# Flog Txt Version 1 # Analyzer Version: 4.6.0 # Analyzer Build Date: Jul 8 2022 06:26:21 # Log Creation Date: 05.08.2022 18:11:00.191 Process: id = "1" image_name = "a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe" filename = "c:\\users\\rdhj0cnfevzx\\desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe" page_root = "0x27829000" os_pid = "0x11b4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x7b4" cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe\" " cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fa87" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 117 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 118 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 119 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 120 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 121 start_va = 0xa0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 122 start_va = 0x1a0000 end_va = 0x1a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 123 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 124 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 125 start_va = 0x400000 end_va = 0x470fff monitored = 1 entry_point = 0x40b2b0 region_type = mapped_file name = "a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe") Region: id = 126 start_va = 0x771d0000 end_va = 0x7734afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 127 start_va = 0x7ffb0000 end_va = 0x7ffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 128 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 129 start_va = 0x7fff0000 end_va = 0x7ffa1676ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 130 start_va = 0x7ffa16770000 end_va = 0x7ffa16930fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 131 start_va = 0x7ffa16931000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffa16931000" filename = "" Region: id = 270 start_va = 0x1c0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 271 start_va = 0x640d0000 end_va = 0x6411ffff monitored = 0 entry_point = 0x640e8180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 272 start_va = 0x64050000 end_va = 0x640c9fff monitored = 0 entry_point = 0x64063290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 273 start_va = 0x76720000 end_va = 0x767fffff monitored = 0 entry_point = 0x76733980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 274 start_va = 0x64120000 end_va = 0x64127fff monitored = 0 entry_point = 0x641217c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 275 start_va = 0x480000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 276 start_va = 0x76720000 end_va = 0x767fffff monitored = 0 entry_point = 0x76733980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 277 start_va = 0x76910000 end_va = 0x76a8dfff monitored = 0 entry_point = 0x769c1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 278 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 279 start_va = 0x7feb0000 end_va = 0x7ffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 280 start_va = 0x480000 end_va = 0x53dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 281 start_va = 0x630000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 282 start_va = 0x73e50000 end_va = 0x73ee1fff monitored = 0 entry_point = 0x73e90380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 283 start_va = 0x7fb00000 end_va = 0x7fea0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 284 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 285 start_va = 0x743d0000 end_va = 0x74516fff monitored = 0 entry_point = 0x743e1cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 286 start_va = 0x74ab0000 end_va = 0x74bfefff monitored = 0 entry_point = 0x74b66820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 287 start_va = 0x540000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 288 start_va = 0x730000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 289 start_va = 0x76600000 end_va = 0x7667afff monitored = 0 entry_point = 0x7661e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 290 start_va = 0x76a90000 end_va = 0x76b4dfff monitored = 0 entry_point = 0x76ac5630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 291 start_va = 0x76cb0000 end_va = 0x76cf3fff monitored = 0 entry_point = 0x76cc9d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 292 start_va = 0x76c00000 end_va = 0x76cacfff monitored = 0 entry_point = 0x76c14f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 293 start_va = 0x73f00000 end_va = 0x73f1dfff monitored = 0 entry_point = 0x73f0b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 294 start_va = 0x73ef0000 end_va = 0x73ef9fff monitored = 0 entry_point = 0x73ef2a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 295 start_va = 0x76840000 end_va = 0x76897fff monitored = 0 entry_point = 0x768825c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 296 start_va = 0x580000 end_va = 0x5a9fff monitored = 0 entry_point = 0x585680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 297 start_va = 0x830000 end_va = 0x9b7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000830000" filename = "" Region: id = 298 start_va = 0x741b0000 end_va = 0x741dafff monitored = 0 entry_point = 0x741b5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 299 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 300 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 301 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 302 start_va = 0x580000 end_va = 0x60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 303 start_va = 0x9c0000 end_va = 0xb40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009c0000" filename = "" Region: id = 304 start_va = 0xb50000 end_va = 0x1f4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b50000" filename = "" Region: id = 305 start_va = 0x1f50000 end_va = 0x214ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f50000" filename = "" Region: id = 306 start_va = 0x6f8a0000 end_va = 0x6f8a5fff monitored = 0 entry_point = 0x6f8a1490 region_type = mapped_file name = "msimg32.dll" filename = "\\Windows\\SysWOW64\\msimg32.dll" (normalized: "c:\\windows\\syswow64\\msimg32.dll") Region: id = 307 start_va = 0x2150000 end_va = 0x294ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002150000" filename = "" Region: id = 308 start_va = 0x1e0000 end_va = 0x1e4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 309 start_va = 0x1e0000 end_va = 0x1e4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 310 start_va = 0x580000 end_va = 0x5b7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 311 start_va = 0x600000 end_va = 0x60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 312 start_va = 0x5c0000 end_va = 0x5f6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 313 start_va = 0x74dc0000 end_va = 0x74eaafff monitored = 0 entry_point = 0x74dfd650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 314 start_va = 0x762b0000 end_va = 0x7646cfff monitored = 0 entry_point = 0x76392a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 315 start_va = 0x1f50000 end_va = 0x1fe0fff monitored = 0 entry_point = 0x1f88cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 316 start_va = 0x2140000 end_va = 0x214ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 317 start_va = 0x76680000 end_va = 0x76711fff monitored = 0 entry_point = 0x766b8cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 318 start_va = 0x6f7e0000 end_va = 0x6f89efff monitored = 0 entry_point = 0x6f7f1dfc region_type = mapped_file name = "msvcr100.dll" filename = "\\Windows\\SysWOW64\\msvcr100.dll" (normalized: "c:\\windows\\syswow64\\msvcr100.dll") Region: id = 319 start_va = 0x1f50000 end_va = 0x20dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f50000" filename = "" Region: id = 320 start_va = 0x1e0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 321 start_va = 0x76d50000 end_va = 0x76d5bfff monitored = 0 entry_point = 0x76d53930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 322 start_va = 0x72cb0000 end_va = 0x72d24fff monitored = 0 entry_point = 0x72ce9a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 323 start_va = 0x1f50000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f50000" filename = "" Region: id = 324 start_va = 0x20d0000 end_va = 0x20dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020d0000" filename = "" Region: id = 325 start_va = 0x2150000 end_va = 0x294ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002150000" filename = "" Region: id = 326 start_va = 0x1e0000 end_va = 0x1e5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 327 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 328 start_va = 0x1e0000 end_va = 0x1e5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 329 start_va = 0x1e0000 end_va = 0x1e5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 330 start_va = 0x1e0000 end_va = 0x1e5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 331 start_va = 0x1e0000 end_va = 0x1e5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 332 start_va = 0x1e0000 end_va = 0x1e5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 333 start_va = 0x1e0000 end_va = 0x1e5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 334 start_va = 0x1e0000 end_va = 0x1e5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 335 start_va = 0x1e0000 end_va = 0x1e5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 336 start_va = 0x1e0000 end_va = 0x1e5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 337 start_va = 0x1e0000 end_va = 0x1e5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 338 start_va = 0x1e0000 end_va = 0x1e5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 339 start_va = 0x1e0000 end_va = 0x1e5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 340 start_va = 0x1e0000 end_va = 0x1e5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 341 start_va = 0x1e0000 end_va = 0x1e5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 342 start_va = 0x1e0000 end_va = 0x1e5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 343 start_va = 0x1e0000 end_va = 0x1e5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 344 start_va = 0x1e0000 end_va = 0x1e5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 345 start_va = 0x1e0000 end_va = 0x1e5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 346 start_va = 0x1e0000 end_va = 0x1e5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 347 start_va = 0x1e0000 end_va = 0x1e5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 348 start_va = 0x1e0000 end_va = 0x1e5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 349 start_va = 0x1e0000 end_va = 0x1e5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 350 start_va = 0x1e0000 end_va = 0x1e5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 351 start_va = 0x2150000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002150000" filename = "" Region: id = 352 start_va = 0x6f780000 end_va = 0x6f7d8fff monitored = 1 entry_point = 0x6f790780 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 353 start_va = 0x2250000 end_va = 0x238ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 354 start_va = 0x6f700000 end_va = 0x6f77cfff monitored = 1 entry_point = 0x6f710db0 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 355 start_va = 0x6f010000 end_va = 0x6f6f0fff monitored = 1 entry_point = 0x6f03cd70 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 356 start_va = 0x76d00000 end_va = 0x76d44fff monitored = 0 entry_point = 0x76d1de90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 357 start_va = 0x6ef10000 end_va = 0x6f004fff monitored = 0 entry_point = 0x6ef64160 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll") Region: id = 358 start_va = 0x5c0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 359 start_va = 0x2250000 end_va = 0x234ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 360 start_va = 0x2380000 end_va = 0x238ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002380000" filename = "" Region: id = 361 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 362 start_va = 0x610000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 363 start_va = 0x620000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 364 start_va = 0x1f50000 end_va = 0x1f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f50000" filename = "" Region: id = 365 start_va = 0x2020000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 366 start_va = 0x1f60000 end_va = 0x1f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f60000" filename = "" Region: id = 367 start_va = 0x1f70000 end_va = 0x1f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 368 start_va = 0x1f80000 end_va = 0x1f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f80000" filename = "" Region: id = 369 start_va = 0x1f90000 end_va = 0x1f90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f90000" filename = "" Region: id = 370 start_va = 0x1fa0000 end_va = 0x1fa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fa0000" filename = "" Region: id = 371 start_va = 0x2390000 end_va = 0x249ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 372 start_va = 0x24a0000 end_va = 0x267ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 373 start_va = 0x1fb0000 end_va = 0x1feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fb0000" filename = "" Region: id = 374 start_va = 0x2390000 end_va = 0x248ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 375 start_va = 0x2490000 end_va = 0x249ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002490000" filename = "" Region: id = 376 start_va = 0x1ff0000 end_va = 0x1ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ff0000" filename = "" Region: id = 377 start_va = 0x2680000 end_va = 0x467ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002680000" filename = "" Region: id = 378 start_va = 0x2030000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002030000" filename = "" Region: id = 379 start_va = 0x20e0000 end_va = 0x211ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 380 start_va = 0x24a0000 end_va = 0x259ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 381 start_va = 0x2670000 end_va = 0x267ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002670000" filename = "" Region: id = 382 start_va = 0x4680000 end_va = 0x49b6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 383 start_va = 0x6dc50000 end_va = 0x6ef01fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\7582400666d289c016013ad0f6e0e3e6\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\7582400666d289c016013ad0f6e0e3e6\\mscorlib.ni.dll") Region: id = 384 start_va = 0x49c0000 end_va = 0x4b1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049c0000" filename = "" Region: id = 385 start_va = 0x1ff0000 end_va = 0x1ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ff0000" filename = "" Region: id = 386 start_va = 0x2000000 end_va = 0x200ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002000000" filename = "" Region: id = 387 start_va = 0x2350000 end_va = 0x237afff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002350000" filename = "" Region: id = 388 start_va = 0x70ac0000 end_va = 0x70ad2fff monitored = 0 entry_point = 0x70ac9950 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 389 start_va = 0x70230000 end_va = 0x7025efff monitored = 0 entry_point = 0x702495e0 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 390 start_va = 0x71560000 end_va = 0x7157afff monitored = 0 entry_point = 0x71569050 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 391 start_va = 0x6dbd0000 end_va = 0x6dc4ffff monitored = 1 entry_point = 0x6dbd1180 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 392 start_va = 0x2010000 end_va = 0x201ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002010000" filename = "" Region: id = 393 start_va = 0x2120000 end_va = 0x212ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002120000" filename = "" Region: id = 394 start_va = 0x6d200000 end_va = 0x6dbcbfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\1be7a15b1f33bf22e4f53aaf45518c77\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\1be7a15b1f33bf22e4f53aaf45518c77\\system.ni.dll") Region: id = 395 start_va = 0x6d070000 end_va = 0x6d1fefff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\1d52bd4ac5e0a6422058a5d62c9f6d9d\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\1d52bd4ac5e0a6422058a5d62c9f6d9d\\system.drawing.ni.dll") Region: id = 396 start_va = 0x6c400000 end_va = 0x6d066fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\fb06ad4bc55b9c3ca68a3f9259d826cd\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\fb06ad4bc55b9c3ca68a3f9259d826cd\\system.windows.forms.ni.dll") Region: id = 397 start_va = 0x2120000 end_va = 0x212ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002120000" filename = "" Region: id = 398 start_va = 0x25a0000 end_va = 0x25c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000025a0000" filename = "" Region: id = 399 start_va = 0x2120000 end_va = 0x212ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002120000" filename = "" Region: id = 400 start_va = 0x2130000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002130000" filename = "" Region: id = 401 start_va = 0x25d0000 end_va = 0x25dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025d0000" filename = "" Region: id = 402 start_va = 0x25e0000 end_va = 0x25effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025e0000" filename = "" Region: id = 403 start_va = 0x25f0000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 404 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 405 start_va = 0x2610000 end_va = 0x261ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002610000" filename = "" Region: id = 406 start_va = 0x2620000 end_va = 0x262ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002620000" filename = "" Region: id = 407 start_va = 0x2630000 end_va = 0x263ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002630000" filename = "" Region: id = 408 start_va = 0x2640000 end_va = 0x264ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002640000" filename = "" Region: id = 409 start_va = 0x2650000 end_va = 0x265ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002650000" filename = "" Region: id = 410 start_va = 0x2660000 end_va = 0x266ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002660000" filename = "" Region: id = 411 start_va = 0x49c0000 end_va = 0x49cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049c0000" filename = "" Region: id = 412 start_va = 0x49d0000 end_va = 0x49dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049d0000" filename = "" Region: id = 413 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 414 start_va = 0x49f0000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049f0000" filename = "" Region: id = 415 start_va = 0x4a00000 end_va = 0x4a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a00000" filename = "" Region: id = 416 start_va = 0x4b10000 end_va = 0x4b1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b10000" filename = "" Region: id = 417 start_va = 0x4a10000 end_va = 0x4a1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a10000" filename = "" Region: id = 418 start_va = 0x4a20000 end_va = 0x4a2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a20000" filename = "" Region: id = 419 start_va = 0x4a30000 end_va = 0x4a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a30000" filename = "" Region: id = 420 start_va = 0x4a40000 end_va = 0x4a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a40000" filename = "" Region: id = 421 start_va = 0x4a50000 end_va = 0x4a5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a50000" filename = "" Region: id = 422 start_va = 0x4a60000 end_va = 0x4a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a60000" filename = "" Region: id = 423 start_va = 0x4a70000 end_va = 0x4a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a70000" filename = "" Region: id = 424 start_va = 0x4a80000 end_va = 0x4a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a80000" filename = "" Region: id = 425 start_va = 0x4a90000 end_va = 0x4a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a90000" filename = "" Region: id = 426 start_va = 0x4aa0000 end_va = 0x4aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004aa0000" filename = "" Region: id = 427 start_va = 0x4ab0000 end_va = 0x4abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ab0000" filename = "" Region: id = 428 start_va = 0x4ac0000 end_va = 0x4acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ac0000" filename = "" Region: id = 429 start_va = 0x4ad0000 end_va = 0x4adffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ad0000" filename = "" Region: id = 430 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 431 start_va = 0x4b20000 end_va = 0x4b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b20000" filename = "" Region: id = 432 start_va = 0x4af0000 end_va = 0x4afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004af0000" filename = "" Region: id = 433 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 434 start_va = 0x4b50000 end_va = 0x4b5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b50000" filename = "" Region: id = 435 start_va = 0x4b60000 end_va = 0x4b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b60000" filename = "" Region: id = 436 start_va = 0x4b70000 end_va = 0x4b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b70000" filename = "" Region: id = 437 start_va = 0x764d0000 end_va = 0x764d5fff monitored = 0 entry_point = 0x764d1460 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 438 start_va = 0x6c3f0000 end_va = 0x6c3f7fff monitored = 0 entry_point = 0x6c3f17b0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 439 start_va = 0x25d0000 end_va = 0x25d4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll" filename = "\\Windows\\SysWOW64\\winnlsres.dll" (normalized: "c:\\windows\\syswow64\\winnlsres.dll") Region: id = 440 start_va = 0x25e0000 end_va = 0x25effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\winnlsres.dll.mui") Region: id = 441 start_va = 0x6bcc0000 end_va = 0x6c3e0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\eb4cca4f06a15158c3f7e2c56516729b\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\eb4cca4f06a15158c3f7e2c56516729b\\system.core.ni.dll") Region: id = 442 start_va = 0x6b8d0000 end_va = 0x6bcb2fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "windowsbase.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\WindowsBase\\9a2107b30cbb02ca475f58ed046eff63\\WindowsBase.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\windowsbase\\9a2107b30cbb02ca475f58ed046eff63\\windowsbase.ni.dll") Region: id = 443 start_va = 0x6adb0000 end_va = 0x6b8c8fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "presentationcore.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\PresentationCore\\d7a637fdf68801e37fc897b530f9a8a6\\PresentationCore.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\presentationcore\\d7a637fdf68801e37fc897b530f9a8a6\\presentationcore.ni.dll") Region: id = 444 start_va = 0x69b10000 end_va = 0x6ada2fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "presentationframework.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Presentatio5ae0f00f#\\56617af3d6fd992497999aec2be809a4\\PresentationFramework.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\presentatio5ae0f00f#\\56617af3d6fd992497999aec2be809a4\\presentationframework.ni.dll") Region: id = 445 start_va = 0x70d10000 end_va = 0x70f00fff monitored = 0 entry_point = 0x70df3cd0 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\SysWOW64\\DWrite.dll" (normalized: "c:\\windows\\syswow64\\dwrite.dll") Region: id = 446 start_va = 0x69960000 end_va = 0x69b0efff monitored = 1 entry_point = 0x69984930 region_type = mapped_file name = "wpfgfx_v0400.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\wpfgfx_v0400.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\wpf\\wpfgfx_v0400.dll") Region: id = 447 start_va = 0x69890000 end_va = 0x69958fff monitored = 1 entry_point = 0x698b81f0 region_type = mapped_file name = "presentationnative_v0400.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\PresentationNative_v0400.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\wpf\\presentationnative_v0400.dll") Region: id = 448 start_va = 0x25f0000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 449 start_va = 0x515c0000 end_va = 0x51bc1fff monitored = 1 entry_point = 0x51b9ddaa region_type = mapped_file name = "system.servicemodel.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.ServiceModel\\v4.0_4.0.0.0__b77a5c561934e089\\System.ServiceModel.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.servicemodel\\v4.0_4.0.0.0__b77a5c561934e089\\system.servicemodel.dll") Region: id = 450 start_va = 0x4b20000 end_va = 0x5121fff monitored = 1 entry_point = 0x50fddaa region_type = mapped_file name = "system.servicemodel.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.ServiceModel\\v4.0_4.0.0.0__b77a5c561934e089\\System.ServiceModel.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.servicemodel\\v4.0_4.0.0.0__b77a5c561934e089\\system.servicemodel.dll") Region: id = 451 start_va = 0x25f0000 end_va = 0x262ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 452 start_va = 0x2630000 end_va = 0x263ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002630000" filename = "" Region: id = 453 start_va = 0x2640000 end_va = 0x264ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002640000" filename = "" Region: id = 454 start_va = 0x2650000 end_va = 0x265ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002650000" filename = "" Region: id = 455 start_va = 0x2660000 end_va = 0x266ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002660000" filename = "" Region: id = 456 start_va = 0x2660000 end_va = 0x266ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002660000" filename = "" Region: id = 457 start_va = 0x69870000 end_va = 0x6988dfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "smdiagnostics.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\SMDiagnostics\\cde471ea4f02c36c73581ed5681e463e\\SMDiagnostics.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\smdiagnostics\\cde471ea4f02c36c73581ed5681e463e\\smdiagnostics.ni.dll") Region: id = 458 start_va = 0x2660000 end_va = 0x266ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002660000" filename = "" Region: id = 459 start_va = 0x49c0000 end_va = 0x49cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049c0000" filename = "" Region: id = 460 start_va = 0x49c0000 end_va = 0x49cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049c0000" filename = "" Region: id = 461 start_va = 0x50ea0000 end_va = 0x50fa5fff monitored = 1 entry_point = 0x50fa09a2 region_type = mapped_file name = "system.identitymodel.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.IdentityModel\\v4.0_4.0.0.0__b77a5c561934e089\\System.IdentityModel.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.identitymodel\\v4.0_4.0.0.0__b77a5c561934e089\\system.identitymodel.dll") Region: id = 462 start_va = 0x49c0000 end_va = 0x4ac5fff monitored = 1 entry_point = 0x4ac09a2 region_type = mapped_file name = "system.identitymodel.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.IdentityModel\\v4.0_4.0.0.0__b77a5c561934e089\\System.IdentityModel.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.identitymodel\\v4.0_4.0.0.0__b77a5c561934e089\\system.identitymodel.dll") Region: id = 463 start_va = 0x4ad0000 end_va = 0x4adffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ad0000" filename = "" Region: id = 464 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 465 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 466 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 467 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 468 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 469 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 470 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 471 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 472 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 473 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 474 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 475 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 476 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 477 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 478 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 479 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 480 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 481 start_va = 0x4af0000 end_va = 0x4afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004af0000" filename = "" Region: id = 482 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 483 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 484 start_va = 0x695c0000 end_va = 0x6986efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.runtime.serialization.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Runteb92aa12#\\9b0d0cb232dec8e57df49678532cb923\\System.Runtime.Serialization.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.runteb92aa12#\\9b0d0cb232dec8e57df49678532cb923\\system.runtime.serialization.ni.dll") Region: id = 485 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 486 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 487 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 488 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 489 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 490 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 491 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 492 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 493 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 494 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 495 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 496 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 497 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 498 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 499 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 500 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 501 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 502 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 503 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 504 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 505 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 506 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 507 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 508 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 509 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 510 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 511 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 512 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 513 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 514 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 515 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 516 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 517 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 518 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 519 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 520 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 521 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 522 start_va = 0x68ea0000 end_va = 0x695bdfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\4fbda26d781323081b45526da6e87b35\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\4fbda26d781323081b45526da6e87b35\\system.xml.ni.dll") Region: id = 523 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 524 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 525 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 526 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 527 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 528 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 529 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 530 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 531 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 532 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 533 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 534 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 535 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 536 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 537 start_va = 0x68dd0000 end_va = 0x68e92fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.servicemodel.internals.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Servd1dec626#\\1348a5d04b41c614e48fe5fdb88d1cfa\\System.ServiceModel.Internals.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.servd1dec626#\\1348a5d04b41c614e48fe5fdb88d1cfa\\system.servicemodel.internals.ni.dll") Region: id = 538 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 539 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 540 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 541 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 542 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 543 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 544 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 545 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 546 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 547 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 548 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 549 start_va = 0x68cd0000 end_va = 0x68dc0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\fe4b221b4109f0c78f57a792500699b5\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\fe4b221b4109f0c78f57a792500699b5\\system.configuration.ni.dll") Region: id = 550 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 551 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 552 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 553 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 554 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 555 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 556 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 557 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 558 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 559 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 560 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 561 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 562 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 563 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 564 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 565 start_va = 0x68c20000 end_va = 0x68ccefff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.transactions.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Transactions\\69b67a0435275c1ec53e3bdf64a063b1\\System.Transactions.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.transactions\\69b67a0435275c1ec53e3bdf64a063b1\\system.transactions.ni.dll") Region: id = 566 start_va = 0x68bd0000 end_va = 0x68c1afff monitored = 1 entry_point = 0x68bef8c2 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 567 start_va = 0x5130000 end_va = 0x517bfff monitored = 1 entry_point = 0x514f8c2 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 568 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 569 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 570 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 571 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 572 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 573 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 574 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 575 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 576 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 577 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 578 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 579 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 580 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 581 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 582 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 583 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 584 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 585 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 586 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 587 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 588 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 589 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 590 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 591 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 592 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 593 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 594 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 595 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 596 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 597 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 598 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 599 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 600 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 601 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 602 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 603 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 604 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 605 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 606 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 607 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 608 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 609 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 610 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 611 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 612 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 613 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 614 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 615 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 616 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 617 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 618 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 619 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 620 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 621 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 622 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 623 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 624 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 625 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 626 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 627 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 628 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 629 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 630 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 631 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 632 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 633 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 634 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 635 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 636 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 637 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 638 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 639 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 640 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 641 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 642 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 643 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 644 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 645 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 646 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 647 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 648 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 649 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 650 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 651 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 652 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 653 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 654 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 655 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 656 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 657 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 658 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 659 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 660 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 661 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 662 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 663 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 664 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 665 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 666 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 667 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 668 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 669 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 670 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 671 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 672 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 673 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 674 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 675 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 676 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 677 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 678 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 679 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 680 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 681 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 682 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 683 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 684 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 685 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 686 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 687 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 688 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 689 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 690 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 691 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 692 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 693 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 694 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 695 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 696 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 697 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 698 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 699 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 700 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 701 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 702 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 703 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 704 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 705 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 706 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 707 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 708 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 709 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 710 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 711 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 712 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 713 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 714 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 715 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 716 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 717 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 718 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 719 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 720 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 721 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 722 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 723 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 724 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 725 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 726 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 727 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 728 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 729 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 730 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 731 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 732 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 733 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 734 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 735 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 736 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 737 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 738 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 739 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 740 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 741 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 742 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 743 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 744 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 745 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 746 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 747 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 748 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 749 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 750 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 751 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 752 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 753 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 754 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 755 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 756 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 757 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 758 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 759 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 760 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 761 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 762 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 763 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 764 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 765 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 766 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 767 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 768 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 769 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 770 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 771 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 772 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 773 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 774 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 775 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 776 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 777 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 778 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 779 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 780 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 781 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 782 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 783 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 784 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 785 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 786 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 787 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 788 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 789 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 790 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 791 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 792 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 793 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 794 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 795 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 796 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 797 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 798 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 799 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 800 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 801 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 802 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 803 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 804 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 805 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 806 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 807 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 808 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 809 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 810 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 811 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 812 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 813 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 814 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 815 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 816 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 817 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 818 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 819 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 820 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 821 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 822 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 823 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 824 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 825 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 826 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 827 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 828 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 829 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 830 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 831 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 832 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 833 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 834 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 835 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 836 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 837 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 838 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 839 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 840 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 841 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 842 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 843 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 844 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 845 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 846 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 847 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 848 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 849 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 850 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 851 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 852 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 853 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 854 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 855 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 856 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 857 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 858 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 859 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 860 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 861 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 862 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 863 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 864 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 865 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 866 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 867 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 868 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 869 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 870 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 871 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 872 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 873 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 874 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 875 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 876 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 877 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 878 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 879 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 880 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 881 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 882 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 883 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 884 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 885 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 886 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 887 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 888 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 889 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 890 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 891 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 892 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 893 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 894 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 895 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 896 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 897 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 898 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 899 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 900 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 901 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 902 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 903 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 904 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 905 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 906 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 907 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 908 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 909 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 910 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 911 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 912 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 913 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 914 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 915 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 916 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 917 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 918 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 919 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 920 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 921 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 922 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 923 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 924 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 925 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 926 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 927 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 928 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 929 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 930 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 931 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 932 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 933 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 934 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 935 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 936 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 937 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 938 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 939 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 940 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 941 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 942 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 943 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 944 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 945 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 946 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 947 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 948 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 949 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 950 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 951 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 952 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 953 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 954 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 955 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 956 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 957 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 958 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 959 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 960 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 961 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 962 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 963 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 964 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 965 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 966 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 967 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 968 start_va = 0x5190000 end_va = 0x519ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005190000" filename = "" Region: id = 969 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 970 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 971 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 972 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 973 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 974 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 975 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 976 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 977 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 978 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 979 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 980 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 981 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 982 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 983 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 984 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 985 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 986 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 987 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 988 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 989 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 990 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 991 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 992 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 993 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 994 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 995 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 996 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 997 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 998 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 999 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1000 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1001 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1002 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1003 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1004 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1005 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1006 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1007 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1008 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1009 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1010 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1011 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1012 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1013 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1014 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1015 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1016 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1017 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1018 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1019 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1020 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1021 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1022 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1023 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1024 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1025 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1026 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1027 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1028 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1029 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1030 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1031 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1032 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1033 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1034 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1035 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1036 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1037 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1038 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1039 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1040 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1041 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1042 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1043 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1044 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1045 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1046 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1047 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1048 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1049 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1050 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1051 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1052 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1053 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1054 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1055 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1056 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1057 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1058 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1059 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1060 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1061 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1062 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1063 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1064 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1065 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1066 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1067 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 1068 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 1069 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1070 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1071 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1072 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1073 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1074 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1075 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1076 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 1077 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1078 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1079 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1080 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1081 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1082 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1083 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1084 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1085 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1086 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1087 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1088 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1089 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1090 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1091 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1092 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 1093 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1094 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1095 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1096 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1097 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 1098 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 1099 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 1100 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 1101 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1102 start_va = 0x5190000 end_va = 0x519ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005190000" filename = "" Region: id = 1103 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 1104 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1105 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1106 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1107 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1108 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1109 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1110 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1111 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1112 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1113 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1114 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1115 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1116 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1117 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1118 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1119 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1120 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1121 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1122 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1123 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1124 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1125 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1126 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1127 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1128 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1129 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1130 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1131 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1132 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1133 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1134 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1135 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1136 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1137 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1138 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1139 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1140 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1141 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1142 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1143 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1144 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1145 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1146 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1147 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1148 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1149 start_va = 0x5190000 end_va = 0x519ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005190000" filename = "" Region: id = 1150 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1151 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1152 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1153 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1154 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1155 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1156 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1157 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1158 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1159 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1160 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1161 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1162 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1163 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1164 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1165 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1166 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1167 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1168 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1169 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1170 start_va = 0x51a0000 end_va = 0x51affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051a0000" filename = "" Region: id = 1171 start_va = 0x51b0000 end_va = 0x51bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051b0000" filename = "" Region: id = 1172 start_va = 0x51c0000 end_va = 0x51cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051c0000" filename = "" Region: id = 1173 start_va = 0x51d0000 end_va = 0x51dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 1174 start_va = 0x51e0000 end_va = 0x51effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051e0000" filename = "" Region: id = 1175 start_va = 0x51f0000 end_va = 0x51fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051f0000" filename = "" Region: id = 1176 start_va = 0x5200000 end_va = 0x520ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005200000" filename = "" Region: id = 1177 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1178 start_va = 0x5220000 end_va = 0x522ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 1179 start_va = 0x5230000 end_va = 0x523ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 1180 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 1181 start_va = 0x51a0000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051a0000" filename = "" Region: id = 1182 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1183 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1184 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1185 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1186 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1187 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1188 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1189 start_va = 0x52a0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1190 start_va = 0x52e0000 end_va = 0x53dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052e0000" filename = "" Region: id = 1191 start_va = 0x53e0000 end_va = 0x541ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000053e0000" filename = "" Region: id = 1192 start_va = 0x5420000 end_va = 0x551ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005420000" filename = "" Region: id = 1193 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1194 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1195 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1196 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1197 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1198 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1199 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1200 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1201 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1202 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1203 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1204 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1205 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1206 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1207 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1208 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1209 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1210 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1211 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1212 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1213 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1214 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1215 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1216 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1217 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1218 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1219 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1220 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1221 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1222 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1223 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1224 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1225 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1226 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1227 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1228 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1229 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1230 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1231 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1232 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1233 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1234 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1235 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1236 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1237 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1238 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1239 start_va = 0x5520000 end_va = 0x552ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005520000" filename = "" Region: id = 1240 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1241 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1242 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1243 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1244 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1245 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1246 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1247 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1248 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1249 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1250 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1251 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1252 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1253 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1254 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1255 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1256 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1257 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1258 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1259 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1260 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1261 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1262 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1263 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1264 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1265 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1266 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1267 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1268 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1269 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1270 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1271 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1272 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1273 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1274 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1275 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1276 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1277 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1278 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1279 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1280 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1281 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1282 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1283 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1284 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1285 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1286 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1287 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1288 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1289 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1290 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1291 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1292 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1293 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1294 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1295 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1296 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1297 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1298 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1299 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1300 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1301 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1302 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1303 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1304 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1305 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1306 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1307 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1308 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1309 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1310 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1311 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1312 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1313 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1314 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1315 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1316 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1317 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1318 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1319 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1320 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1321 start_va = 0x7fe60000 end_va = 0x7feaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fe60000" filename = "" Region: id = 1322 start_va = 0x7fe50000 end_va = 0x7fe5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fe50000" filename = "" Region: id = 1323 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1324 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1325 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1326 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1327 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1328 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1329 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1330 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1331 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1332 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1333 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1334 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1335 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1336 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1337 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1338 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1339 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1340 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1341 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1342 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1343 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1344 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1345 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1346 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1347 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1348 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1349 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1350 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1351 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1352 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1353 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1354 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1355 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1356 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1357 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1358 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1359 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1360 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1361 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1362 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1363 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1364 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1365 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1366 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1367 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1368 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1369 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1370 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1371 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1372 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1373 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1374 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1375 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1376 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1377 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1378 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1379 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1380 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1381 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1382 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1383 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1384 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1385 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1386 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1387 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1388 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1389 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1390 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1391 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1392 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1393 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1394 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1395 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1396 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1397 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1398 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1399 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1400 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1401 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1402 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1403 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1404 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1405 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1406 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1407 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1408 start_va = 0x5540000 end_va = 0x554ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005540000" filename = "" Region: id = 1409 start_va = 0x5540000 end_va = 0x554ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005540000" filename = "" Region: id = 1410 start_va = 0x5540000 end_va = 0x554ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005540000" filename = "" Region: id = 1411 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1412 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1413 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1414 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1415 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1416 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1417 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1418 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1419 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1420 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1421 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1422 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1423 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1424 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1425 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1426 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1427 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1428 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1429 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1430 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1431 start_va = 0x5540000 end_va = 0x554ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005540000" filename = "" Region: id = 1432 start_va = 0x5540000 end_va = 0x554ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005540000" filename = "" Region: id = 1433 start_va = 0x5540000 end_va = 0x554ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005540000" filename = "" Region: id = 1434 start_va = 0x5540000 end_va = 0x554ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005540000" filename = "" Region: id = 1435 start_va = 0x5540000 end_va = 0x554ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005540000" filename = "" Region: id = 1436 start_va = 0x5540000 end_va = 0x554ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005540000" filename = "" Region: id = 1437 start_va = 0x5540000 end_va = 0x554ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005540000" filename = "" Region: id = 1438 start_va = 0x5540000 end_va = 0x554ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005540000" filename = "" Region: id = 1439 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1440 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1441 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1442 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1443 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1444 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1445 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1446 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1447 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1448 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1449 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1450 start_va = 0x5540000 end_va = 0x554ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005540000" filename = "" Region: id = 1451 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1452 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1453 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1454 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1455 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1456 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1457 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1458 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1459 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1460 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1461 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1462 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1463 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1464 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1465 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1466 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1467 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1468 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1469 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1470 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1471 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1472 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1473 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1474 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1475 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1476 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1477 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1478 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1479 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1480 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1481 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1482 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1483 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1484 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1485 start_va = 0x5540000 end_va = 0x554ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005540000" filename = "" Region: id = 1486 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1487 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1488 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1489 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1490 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1491 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1492 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1493 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1494 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1495 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1496 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1497 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1498 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1499 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1500 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1501 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1502 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1503 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1504 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1505 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1506 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1507 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1508 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1509 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1510 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1511 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1512 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1513 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1514 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1515 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1516 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1517 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1518 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1519 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1520 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1521 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1522 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1523 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1524 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1525 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1526 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1527 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1528 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1529 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1530 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1531 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1532 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1533 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1534 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1535 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1536 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1537 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1538 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1539 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1540 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1541 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1542 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1543 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1544 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1545 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1546 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1547 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1548 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1549 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1550 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1551 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1552 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1553 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1554 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1555 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1556 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1557 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1558 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1559 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1560 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1561 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1562 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1563 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1564 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1565 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1566 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1567 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1568 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1569 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1570 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1571 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1572 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1573 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1574 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1575 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1576 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1577 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1578 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1579 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1580 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1581 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1582 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1583 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1584 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1585 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1586 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1587 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1588 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1589 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1590 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1591 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1592 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1593 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1594 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1595 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1596 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1597 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1598 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1599 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1600 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1601 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1602 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1603 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1604 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1605 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1606 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1607 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1608 start_va = 0x5540000 end_va = 0x554ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005540000" filename = "" Region: id = 1609 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1610 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1611 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1612 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1613 start_va = 0x5540000 end_va = 0x554ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005540000" filename = "" Region: id = 1614 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1615 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1616 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1617 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1618 start_va = 0x73f30000 end_va = 0x73f8efff monitored = 0 entry_point = 0x73f34af0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 1619 start_va = 0x71420000 end_va = 0x7146efff monitored = 0 entry_point = 0x7142d850 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 1620 start_va = 0x70a30000 end_va = 0x70ab3fff monitored = 0 entry_point = 0x70a56530 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 1621 start_va = 0x76900000 end_va = 0x76906fff monitored = 0 entry_point = 0x76901e10 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 1622 start_va = 0x6f9e0000 end_va = 0x6f9e7fff monitored = 0 entry_point = 0x6f9e1920 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 1623 start_va = 0x71510000 end_va = 0x7153efff monitored = 0 entry_point = 0x7151bb70 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 1624 start_va = 0x6f9f0000 end_va = 0x6fa36fff monitored = 0 entry_point = 0x6fa058d0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 1625 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1626 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1627 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1628 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1629 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1630 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1631 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1632 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1633 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1634 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1635 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1636 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1637 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1638 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1639 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1640 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1641 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1642 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1643 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1644 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1645 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1646 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1647 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1648 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1649 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1650 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1651 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1652 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1653 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1654 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1655 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1656 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1657 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1658 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1659 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1660 start_va = 0x5530000 end_va = 0x553ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 1661 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1662 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1663 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1664 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1665 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1666 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1667 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1668 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1669 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1670 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1671 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1672 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1673 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1674 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1675 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1676 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1677 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1678 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1679 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1680 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1681 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1682 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1683 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1684 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1685 start_va = 0x5560000 end_va = 0x556ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005560000" filename = "" Region: id = 1686 start_va = 0x5560000 end_va = 0x556ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005560000" filename = "" Region: id = 1687 start_va = 0x5560000 end_va = 0x556ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005560000" filename = "" Region: id = 1688 start_va = 0x5560000 end_va = 0x556ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005560000" filename = "" Region: id = 1689 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1690 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1691 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1692 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1693 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1694 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1695 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1696 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1697 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1698 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1699 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1700 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1701 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1702 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1703 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1704 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1705 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1706 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1707 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1708 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1709 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1710 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1711 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1712 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1713 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1714 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1715 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1716 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1717 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1718 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1719 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1720 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1721 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1722 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1723 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1724 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1725 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1726 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1727 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1728 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1729 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1730 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1731 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1732 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1733 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1734 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1735 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1736 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1737 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1738 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1739 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1740 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1741 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1742 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1743 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1744 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1745 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1746 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1747 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1748 start_va = 0x5560000 end_va = 0x556ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005560000" filename = "" Region: id = 1749 start_va = 0x5560000 end_va = 0x556ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005560000" filename = "" Region: id = 1750 start_va = 0x5560000 end_va = 0x556ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005560000" filename = "" Region: id = 1751 start_va = 0x5560000 end_va = 0x556ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005560000" filename = "" Region: id = 1752 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1753 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1754 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1755 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1756 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1757 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1758 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1759 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1760 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1761 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1762 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1763 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1764 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1765 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1766 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1767 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1768 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1769 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1770 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1771 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1772 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1773 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1774 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1775 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1776 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1777 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1778 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1779 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1780 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1781 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1782 start_va = 0x5560000 end_va = 0x556ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005560000" filename = "" Region: id = 1783 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1784 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1785 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1786 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1787 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1788 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1789 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1790 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1791 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1792 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1793 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1794 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1795 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1796 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1797 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1798 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1799 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1800 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1801 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1802 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1803 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1804 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1805 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1806 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1807 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1808 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1809 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1810 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1811 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1812 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1813 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1814 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1815 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1816 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1817 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1818 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1819 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1820 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1821 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1822 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1823 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1824 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1825 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1826 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1827 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1828 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1829 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1830 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1831 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1832 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1833 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1834 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1835 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1836 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1837 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1838 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1839 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1840 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1841 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1842 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1843 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1844 start_va = 0x5570000 end_va = 0x557ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005570000" filename = "" Region: id = 1845 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1846 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1847 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1848 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1849 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1850 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1851 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1852 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1853 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1854 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1855 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1856 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1857 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1858 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1859 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1860 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1861 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1862 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1863 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1864 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1865 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1866 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1867 start_va = 0x5570000 end_va = 0x557ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005570000" filename = "" Region: id = 1868 start_va = 0x5570000 end_va = 0x557ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005570000" filename = "" Region: id = 1869 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1870 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1871 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1872 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1873 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1874 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1875 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1876 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1877 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1878 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1879 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1880 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1881 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1882 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1883 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1884 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1885 start_va = 0x5570000 end_va = 0x557ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005570000" filename = "" Region: id = 1886 start_va = 0x5580000 end_va = 0x558ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005580000" filename = "" Region: id = 1887 start_va = 0x5590000 end_va = 0x559ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005590000" filename = "" Region: id = 1888 start_va = 0x55a0000 end_va = 0x55affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 1889 start_va = 0x55b0000 end_va = 0x55bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000055b0000" filename = "" Region: id = 1890 start_va = 0x55c0000 end_va = 0x55cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000055c0000" filename = "" Region: id = 1891 start_va = 0x55d0000 end_va = 0x55dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000055d0000" filename = "" Region: id = 1892 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1893 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1894 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1895 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1896 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1897 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1898 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1899 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1900 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1901 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1902 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1903 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1904 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1905 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1906 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1907 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1908 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1909 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1910 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1911 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1912 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1913 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1914 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1915 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1916 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1917 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1918 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1919 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1920 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1921 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1922 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1923 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1924 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1925 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1926 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1927 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1928 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1929 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1930 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1931 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1932 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1933 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1934 start_va = 0x5570000 end_va = 0x557ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005570000" filename = "" Region: id = 1935 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1936 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1937 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1938 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1939 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1940 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1941 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1942 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1943 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1944 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1945 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1946 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1947 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1948 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1949 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1950 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1951 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1952 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1953 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1954 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1955 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1956 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1957 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1958 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1959 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1960 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1961 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1962 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1963 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1964 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1965 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1966 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1967 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1968 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1969 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1970 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1971 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1972 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1973 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1974 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1975 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1976 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1977 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1978 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1979 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1980 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1981 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1982 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1983 start_va = 0x5570000 end_va = 0x557ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005570000" filename = "" Region: id = 1984 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1985 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1986 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1987 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1988 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1989 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1990 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1991 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1992 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1993 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1994 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1995 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1996 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1997 start_va = 0x5570000 end_va = 0x557ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005570000" filename = "" Region: id = 1998 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 1999 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2000 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2001 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2002 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2003 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2004 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2005 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2006 start_va = 0x5570000 end_va = 0x557ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005570000" filename = "" Region: id = 2007 start_va = 0x5570000 end_va = 0x557ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005570000" filename = "" Region: id = 2008 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2009 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2010 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2011 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2012 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2013 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2014 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2015 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2016 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2017 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2018 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2019 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2020 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2021 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2022 start_va = 0x5570000 end_va = 0x557ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005570000" filename = "" Region: id = 2023 start_va = 0x5580000 end_va = 0x558ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005580000" filename = "" Region: id = 2024 start_va = 0x5590000 end_va = 0x559ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005590000" filename = "" Region: id = 2025 start_va = 0x55a0000 end_va = 0x55affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 2026 start_va = 0x55b0000 end_va = 0x55bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000055b0000" filename = "" Region: id = 2027 start_va = 0x55c0000 end_va = 0x55cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000055c0000" filename = "" Region: id = 2028 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2029 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2030 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2031 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2032 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2033 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2034 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2035 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2036 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2037 start_va = 0x5550000 end_va = 0x555ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2038 start_va = 0x68bb0000 end_va = 0x68bc2fff monitored = 0 entry_point = 0x68bb25d0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc6.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc6.dll") Region: id = 2039 start_va = 0x68b90000 end_va = 0x68ba3fff monitored = 0 entry_point = 0x68b93c10 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc.dll") Region: id = 2040 start_va = 0x71410000 end_va = 0x71417fff monitored = 0 entry_point = 0x71411fc0 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 2041 start_va = 0x68ae0000 end_va = 0x68b84fff monitored = 0 entry_point = 0x68afac50 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll") Region: id = 2042 start_va = 0x68ab0000 end_va = 0x68ad2fff monitored = 0 entry_point = 0x68ab5570 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll") Region: id = 2043 start_va = 0x68aa0000 end_va = 0x68aaffff monitored = 0 entry_point = 0x68aa3820 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll") Region: id = 2044 start_va = 0x55d0000 end_va = 0x56affff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 2045 start_va = 0x5570000 end_va = 0x55affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005570000" filename = "" Region: id = 2046 start_va = 0x56b0000 end_va = 0x57affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000056b0000" filename = "" Region: id = 2047 start_va = 0x57b0000 end_va = 0x57effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000057b0000" filename = "" Region: id = 2048 start_va = 0x57f0000 end_va = 0x58effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000057f0000" filename = "" Region: id = 2049 start_va = 0x71470000 end_va = 0x7150afff monitored = 0 entry_point = 0x714af7e0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll") Region: id = 2050 start_va = 0x71540000 end_va = 0x71551fff monitored = 0 entry_point = 0x71544510 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\SysWOW64\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\syswow64\\ondemandconnroutehelper.dll") Region: id = 2051 start_va = 0x58f0000 end_va = 0x592ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000058f0000" filename = "" Region: id = 2052 start_va = 0x5930000 end_va = 0x5a2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005930000" filename = "" Region: id = 2053 start_va = 0x5a30000 end_va = 0x5a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a30000" filename = "" Region: id = 2054 start_va = 0x5a70000 end_va = 0x5b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a70000" filename = "" Region: id = 2055 start_va = 0x74eb0000 end_va = 0x762aefff monitored = 0 entry_point = 0x7506b990 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 2056 start_va = 0x76800000 end_va = 0x76836fff monitored = 0 entry_point = 0x76803b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 2057 start_va = 0x745b0000 end_va = 0x74aa8fff monitored = 0 entry_point = 0x747b7610 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 2058 start_va = 0x74520000 end_va = 0x745acfff monitored = 0 entry_point = 0x74569b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 2059 start_va = 0x76470000 end_va = 0x764b3fff monitored = 0 entry_point = 0x76477410 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 2060 start_va = 0x73f20000 end_va = 0x73f2efff monitored = 0 entry_point = 0x73f22e40 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 2061 start_va = 0x5550000 end_va = 0x5553fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 2062 start_va = 0x55b0000 end_va = 0x55b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000055b0000" filename = "" Region: id = 2063 start_va = 0x5b70000 end_va = 0x5b70fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 2064 start_va = 0x5b70000 end_va = 0x5b78fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 2065 start_va = 0x5b70000 end_va = 0x5b70fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 2066 start_va = 0x5b70000 end_va = 0x5b78fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 2067 start_va = 0x5b70000 end_va = 0x5b70fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 2068 start_va = 0x5b70000 end_va = 0x5b78fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 2069 start_va = 0x5b70000 end_va = 0x5b80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005b70000" filename = "" Region: id = 2070 start_va = 0x6fdf0000 end_va = 0x6fdf9fff monitored = 0 entry_point = 0x6fdf3200 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 2071 start_va = 0x6f970000 end_va = 0x6f9d3fff monitored = 0 entry_point = 0x6f98afd0 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll") Region: id = 2072 start_va = 0x73f90000 end_va = 0x74107fff monitored = 0 entry_point = 0x73fe8a90 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 2073 start_va = 0x764c0000 end_va = 0x764cdfff monitored = 0 entry_point = 0x764c5410 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 2074 start_va = 0x6f960000 end_va = 0x6f96ffff monitored = 0 entry_point = 0x6f964600 region_type = mapped_file name = "mskeyprotect.dll" filename = "\\Windows\\SysWOW64\\mskeyprotect.dll" (normalized: "c:\\windows\\syswow64\\mskeyprotect.dll") Region: id = 2075 start_va = 0x6f940000 end_va = 0x6f95ffff monitored = 0 entry_point = 0x6f94d120 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll") Region: id = 2076 start_va = 0x6f910000 end_va = 0x6f93bfff monitored = 0 entry_point = 0x6f92bb10 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\SysWOW64\\ntasn1.dll" (normalized: "c:\\windows\\syswow64\\ntasn1.dll") Region: id = 2077 start_va = 0x6f8f0000 end_va = 0x6f909fff monitored = 0 entry_point = 0x6f8ffa70 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\SysWOW64\\ncryptsslp.dll" (normalized: "c:\\windows\\syswow64\\ncryptsslp.dll") Region: id = 2078 start_va = 0x5b90000 end_va = 0x5bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b90000" filename = "" Region: id = 2079 start_va = 0x5bd0000 end_va = 0x5ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005bd0000" filename = "" Region: id = 2080 start_va = 0x68980000 end_va = 0x68a9cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\98d3949f9ba1a384939805aa5e47e933\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.management\\98d3949f9ba1a384939805aa5e47e933\\system.management.ni.dll") Region: id = 2081 start_va = 0x5cd0000 end_va = 0x5d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005cd0000" filename = "" Region: id = 2082 start_va = 0x5d10000 end_va = 0x5e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d10000" filename = "" Region: id = 2083 start_va = 0x5e10000 end_va = 0x5e10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005e10000" filename = "" Region: id = 2084 start_va = 0x74340000 end_va = 0x743c3fff monitored = 0 entry_point = 0x74366220 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 2085 start_va = 0x5e20000 end_va = 0x5e20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005e20000" filename = "" Region: id = 2086 start_va = 0x68960000 end_va = 0x6897bfff monitored = 0 entry_point = 0x6896aa90 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\SysWOW64\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wmiutils.dll") Region: id = 2087 start_va = 0x688f0000 end_va = 0x68956fff monitored = 0 entry_point = 0x6890b610 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 2088 start_va = 0x5e30000 end_va = 0x5e6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e30000" filename = "" Region: id = 2089 start_va = 0x5e70000 end_va = 0x5f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e70000" filename = "" Region: id = 2090 start_va = 0x688e0000 end_va = 0x688ecfff monitored = 0 entry_point = 0x688e3520 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 2091 start_va = 0x688d0000 end_va = 0x688dafff monitored = 1 entry_point = 0x688d41f0 region_type = mapped_file name = "wminet_utils.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WMINet_Utils.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\wminet_utils.dll") Region: id = 2092 start_va = 0x5f70000 end_va = 0x5f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f70000" filename = "" Region: id = 2093 start_va = 0x5f80000 end_va = 0x5f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f80000" filename = "" Region: id = 2094 start_va = 0x5f90000 end_va = 0x5f9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f90000" filename = "" Region: id = 2608 start_va = 0x688b0000 end_va = 0x688c0fff monitored = 0 entry_point = 0x688b8fa0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 2609 start_va = 0x687f0000 end_va = 0x688aefff monitored = 0 entry_point = 0x68821e80 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 2616 start_va = 0x5f90000 end_va = 0x5f92fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005f90000" filename = "" Region: id = 2617 start_va = 0x68660000 end_va = 0x687e6fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.csharp.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.CSharp\\849e4f93d41f8b6645878090ee9a7505\\Microsoft.CSharp.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.csharp\\849e4f93d41f8b6645878090ee9a7505\\microsoft.csharp.ni.dll") Region: id = 2618 start_va = 0x684f0000 end_va = 0x6865afff monitored = 0 entry_point = 0x6855e360 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\gdiplus.dll") Region: id = 2619 start_va = 0x5f90000 end_va = 0x60effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f90000" filename = "" Region: id = 2620 start_va = 0x5f90000 end_va = 0x5fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f90000" filename = "" Region: id = 2621 start_va = 0x5fd0000 end_va = 0x60cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005fd0000" filename = "" Region: id = 2622 start_va = 0x60e0000 end_va = 0x60effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000060e0000" filename = "" Region: id = 2623 start_va = 0x764e0000 end_va = 0x765fefff monitored = 0 entry_point = 0x76525980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2624 start_va = 0x68490000 end_va = 0x684effff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.dynamic.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Dynamic\\81f3dddd8aa6172d72bf5f1161e6fd01\\System.Dynamic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.dynamic\\81f3dddd8aa6172d72bf5f1161e6fd01\\system.dynamic.ni.dll") Region: id = 2625 start_va = 0x60d0000 end_va = 0x60dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000060d0000" filename = "" Region: id = 2626 start_va = 0x60f0000 end_va = 0x60fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000060f0000" filename = "" Region: id = 2627 start_va = 0x6100000 end_va = 0x610ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006100000" filename = "" Region: id = 2628 start_va = 0x6110000 end_va = 0x611ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006110000" filename = "" Region: id = 2629 start_va = 0x6120000 end_va = 0x612ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006120000" filename = "" Region: id = 2630 start_va = 0x6100000 end_va = 0x610ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006100000" filename = "" Region: id = 2631 start_va = 0x6100000 end_va = 0x610ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006100000" filename = "" Region: id = 2632 start_va = 0x6100000 end_va = 0x610ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006100000" filename = "" Region: id = 2633 start_va = 0x6100000 end_va = 0x610ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006100000" filename = "" Region: id = 2634 start_va = 0x6100000 end_va = 0x610ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006100000" filename = "" Region: id = 2635 start_va = 0x6100000 end_va = 0x610ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006100000" filename = "" Region: id = 2636 start_va = 0x6110000 end_va = 0x611ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006110000" filename = "" Region: id = 2637 start_va = 0x6100000 end_va = 0x610ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006100000" filename = "" Region: id = 2638 start_va = 0x6110000 end_va = 0x611ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006110000" filename = "" Region: id = 2639 start_va = 0x6120000 end_va = 0x612ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006120000" filename = "" Region: id = 2640 start_va = 0x6130000 end_va = 0x613ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006130000" filename = "" Region: id = 2641 start_va = 0x6140000 end_va = 0x614ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006140000" filename = "" Region: id = 2642 start_va = 0x6150000 end_va = 0x615ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006150000" filename = "" Region: id = 2643 start_va = 0x6160000 end_va = 0x616ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006160000" filename = "" Region: id = 2644 start_va = 0x6170000 end_va = 0x617ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006170000" filename = "" Region: id = 2645 start_va = 0x6180000 end_va = 0x618ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006180000" filename = "" Region: id = 2646 start_va = 0x6190000 end_va = 0x619ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006190000" filename = "" Region: id = 2647 start_va = 0x6100000 end_va = 0x610ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006100000" filename = "" Region: id = 2648 start_va = 0x6110000 end_va = 0x611ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006110000" filename = "" Region: id = 2649 start_va = 0x6110000 end_va = 0x611ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006110000" filename = "" Region: id = 2650 start_va = 0x6120000 end_va = 0x612ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006120000" filename = "" Region: id = 2651 start_va = 0x6110000 end_va = 0x6120fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006110000" filename = "" Region: id = 2652 start_va = 0x6130000 end_va = 0x616ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006130000" filename = "" Region: id = 2653 start_va = 0x61a0000 end_va = 0x629ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 2654 start_va = 0x6130000 end_va = 0x616ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006130000" filename = "" Region: id = 2655 start_va = 0x61a0000 end_va = 0x629ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 2656 start_va = 0x6130000 end_va = 0x616ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006130000" filename = "" Region: id = 2657 start_va = 0x61a0000 end_va = 0x629ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 2658 start_va = 0x68330000 end_va = 0x683f3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.security.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Security\\754ca70e68140abcdb8476cff64c4169\\System.Security.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.security\\754ca70e68140abcdb8476cff64c4169\\system.security.ni.dll") Region: id = 2659 start_va = 0x6130000 end_va = 0x613ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006130000" filename = "" Region: id = 2660 start_va = 0x6130000 end_va = 0x613ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006130000" filename = "" Region: id = 2661 start_va = 0x6140000 end_va = 0x614ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006140000" filename = "" Region: id = 2662 start_va = 0x61a0000 end_va = 0x629ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 2663 start_va = 0x6130000 end_va = 0x616ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006130000" filename = "" Region: id = 2664 start_va = 0x62a0000 end_va = 0x639ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000062a0000" filename = "" Region: id = 2669 start_va = 0x6130000 end_va = 0x6132fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006130000" filename = "" Region: id = 2674 start_va = 0x6130000 end_va = 0x6131fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iexplore.exe.mui" filename = "\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui") Region: id = 2675 start_va = 0x62a0000 end_va = 0x6369fff monitored = 0 entry_point = 0x62a21f0 region_type = mapped_file name = "iexplore.exe" filename = "\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe") Region: id = 2676 start_va = 0x6130000 end_va = 0x6131fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iexplore.exe.mui" filename = "\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui") Region: id = 2677 start_va = 0x62a0000 end_va = 0x6369fff monitored = 0 entry_point = 0x62a21f0 region_type = mapped_file name = "iexplore.exe" filename = "\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe") Region: id = 2678 start_va = 0x6130000 end_va = 0x613ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006130000" filename = "" Region: id = 2679 start_va = 0x6130000 end_va = 0x616ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006130000" filename = "" Region: id = 2680 start_va = 0x62a0000 end_va = 0x639ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000062a0000" filename = "" Region: id = 2684 start_va = 0x6130000 end_va = 0x6132fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006130000" filename = "" Region: id = 2688 start_va = 0x6130000 end_va = 0x613ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006130000" filename = "" Region: id = 2689 start_va = 0x6130000 end_va = 0x616ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006130000" filename = "" Region: id = 2690 start_va = 0x62a0000 end_va = 0x639ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000062a0000" filename = "" Region: id = 2790 start_va = 0x6130000 end_va = 0x6132fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006130000" filename = "" Region: id = 2791 start_va = 0x6130000 end_va = 0x616ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006130000" filename = "" Region: id = 2792 start_va = 0x62a0000 end_va = 0x639ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000062a0000" filename = "" Region: id = 2793 start_va = 0x6130000 end_va = 0x613ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006130000" filename = "" Region: id = 2794 start_va = 0x6130000 end_va = 0x616ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006130000" filename = "" Region: id = 2795 start_va = 0x62a0000 end_va = 0x639ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000062a0000" filename = "" Region: id = 2797 start_va = 0x6130000 end_va = 0x613ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006130000" filename = "" Region: id = 2798 start_va = 0x6130000 end_va = 0x613ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006130000" filename = "" Region: id = 2799 start_va = 0x6140000 end_va = 0x614ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006140000" filename = "" Region: id = 2800 start_va = 0x6150000 end_va = 0x615ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006150000" filename = "" Region: id = 2801 start_va = 0x6160000 end_va = 0x616ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006160000" filename = "" Region: id = 2802 start_va = 0x6170000 end_va = 0x617ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006170000" filename = "" Region: id = 2803 start_va = 0x6130000 end_va = 0x613ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006130000" filename = "" Region: id = 2804 start_va = 0x6130000 end_va = 0x613ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006130000" filename = "" Region: id = 2805 start_va = 0x6130000 end_va = 0x613ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006130000" filename = "" Region: id = 2806 start_va = 0x6130000 end_va = 0x613ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006130000" filename = "" Region: id = 2807 start_va = 0x6130000 end_va = 0x613ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006130000" filename = "" Region: id = 2809 start_va = 0x540000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2810 start_va = 0x730000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Thread: id = 1 os_tid = 0x11b8 [0084.697] GetStartupInfoA (in: lpStartupInfo=0x19ff18 | out: lpStartupInfo=0x19ff18*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0084.698] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2140000 [0084.999] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76720000 [0084.999] GetProcAddress (hModule=0x76720000, lpProcName="FlsAlloc") returned 0x7673a980 [0084.999] GetProcAddress (hModule=0x76720000, lpProcName="FlsGetValue") returned 0x76737570 [0084.999] GetProcAddress (hModule=0x76720000, lpProcName="FlsSetValue") returned 0x76739e30 [0085.000] GetProcAddress (hModule=0x76720000, lpProcName="FlsFree") returned 0x76744ff0 [0085.000] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76720000 [0085.000] GetProcAddress (hModule=0x76720000, lpProcName="EncodePointer") returned 0x7722f730 [0085.000] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76720000 [0085.000] GetProcAddress (hModule=0x76720000, lpProcName="EncodePointer") returned 0x7722f730 [0085.000] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76720000 [0085.001] GetProcAddress (hModule=0x76720000, lpProcName="EncodePointer") returned 0x7722f730 [0085.001] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76720000 [0085.001] GetProcAddress (hModule=0x76720000, lpProcName="EncodePointer") returned 0x7722f730 [0085.001] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76720000 [0085.001] GetProcAddress (hModule=0x76720000, lpProcName="EncodePointer") returned 0x7722f730 [0085.001] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76720000 [0085.002] GetProcAddress (hModule=0x76720000, lpProcName="EncodePointer") returned 0x7722f730 [0085.002] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76720000 [0085.002] GetProcAddress (hModule=0x76720000, lpProcName="EncodePointer") returned 0x7722f730 [0085.002] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76720000 [0085.002] GetProcAddress (hModule=0x76720000, lpProcName="DecodePointer") returned 0x7722d830 [0085.003] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x238) returned 0x21405a8 [0085.003] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76720000 [0085.003] GetProcAddress (hModule=0x76720000, lpProcName="DecodePointer") returned 0x7722d830 [0085.003] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76720000 [0085.003] GetProcAddress (hModule=0x76720000, lpProcName="EncodePointer") returned 0x7722f730 [0085.003] GetProcAddress (hModule=0x76720000, lpProcName="DecodePointer") returned 0x7722d830 [0085.003] GetCurrentThreadId () returned 0x11b8 [0085.003] GetStartupInfoA (in: lpStartupInfo=0x19fe84 | out: lpStartupInfo=0x19fe84*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0085.004] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x824) returned 0x21407e8 [0085.004] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0085.004] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0085.004] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0085.004] SetHandleCount (uNumber=0x20) returned 0x20 [0085.004] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe\" " [0085.004] GetEnvironmentStringsW () returned 0x643858* [0085.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1293, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1293 [0085.004] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x531) returned 0x2141018 [0085.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1293, lpMultiByteStr=0x2141038, cbMultiByte=1293, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1293 [0085.004] FreeEnvironmentStringsW (penv=0x643858) returned 1 [0085.004] GetLastError () returned 0x0 [0085.004] SetLastError (dwErrCode=0x0) [0085.004] GetLastError () returned 0x0 [0085.005] SetLastError (dwErrCode=0x0) [0085.005] GetLastError () returned 0x0 [0085.005] SetLastError (dwErrCode=0x0) [0085.005] GetACP () returned 0x4e4 [0085.005] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x244) returned 0x2141558 [0085.005] GetLastError () returned 0x0 [0085.005] SetLastError (dwErrCode=0x0) [0085.005] IsValidCodePage (CodePage=0x4e4) returned 1 [0085.005] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19fe4c | out: lpCPInfo=0x19fe4c) returned 1 [0085.005] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f910 | out: lpCPInfo=0x19f910) returned 1 [0085.005] GetLastError () returned 0x0 [0085.005] SetLastError (dwErrCode=0x0) [0085.005] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x19f8a8 | out: lpCharType=0x19f8a8) returned 1 [0085.005] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19f928, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0085.005] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x22c) returned 0x21417a8 [0085.005] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19f928, cbMultiByte=256, lpWideCharStr=0x21417d0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽") returned 256 [0085.005] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchSrc=256, lpCharType=0x19fc30 | out: lpCharType=0x19fc30) returned 1 [0085.005] HeapValidate (hHeap=0x2140000, dwFlags=0x0, lpMem=0x21417a8) returned 1 [0085.020] HeapFree (in: hHeap=0x2140000, dwFlags=0x0, lpMem=0x21417a8 | out: hHeap=0x2140000) returned 1 [0085.021] GetLastError () returned 0x0 [0085.021] SetLastError (dwErrCode=0x0) [0085.022] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0085.022] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19f928, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0085.022] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x22c) returned 0x21417a8 [0085.022] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19f928, cbMultiByte=256, lpWideCharStr=0x21417d0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽") returned 256 [0085.022] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0085.022] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x22c) returned 0x21419e0 [0085.022] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchSrc=256, lpDestStr=0x2141a08, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽") returned 256 [0085.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchWideChar=256, lpMultiByteStr=0x19fb30, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0085.022] HeapValidate (hHeap=0x2140000, dwFlags=0x0, lpMem=0x21419e0) returned 1 [0085.022] HeapFree (in: hHeap=0x2140000, dwFlags=0x0, lpMem=0x21419e0 | out: hHeap=0x2140000) returned 1 [0085.023] HeapValidate (hHeap=0x2140000, dwFlags=0x0, lpMem=0x21417a8) returned 1 [0085.023] HeapFree (in: hHeap=0x2140000, dwFlags=0x0, lpMem=0x21417a8 | out: hHeap=0x2140000) returned 1 [0085.023] GetLastError () returned 0x0 [0085.023] SetLastError (dwErrCode=0x0) [0085.023] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19f928, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0085.023] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x22c) returned 0x21417a8 [0085.023] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19f928, cbMultiByte=256, lpWideCharStr=0x21417d0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽") returned 256 [0085.023] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0085.024] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x22c) returned 0x21419e0 [0085.024] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ﷽﷽", cchSrc=256, lpDestStr=0x2141a08, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ﷽﷽") returned 256 [0085.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ﷽﷽", cchWideChar=256, lpMultiByteStr=0x19fa30, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0085.024] HeapValidate (hHeap=0x2140000, dwFlags=0x0, lpMem=0x21419e0) returned 1 [0085.024] HeapFree (in: hHeap=0x2140000, dwFlags=0x0, lpMem=0x21419e0 | out: hHeap=0x2140000) returned 1 [0085.024] HeapValidate (hHeap=0x2140000, dwFlags=0x0, lpMem=0x21417a8) returned 1 [0085.025] HeapFree (in: hHeap=0x2140000, dwFlags=0x0, lpMem=0x21417a8 | out: hHeap=0x2140000) returned 1 [0085.025] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x465318, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe")) returned 0x62 [0085.025] GetLastError () returned 0x0 [0085.025] SetLastError (dwErrCode=0x0) [0085.025] GetLastError () returned 0x0 [0085.025] SetLastError (dwErrCode=0x0) [0085.025] GetLastError () returned 0x0 [0085.025] SetLastError (dwErrCode=0x0) [0085.025] GetLastError () returned 0x0 [0085.025] SetLastError (dwErrCode=0x0) [0085.025] GetLastError () returned 0x0 [0085.025] SetLastError (dwErrCode=0x0) [0085.025] GetLastError () returned 0x0 [0085.025] SetLastError (dwErrCode=0x0) [0085.025] GetLastError () returned 0x0 [0085.026] SetLastError (dwErrCode=0x0) [0085.026] GetLastError () returned 0x0 [0085.026] SetLastError (dwErrCode=0x0) [0085.026] GetLastError () returned 0x0 [0085.026] SetLastError (dwErrCode=0x0) [0085.026] GetLastError () returned 0x0 [0085.026] SetLastError (dwErrCode=0x0) [0085.026] GetLastError () returned 0x0 [0085.026] SetLastError (dwErrCode=0x0) [0085.026] GetLastError () returned 0x0 [0085.026] SetLastError (dwErrCode=0x0) [0085.026] GetLastError () returned 0x0 [0085.026] SetLastError (dwErrCode=0x0) [0085.026] GetLastError () returned 0x0 [0085.026] SetLastError (dwErrCode=0x0) [0085.026] GetLastError () returned 0x0 [0085.026] SetLastError (dwErrCode=0x0) [0085.026] GetLastError () returned 0x0 [0085.026] SetLastError (dwErrCode=0x0) [0085.026] GetLastError () returned 0x0 [0085.026] SetLastError (dwErrCode=0x0) [0085.027] GetLastError () returned 0x0 [0085.027] SetLastError (dwErrCode=0x0) [0085.027] GetLastError () returned 0x0 [0085.027] SetLastError (dwErrCode=0x0) [0085.027] GetLastError () returned 0x0 [0085.027] SetLastError (dwErrCode=0x0) [0085.027] GetLastError () returned 0x0 [0085.027] SetLastError (dwErrCode=0x0) [0085.027] GetLastError () returned 0x0 [0085.027] SetLastError (dwErrCode=0x0) [0085.027] GetLastError () returned 0x0 [0085.027] SetLastError (dwErrCode=0x0) [0085.027] GetLastError () returned 0x0 [0085.027] SetLastError (dwErrCode=0x0) [0085.027] GetLastError () returned 0x0 [0085.027] SetLastError (dwErrCode=0x0) [0085.027] GetLastError () returned 0x0 [0085.027] SetLastError (dwErrCode=0x0) [0085.027] GetLastError () returned 0x0 [0085.027] SetLastError (dwErrCode=0x0) [0085.027] GetLastError () returned 0x0 [0085.027] SetLastError (dwErrCode=0x0) [0085.028] GetLastError () returned 0x0 [0085.028] SetLastError (dwErrCode=0x0) [0085.028] GetLastError () returned 0x0 [0085.028] SetLastError (dwErrCode=0x0) [0085.028] GetLastError () returned 0x0 [0085.028] SetLastError (dwErrCode=0x0) [0085.028] GetLastError () returned 0x0 [0085.028] SetLastError (dwErrCode=0x0) [0085.028] GetLastError () returned 0x0 [0085.028] SetLastError (dwErrCode=0x0) [0085.028] GetLastError () returned 0x0 [0085.028] SetLastError (dwErrCode=0x0) [0085.028] GetLastError () returned 0x0 [0085.028] SetLastError (dwErrCode=0x0) [0085.028] GetLastError () returned 0x0 [0085.028] SetLastError (dwErrCode=0x0) [0085.028] GetLastError () returned 0x0 [0085.028] SetLastError (dwErrCode=0x0) [0085.028] GetLastError () returned 0x0 [0085.028] SetLastError (dwErrCode=0x0) [0085.028] GetLastError () returned 0x0 [0085.028] SetLastError (dwErrCode=0x0) [0085.028] GetLastError () returned 0x0 [0085.029] SetLastError (dwErrCode=0x0) [0085.029] GetLastError () returned 0x0 [0085.029] SetLastError (dwErrCode=0x0) [0085.029] GetLastError () returned 0x0 [0085.029] SetLastError (dwErrCode=0x0) [0085.029] GetLastError () returned 0x0 [0085.029] SetLastError (dwErrCode=0x0) [0085.029] GetLastError () returned 0x0 [0085.029] SetLastError (dwErrCode=0x0) [0085.029] GetLastError () returned 0x0 [0085.029] SetLastError (dwErrCode=0x0) [0085.029] GetLastError () returned 0x0 [0085.029] SetLastError (dwErrCode=0x0) [0085.029] GetLastError () returned 0x0 [0085.029] SetLastError (dwErrCode=0x0) [0085.029] GetLastError () returned 0x0 [0085.029] SetLastError (dwErrCode=0x0) [0085.029] GetLastError () returned 0x0 [0085.029] SetLastError (dwErrCode=0x0) [0085.029] GetLastError () returned 0x0 [0085.029] SetLastError (dwErrCode=0x0) [0085.029] GetLastError () returned 0x0 [0085.030] SetLastError (dwErrCode=0x0) [0085.030] GetLastError () returned 0x0 [0085.030] SetLastError (dwErrCode=0x0) [0085.030] GetLastError () returned 0x0 [0085.030] SetLastError (dwErrCode=0x0) [0085.030] GetLastError () returned 0x0 [0085.030] SetLastError (dwErrCode=0x0) [0085.030] GetLastError () returned 0x0 [0085.030] SetLastError (dwErrCode=0x0) [0085.030] GetLastError () returned 0x0 [0085.030] SetLastError (dwErrCode=0x0) [0085.030] GetLastError () returned 0x0 [0085.030] SetLastError (dwErrCode=0x0) [0085.030] GetLastError () returned 0x0 [0085.030] SetLastError (dwErrCode=0x0) [0085.030] GetLastError () returned 0x0 [0085.030] SetLastError (dwErrCode=0x0) [0085.030] GetLastError () returned 0x0 [0085.030] SetLastError (dwErrCode=0x0) [0085.030] GetLastError () returned 0x0 [0085.030] SetLastError (dwErrCode=0x0) [0085.030] GetLastError () returned 0x0 [0085.030] SetLastError (dwErrCode=0x0) [0085.030] GetLastError () returned 0x0 [0085.031] SetLastError (dwErrCode=0x0) [0085.031] GetLastError () returned 0x0 [0085.031] SetLastError (dwErrCode=0x0) [0085.031] GetLastError () returned 0x0 [0085.031] SetLastError (dwErrCode=0x0) [0085.031] GetLastError () returned 0x0 [0085.031] SetLastError (dwErrCode=0x0) [0085.031] GetLastError () returned 0x0 [0085.031] SetLastError (dwErrCode=0x0) [0085.031] GetLastError () returned 0x0 [0085.031] SetLastError (dwErrCode=0x0) [0085.031] GetLastError () returned 0x0 [0085.031] SetLastError (dwErrCode=0x0) [0085.031] GetLastError () returned 0x0 [0085.031] SetLastError (dwErrCode=0x0) [0085.031] GetLastError () returned 0x0 [0085.031] SetLastError (dwErrCode=0x0) [0085.031] GetLastError () returned 0x0 [0085.031] SetLastError (dwErrCode=0x0) [0085.031] GetLastError () returned 0x0 [0085.031] SetLastError (dwErrCode=0x0) [0085.031] GetLastError () returned 0x0 [0085.031] SetLastError (dwErrCode=0x0) [0085.032] GetLastError () returned 0x0 [0085.032] SetLastError (dwErrCode=0x0) [0085.032] GetLastError () returned 0x0 [0085.032] SetLastError (dwErrCode=0x0) [0085.032] GetLastError () returned 0x0 [0085.032] SetLastError (dwErrCode=0x0) [0085.032] GetLastError () returned 0x0 [0085.032] SetLastError (dwErrCode=0x0) [0085.032] GetLastError () returned 0x0 [0085.032] SetLastError (dwErrCode=0x0) [0085.032] GetLastError () returned 0x0 [0085.032] SetLastError (dwErrCode=0x0) [0085.032] GetLastError () returned 0x0 [0085.032] SetLastError (dwErrCode=0x0) [0085.032] GetLastError () returned 0x0 [0085.032] SetLastError (dwErrCode=0x0) [0085.032] GetLastError () returned 0x0 [0085.032] SetLastError (dwErrCode=0x0) [0085.032] GetLastError () returned 0x0 [0085.032] SetLastError (dwErrCode=0x0) [0085.032] GetLastError () returned 0x0 [0085.032] SetLastError (dwErrCode=0x0) [0085.032] GetLastError () returned 0x0 [0085.033] SetLastError (dwErrCode=0x0) [0085.033] GetLastError () returned 0x0 [0085.033] SetLastError (dwErrCode=0x0) [0085.033] GetLastError () returned 0x0 [0085.033] SetLastError (dwErrCode=0x0) [0085.033] GetLastError () returned 0x0 [0085.033] SetLastError (dwErrCode=0x0) [0085.033] GetLastError () returned 0x0 [0085.033] SetLastError (dwErrCode=0x0) [0085.033] GetLastError () returned 0x0 [0085.033] SetLastError (dwErrCode=0x0) [0085.033] GetLastError () returned 0x0 [0085.033] SetLastError (dwErrCode=0x0) [0085.033] GetLastError () returned 0x0 [0085.033] SetLastError (dwErrCode=0x0) [0085.033] GetLastError () returned 0x0 [0085.033] SetLastError (dwErrCode=0x0) [0085.033] GetLastError () returned 0x0 [0085.033] SetLastError (dwErrCode=0x0) [0085.033] GetLastError () returned 0x0 [0085.033] SetLastError (dwErrCode=0x0) [0085.033] GetLastError () returned 0x0 [0085.034] SetLastError (dwErrCode=0x0) [0085.034] GetLastError () returned 0x0 [0085.034] SetLastError (dwErrCode=0x0) [0085.034] GetLastError () returned 0x0 [0085.034] SetLastError (dwErrCode=0x0) [0085.034] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x8f) returned 0x21417a8 [0085.034] GetLastError () returned 0x0 [0085.034] SetLastError (dwErrCode=0x0) [0085.034] GetLastError () returned 0x0 [0085.034] SetLastError (dwErrCode=0x0) [0085.034] GetLastError () returned 0x0 [0085.034] SetLastError (dwErrCode=0x0) [0085.034] GetLastError () returned 0x0 [0085.034] SetLastError (dwErrCode=0x0) [0085.034] GetLastError () returned 0x0 [0085.034] SetLastError (dwErrCode=0x0) [0085.034] GetLastError () returned 0x0 [0085.034] SetLastError (dwErrCode=0x0) [0085.034] GetLastError () returned 0x0 [0085.034] SetLastError (dwErrCode=0x0) [0085.034] GetLastError () returned 0x0 [0085.034] SetLastError (dwErrCode=0x0) [0085.034] GetLastError () returned 0x0 [0085.035] SetLastError (dwErrCode=0x0) [0085.035] GetLastError () returned 0x0 [0085.035] SetLastError (dwErrCode=0x0) [0085.035] GetLastError () returned 0x0 [0085.035] SetLastError (dwErrCode=0x0) [0085.035] GetLastError () returned 0x0 [0085.035] SetLastError (dwErrCode=0x0) [0085.035] GetLastError () returned 0x0 [0085.035] SetLastError (dwErrCode=0x0) [0085.035] GetLastError () returned 0x0 [0085.035] SetLastError (dwErrCode=0x0) [0085.035] GetLastError () returned 0x0 [0085.035] SetLastError (dwErrCode=0x0) [0085.035] GetLastError () returned 0x0 [0085.035] SetLastError (dwErrCode=0x0) [0085.035] GetLastError () returned 0x0 [0085.035] SetLastError (dwErrCode=0x0) [0085.035] GetLastError () returned 0x0 [0085.035] SetLastError (dwErrCode=0x0) [0085.035] GetLastError () returned 0x0 [0085.035] SetLastError (dwErrCode=0x0) [0085.035] GetLastError () returned 0x0 [0085.035] SetLastError (dwErrCode=0x0) [0085.035] GetLastError () returned 0x0 [0085.036] SetLastError (dwErrCode=0x0) [0085.036] GetLastError () returned 0x0 [0085.036] SetLastError (dwErrCode=0x0) [0085.036] GetLastError () returned 0x0 [0085.036] SetLastError (dwErrCode=0x0) [0085.036] GetLastError () returned 0x0 [0085.036] SetLastError (dwErrCode=0x0) [0085.036] GetLastError () returned 0x0 [0085.036] SetLastError (dwErrCode=0x0) [0085.036] GetLastError () returned 0x0 [0085.036] SetLastError (dwErrCode=0x0) [0085.036] GetLastError () returned 0x0 [0085.036] SetLastError (dwErrCode=0x0) [0085.036] GetLastError () returned 0x0 [0085.036] SetLastError (dwErrCode=0x0) [0085.036] GetLastError () returned 0x0 [0085.036] SetLastError (dwErrCode=0x0) [0085.036] GetLastError () returned 0x0 [0085.036] SetLastError (dwErrCode=0x0) [0085.036] GetLastError () returned 0x0 [0085.036] SetLastError (dwErrCode=0x0) [0085.036] GetLastError () returned 0x0 [0085.037] SetLastError (dwErrCode=0x0) [0085.037] GetLastError () returned 0x0 [0085.037] SetLastError (dwErrCode=0x0) [0085.037] GetLastError () returned 0x0 [0085.037] SetLastError (dwErrCode=0x0) [0085.037] GetLastError () returned 0x0 [0085.037] SetLastError (dwErrCode=0x0) [0085.037] GetLastError () returned 0x0 [0085.037] SetLastError (dwErrCode=0x0) [0085.037] GetLastError () returned 0x0 [0085.037] SetLastError (dwErrCode=0x0) [0085.093] GetLastError () returned 0x0 [0085.093] SetLastError (dwErrCode=0x0) [0085.093] GetLastError () returned 0x0 [0085.093] SetLastError (dwErrCode=0x0) [0085.093] GetLastError () returned 0x0 [0085.093] SetLastError (dwErrCode=0x0) [0085.093] GetLastError () returned 0x0 [0085.093] SetLastError (dwErrCode=0x0) [0085.093] GetLastError () returned 0x0 [0085.093] SetLastError (dwErrCode=0x0) [0085.093] GetLastError () returned 0x0 [0085.093] SetLastError (dwErrCode=0x0) [0085.093] GetLastError () returned 0x0 [0085.093] SetLastError (dwErrCode=0x0) [0085.093] GetLastError () returned 0x0 [0085.093] SetLastError (dwErrCode=0x0) [0085.093] GetLastError () returned 0x0 [0085.093] SetLastError (dwErrCode=0x0) [0085.093] GetLastError () returned 0x0 [0085.094] SetLastError (dwErrCode=0x0) [0085.094] GetLastError () returned 0x0 [0085.094] SetLastError (dwErrCode=0x0) [0085.094] GetLastError () returned 0x0 [0085.094] SetLastError (dwErrCode=0x0) [0085.094] GetLastError () returned 0x0 [0085.094] SetLastError (dwErrCode=0x0) [0085.094] GetLastError () returned 0x0 [0085.094] SetLastError (dwErrCode=0x0) [0085.094] GetLastError () returned 0x0 [0085.094] SetLastError (dwErrCode=0x0) [0085.094] GetLastError () returned 0x0 [0085.094] SetLastError (dwErrCode=0x0) [0085.094] GetLastError () returned 0x0 [0085.094] SetLastError (dwErrCode=0x0) [0085.094] GetLastError () returned 0x0 [0085.094] SetLastError (dwErrCode=0x0) [0085.094] GetLastError () returned 0x0 [0085.094] SetLastError (dwErrCode=0x0) [0085.094] GetLastError () returned 0x0 [0085.094] SetLastError (dwErrCode=0x0) [0085.094] GetLastError () returned 0x0 [0085.094] SetLastError (dwErrCode=0x0) [0085.095] GetLastError () returned 0x0 [0085.095] SetLastError (dwErrCode=0x0) [0085.095] GetLastError () returned 0x0 [0085.095] SetLastError (dwErrCode=0x0) [0085.095] GetLastError () returned 0x0 [0085.095] SetLastError (dwErrCode=0x0) [0085.095] GetLastError () returned 0x0 [0085.095] SetLastError (dwErrCode=0x0) [0085.095] GetLastError () returned 0x0 [0085.095] SetLastError (dwErrCode=0x0) [0085.095] GetLastError () returned 0x0 [0085.095] SetLastError (dwErrCode=0x0) [0085.095] GetLastError () returned 0x0 [0085.095] SetLastError (dwErrCode=0x0) [0085.095] GetLastError () returned 0x0 [0085.095] SetLastError (dwErrCode=0x0) [0085.095] GetLastError () returned 0x0 [0085.095] SetLastError (dwErrCode=0x0) [0085.095] GetLastError () returned 0x0 [0085.095] SetLastError (dwErrCode=0x0) [0085.095] GetLastError () returned 0x0 [0085.095] SetLastError (dwErrCode=0x0) [0085.095] GetLastError () returned 0x0 [0085.096] SetLastError (dwErrCode=0x0) [0085.096] GetLastError () returned 0x0 [0085.096] SetLastError (dwErrCode=0x0) [0085.096] GetLastError () returned 0x0 [0085.096] SetLastError (dwErrCode=0x0) [0085.096] GetLastError () returned 0x0 [0085.096] SetLastError (dwErrCode=0x0) [0085.096] GetLastError () returned 0x0 [0085.096] SetLastError (dwErrCode=0x0) [0085.096] GetLastError () returned 0x0 [0085.096] SetLastError (dwErrCode=0x0) [0085.096] GetLastError () returned 0x0 [0085.096] SetLastError (dwErrCode=0x0) [0085.096] GetLastError () returned 0x0 [0085.096] SetLastError (dwErrCode=0x0) [0085.096] GetLastError () returned 0x0 [0085.096] SetLastError (dwErrCode=0x0) [0085.096] GetLastError () returned 0x0 [0085.096] SetLastError (dwErrCode=0x0) [0085.096] GetLastError () returned 0x0 [0085.096] SetLastError (dwErrCode=0x0) [0085.096] GetLastError () returned 0x0 [0085.096] SetLastError (dwErrCode=0x0) [0085.096] GetLastError () returned 0x0 [0085.097] SetLastError (dwErrCode=0x0) [0085.097] GetLastError () returned 0x0 [0085.097] SetLastError (dwErrCode=0x0) [0085.097] GetLastError () returned 0x0 [0085.097] SetLastError (dwErrCode=0x0) [0085.097] GetLastError () returned 0x0 [0085.097] SetLastError (dwErrCode=0x0) [0085.097] GetLastError () returned 0x0 [0085.097] SetLastError (dwErrCode=0x0) [0085.097] GetLastError () returned 0x0 [0085.097] SetLastError (dwErrCode=0x0) [0085.097] GetLastError () returned 0x0 [0085.097] SetLastError (dwErrCode=0x0) [0085.097] GetLastError () returned 0x0 [0085.097] SetLastError (dwErrCode=0x0) [0085.097] GetLastError () returned 0x0 [0085.097] SetLastError (dwErrCode=0x0) [0085.097] GetLastError () returned 0x0 [0085.097] SetLastError (dwErrCode=0x0) [0085.097] GetLastError () returned 0x0 [0085.097] SetLastError (dwErrCode=0x0) [0085.097] GetLastError () returned 0x0 [0085.097] SetLastError (dwErrCode=0x0) [0085.097] GetLastError () returned 0x0 [0085.098] SetLastError (dwErrCode=0x0) [0085.098] GetLastError () returned 0x0 [0085.098] SetLastError (dwErrCode=0x0) [0085.098] GetLastError () returned 0x0 [0085.098] SetLastError (dwErrCode=0x0) [0085.098] GetLastError () returned 0x0 [0085.098] SetLastError (dwErrCode=0x0) [0085.098] GetLastError () returned 0x0 [0085.098] SetLastError (dwErrCode=0x0) [0085.098] GetLastError () returned 0x0 [0085.098] SetLastError (dwErrCode=0x0) [0085.098] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0xb4) returned 0x2141840 [0085.098] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x43) returned 0x2141900 [0085.098] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x52) returned 0x2141950 [0085.098] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x5b) returned 0x21419b0 [0085.098] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x60) returned 0x2141a18 [0085.099] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x55) returned 0x2141a80 [0085.099] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x38) returned 0x2141ae0 [0085.099] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x48) returned 0x2141b20 [0085.099] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x31) returned 0x2141b70 [0085.099] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x41) returned 0x2141bb0 [0085.099] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x55) returned 0x2141c00 [0085.099] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x39) returned 0x2141c60 [0085.099] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x3b) returned 0x2141ca8 [0085.099] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x32) returned 0x2141cf0 [0085.099] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x8d) returned 0x2141d30 [0085.099] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x62) returned 0x2141dc8 [0085.099] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x3f) returned 0x2141e38 [0085.099] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x41) returned 0x2141e80 [0085.099] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x6c) returned 0x2141ed0 [0085.099] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x36) returned 0x2141f48 [0085.099] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x3c) returned 0x2141f88 [0085.100] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x3f) returned 0x2141fd0 [0085.100] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x48) returned 0x2142018 [0085.100] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x4d) returned 0x2142068 [0085.100] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x42) returned 0x21420c0 [0085.100] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x8f) returned 0x2142110 [0085.100] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x3b) returned 0x21421a8 [0085.100] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x33) returned 0x21421f0 [0085.100] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x3a) returned 0x2142230 [0085.100] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x4e) returned 0x2142278 [0085.100] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x4d) returned 0x21422d0 [0085.101] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x36) returned 0x2142328 [0085.101] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x45) returned 0x2142368 [0085.101] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x3a) returned 0x21423b8 [0085.101] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x46) returned 0x2142400 [0085.101] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x36) returned 0x2142450 [0085.101] HeapValidate (hHeap=0x2140000, dwFlags=0x0, lpMem=0x2141018) returned 1 [0085.101] HeapFree (in: hHeap=0x2140000, dwFlags=0x0, lpMem=0x2141018 | out: hHeap=0x2140000) returned 1 [0085.101] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76720000 [0085.101] GetProcAddress (hModule=0x76720000, lpProcName="IsProcessorFeaturePresent") returned 0x76739bf0 [0085.101] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0085.102] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0xa4) returned 0x2141018 [0085.103] RtlAllocateHeap (HeapHandle=0x2140000, Flags=0x0, Size=0x824) returned 0x2142490 [0085.103] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x415f60) returned 0x0 [0085.103] HeapValidate (hHeap=0x2140000, dwFlags=0x0, lpMem=0x2141018) returned 1 [0085.104] HeapValidate (hHeap=0x2140000, dwFlags=0x0, lpMem=0x2141018) returned 1 [0085.104] GetLastError () returned 0x0 [0085.104] SetLastError (dwErrCode=0x0) [0085.104] GetLastError () returned 0x0 [0085.104] SetLastError (dwErrCode=0x0) [0085.104] GetLastError () returned 0x0 [0085.104] SetLastError (dwErrCode=0x0) [0085.104] GetLastError () returned 0x0 [0085.104] SetLastError (dwErrCode=0x0) [0085.104] GetLastError () returned 0x0 [0085.105] SetLastError (dwErrCode=0x0) [0085.105] GetLastError () returned 0x0 [0085.105] SetLastError (dwErrCode=0x0) [0085.105] GetLastError () returned 0x0 [0085.105] SetLastError (dwErrCode=0x0) [0085.105] GetLastError () returned 0x0 [0085.105] SetLastError (dwErrCode=0x0) [0085.105] GetLastError () returned 0x0 [0085.105] SetLastError (dwErrCode=0x0) [0085.105] GetLastError () returned 0x0 [0085.105] SetLastError (dwErrCode=0x0) [0085.105] GetLastError () returned 0x0 [0085.105] SetLastError (dwErrCode=0x0) [0085.105] GetLastError () returned 0x0 [0085.105] SetLastError (dwErrCode=0x0) [0085.105] GetLastError () returned 0x0 [0085.105] SetLastError (dwErrCode=0x0) [0085.105] GetLastError () returned 0x0 [0085.105] SetLastError (dwErrCode=0x0) [0085.105] GetLastError () returned 0x0 [0085.105] SetLastError (dwErrCode=0x0) [0085.105] GetLastError () returned 0x0 [0085.105] SetLastError (dwErrCode=0x0) [0085.105] GetLastError () returned 0x0 [0085.106] SetLastError (dwErrCode=0x0) [0085.106] GetLastError () returned 0x0 [0085.106] SetLastError (dwErrCode=0x0) [0085.106] GetLastError () returned 0x0 [0085.106] SetLastError (dwErrCode=0x0) [0085.106] GetLastError () returned 0x0 [0085.106] SetLastError (dwErrCode=0x0) [0085.106] GetLastError () returned 0x0 [0085.106] SetLastError (dwErrCode=0x0) [0085.106] GetLastError () returned 0x0 [0085.106] SetLastError (dwErrCode=0x0) [0085.106] GetLastError () returned 0x0 [0085.106] SetLastError (dwErrCode=0x0) [0085.106] GetLastError () returned 0x0 [0085.106] SetLastError (dwErrCode=0x0) [0085.106] GetLastError () returned 0x0 [0085.106] SetLastError (dwErrCode=0x0) [0085.106] GetLastError () returned 0x0 [0085.106] SetLastError (dwErrCode=0x0) [0085.106] GetLastError () returned 0x0 [0085.106] SetLastError (dwErrCode=0x0) [0085.106] GetLastError () returned 0x0 [0085.106] SetLastError (dwErrCode=0x0) [0085.106] GetLastError () returned 0x0 [0085.107] SetLastError (dwErrCode=0x0) [0085.107] GetLastError () returned 0x0 [0085.107] SetLastError (dwErrCode=0x0) [0085.107] GetLastError () returned 0x0 [0085.107] SetLastError (dwErrCode=0x0) [0085.107] GetLastError () returned 0x0 [0085.107] SetLastError (dwErrCode=0x0) [0085.107] GetLastError () returned 0x0 [0085.107] SetLastError (dwErrCode=0x0) [0085.107] GetLastError () returned 0x0 [0085.107] SetLastError (dwErrCode=0x0) [0085.107] GetLastError () returned 0x0 [0085.107] SetLastError (dwErrCode=0x0) [0085.107] GetLastError () returned 0x0 [0085.107] SetLastError (dwErrCode=0x0) [0085.107] GetLastError () returned 0x0 [0085.107] SetLastError (dwErrCode=0x0) [0085.107] GetLastError () returned 0x0 [0085.107] SetLastError (dwErrCode=0x0) [0085.107] GetLastError () returned 0x0 [0085.107] SetLastError (dwErrCode=0x0) [0085.107] GetLastError () returned 0x0 [0085.107] SetLastError (dwErrCode=0x0) [0085.107] GetLastError () returned 0x0 [0085.107] SetLastError (dwErrCode=0x0) [0085.107] GetLastError () returned 0x0 [0085.108] SetLastError (dwErrCode=0x0) [0085.108] GetLastError () returned 0x0 [0085.108] SetLastError (dwErrCode=0x0) [0085.108] GetLastError () returned 0x0 [0085.108] SetLastError (dwErrCode=0x0) [0085.108] GetLastError () returned 0x0 [0085.108] SetLastError (dwErrCode=0x0) [0085.108] GetLastError () returned 0x0 [0085.108] SetLastError (dwErrCode=0x0) [0085.108] GetLastError () returned 0x0 [0085.108] SetLastError (dwErrCode=0x0) [0085.108] GetLastError () returned 0x0 [0085.108] SetLastError (dwErrCode=0x0) [0085.108] GetLastError () returned 0x0 [0085.108] SetLastError (dwErrCode=0x0) [0085.108] GetLastError () returned 0x0 [0085.108] SetLastError (dwErrCode=0x0) [0085.108] GetLastError () returned 0x0 [0085.108] SetLastError (dwErrCode=0x0) [0085.108] GetLastError () returned 0x0 [0085.108] SetLastError (dwErrCode=0x0) [0085.108] GetLastError () returned 0x0 [0085.108] SetLastError (dwErrCode=0x0) [0085.108] GetLastError () returned 0x0 [0085.108] SetLastError (dwErrCode=0x0) [0085.108] GetLastError () returned 0x0 [0085.109] SetLastError (dwErrCode=0x0) [0085.109] GetLastError () returned 0x0 [0085.109] SetLastError (dwErrCode=0x0) [0085.109] GetLastError () returned 0x0 [0085.109] SetLastError (dwErrCode=0x0) [0085.109] GetLastError () returned 0x0 [0085.109] SetLastError (dwErrCode=0x0) [0085.109] GetLastError () returned 0x0 [0085.109] SetLastError (dwErrCode=0x0) [0085.109] GetLastError () returned 0x0 [0085.109] SetLastError (dwErrCode=0x0) [0085.109] GetLastError () returned 0x0 [0085.109] SetLastError (dwErrCode=0x0) [0085.109] GetLastError () returned 0x0 [0085.109] SetLastError (dwErrCode=0x0) [0085.109] GetLastError () returned 0x0 [0085.109] SetLastError (dwErrCode=0x0) [0085.109] GetLastError () returned 0x0 [0085.109] SetLastError (dwErrCode=0x0) [0085.109] GetLastError () returned 0x0 [0085.109] SetLastError (dwErrCode=0x0) [0085.109] GetLastError () returned 0x0 [0085.109] SetLastError (dwErrCode=0x0) [0085.109] GetLastError () returned 0x0 [0085.109] SetLastError (dwErrCode=0x0) [0085.109] GetLastError () returned 0x0 [0085.109] SetLastError (dwErrCode=0x0) [0085.109] GetLastError () returned 0x0 [0085.110] SetLastError (dwErrCode=0x0) [0085.110] GetLastError () returned 0x0 [0085.110] SetLastError (dwErrCode=0x0) [0085.110] GetLastError () returned 0x0 [0085.110] SetLastError (dwErrCode=0x0) [0085.110] GetLastError () returned 0x0 [0085.110] SetLastError (dwErrCode=0x0) [0085.110] GetLastError () returned 0x0 [0085.110] SetLastError (dwErrCode=0x0) [0085.110] GetLastError () returned 0x0 [0085.110] SetLastError (dwErrCode=0x0) [0085.110] GetLastError () returned 0x0 [0085.110] SetLastError (dwErrCode=0x0) [0085.110] GetLastError () returned 0x0 [0085.110] SetLastError (dwErrCode=0x0) [0085.110] GetLastError () returned 0x0 [0085.110] SetLastError (dwErrCode=0x0) [0085.110] GetLastError () returned 0x0 [0085.110] SetLastError (dwErrCode=0x0) [0085.110] GetLastError () returned 0x0 [0085.110] SetLastError (dwErrCode=0x0) [0085.110] GetLastError () returned 0x0 [0085.110] SetLastError (dwErrCode=0x0) [0085.110] GetLastError () returned 0x0 [0085.110] SetLastError (dwErrCode=0x0) [0085.110] GetLastError () returned 0x0 [0085.111] SetLastError (dwErrCode=0x0) [0085.111] GetLastError () returned 0x0 [0085.111] SetLastError (dwErrCode=0x0) [0085.111] GetLastError () returned 0x0 [0085.111] SetLastError (dwErrCode=0x0) [0085.111] GetLastError () returned 0x0 [0085.111] SetLastError (dwErrCode=0x0) [0085.111] GetLastError () returned 0x0 [0085.111] SetLastError (dwErrCode=0x0) [0085.111] GetLastError () returned 0x0 [0085.111] SetLastError (dwErrCode=0x0) [0085.111] GetLastError () returned 0x0 [0085.111] SetLastError (dwErrCode=0x0) [0085.111] GetLastError () returned 0x0 [0085.111] SetLastError (dwErrCode=0x0) [0085.111] GetLastError () returned 0x0 [0085.111] SetLastError (dwErrCode=0x0) [0085.111] GetLastError () returned 0x0 [0085.111] SetLastError (dwErrCode=0x0) [0085.111] GetLastError () returned 0x0 [0085.111] SetLastError (dwErrCode=0x0) [0085.111] GetLastError () returned 0x0 [0085.112] SetLastError (dwErrCode=0x0) [0085.112] GetLastError () returned 0x0 [0085.112] SetLastError (dwErrCode=0x0) [0085.112] GetLastError () returned 0x0 [0085.112] SetLastError (dwErrCode=0x0) [0085.112] GetLastError () returned 0x0 [0085.112] SetLastError (dwErrCode=0x0) [0085.112] GetLastError () returned 0x0 [0085.112] SetLastError (dwErrCode=0x0) [0085.112] GetLastError () returned 0x0 [0085.112] SetLastError (dwErrCode=0x0) [0085.112] GetLastError () returned 0x0 [0085.112] SetLastError (dwErrCode=0x0) [0085.112] GetLastError () returned 0x0 [0085.112] SetLastError (dwErrCode=0x0) [0085.112] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.489] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.494] GetMessageTime () returned 0 [0085.494] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.495] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.495] GetMessageTime () returned 0 [0085.495] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.495] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.495] GetMessageTime () returned 0 [0085.495] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.495] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.495] GetMessageTime () returned 0 [0085.495] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.495] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.495] GetMessageTime () returned 0 [0085.495] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.498] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.498] GetMessageTime () returned 0 [0085.498] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.498] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.498] GetMessageTime () returned 0 [0085.498] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.499] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.499] GetMessageTime () returned 0 [0085.499] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.499] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.499] GetMessageTime () returned 0 [0085.499] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.499] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.500] GetMessageTime () returned 0 [0085.500] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.500] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.500] GetMessageTime () returned 0 [0085.500] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.500] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.500] GetMessageTime () returned 0 [0085.500] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.500] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.500] GetMessageTime () returned 0 [0085.501] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.501] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.501] GetMessageTime () returned 0 [0085.502] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.502] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.502] GetMessageTime () returned 0 [0085.502] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.502] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.502] GetMessageTime () returned 0 [0085.502] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.502] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.502] GetMessageTime () returned 0 [0085.502] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.502] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.503] GetMessageTime () returned 0 [0085.503] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.503] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.503] GetMessageTime () returned 0 [0085.504] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.504] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.504] GetMessageTime () returned 0 [0085.504] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.504] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.504] GetMessageTime () returned 0 [0085.504] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.504] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.504] GetMessageTime () returned 0 [0085.504] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.504] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.504] GetMessageTime () returned 0 [0085.506] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.506] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.506] GetMessageTime () returned 0 [0085.506] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.506] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.506] GetMessageTime () returned 0 [0085.506] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.506] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.507] GetMessageTime () returned 0 [0085.507] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.507] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.507] GetMessageTime () returned 0 [0085.507] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.507] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.507] GetMessageTime () returned 0 [0085.507] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.507] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.507] GetMessageTime () returned 0 [0085.507] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.507] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.507] GetMessageTime () returned 0 [0085.507] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.507] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.508] GetMessageTime () returned 0 [0085.508] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.508] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.508] GetMessageTime () returned 0 [0085.508] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.508] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.508] GetMessageTime () returned 0 [0085.508] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.508] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.511] GetMessageTime () returned 0 [0085.511] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.511] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.511] GetMessageTime () returned 0 [0085.511] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.511] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.511] GetMessageTime () returned 0 [0085.512] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.512] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.512] GetMessageTime () returned 0 [0085.512] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.512] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.512] GetMessageTime () returned 0 [0085.512] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.512] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.513] GetMessageTime () returned 0 [0085.513] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.513] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.514] GetMessageTime () returned 0 [0085.514] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.514] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.514] GetMessageTime () returned 0 [0085.514] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.514] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.514] GetMessageTime () returned 0 [0085.514] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.514] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.514] GetMessageTime () returned 0 [0085.514] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.514] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.514] GetMessageTime () returned 0 [0085.514] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.514] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.515] GetMessageTime () returned 0 [0085.515] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.515] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.515] GetMessageTime () returned 0 [0085.515] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.515] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.515] GetMessageTime () returned 0 [0085.515] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.515] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.515] GetMessageTime () returned 0 [0085.515] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.515] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.515] GetMessageTime () returned 0 [0085.515] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.515] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.515] GetMessageTime () returned 0 [0085.516] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.516] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.516] GetMessageTime () returned 0 [0085.516] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.516] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.516] GetMessageTime () returned 0 [0085.516] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.516] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.516] GetMessageTime () returned 0 [0085.516] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.517] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.517] GetMessageTime () returned 0 [0085.517] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.517] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.517] GetMessageTime () returned 0 [0085.518] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.518] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.518] GetMessageTime () returned 0 [0085.518] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.518] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.518] GetMessageTime () returned 0 [0085.518] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.518] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.518] GetMessageTime () returned 0 [0085.518] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.518] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.518] GetMessageTime () returned 0 [0085.518] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.518] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.518] GetMessageTime () returned 0 [0085.519] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.519] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.519] GetMessageTime () returned 0 [0085.519] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.519] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.519] GetMessageTime () returned 0 [0085.519] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.519] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.519] GetMessageTime () returned 0 [0085.519] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.519] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.519] GetMessageTime () returned 0 [0085.519] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.519] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.519] GetMessageTime () returned 0 [0085.520] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.520] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.520] GetMessageTime () returned 0 [0085.520] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.520] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.520] GetMessageTime () returned 0 [0085.520] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.520] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.520] GetMessageTime () returned 0 [0085.520] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.520] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.520] GetMessageTime () returned 0 [0085.520] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.520] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.520] GetMessageTime () returned 0 [0085.521] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.521] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.521] GetMessageTime () returned 0 [0085.521] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.521] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.521] GetMessageTime () returned 0 [0085.521] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.521] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.521] GetMessageTime () returned 0 [0085.521] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.521] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.521] GetMessageTime () returned 0 [0085.521] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.521] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.521] GetMessageTime () returned 0 [0085.544] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.544] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.544] GetMessageTime () returned 0 [0085.544] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.544] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.544] GetMessageTime () returned 0 [0085.544] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.544] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.545] GetMessageTime () returned 0 [0085.545] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.545] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.545] GetMessageTime () returned 0 [0085.545] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.545] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.545] GetMessageTime () returned 0 [0085.545] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.545] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.545] GetMessageTime () returned 0 [0085.545] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.545] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.545] GetMessageTime () returned 0 [0085.545] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.545] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.545] GetMessageTime () returned 0 [0085.545] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.545] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.545] GetMessageTime () returned 0 [0085.545] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.545] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.545] GetMessageTime () returned 0 [0085.546] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.546] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.546] GetMessageTime () returned 0 [0085.546] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.546] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.546] GetMessageTime () returned 0 [0085.546] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.546] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.546] GetMessageTime () returned 0 [0085.546] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.546] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.546] GetMessageTime () returned 0 [0085.546] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.546] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.546] GetMessageTime () returned 0 [0085.546] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.546] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.546] GetMessageTime () returned 0 [0085.546] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.546] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.546] GetMessageTime () returned 0 [0085.546] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.547] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.547] GetMessageTime () returned 0 [0085.547] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.547] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.547] GetMessageTime () returned 0 [0085.547] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.547] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.547] GetMessageTime () returned 0 [0085.547] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.547] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.547] GetMessageTime () returned 0 [0085.547] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.547] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.547] GetMessageTime () returned 0 [0085.547] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.547] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.547] GetMessageTime () returned 0 [0085.547] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.547] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.547] GetMessageTime () returned 0 [0085.547] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.547] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.547] GetMessageTime () returned 0 [0085.548] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.548] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.548] GetMessageTime () returned 0 [0085.548] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.548] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.548] GetMessageTime () returned 0 [0085.548] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.548] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.548] GetMessageTime () returned 0 [0085.548] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.548] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.548] GetMessageTime () returned 0 [0085.548] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.548] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.548] GetMessageTime () returned 0 [0085.548] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.548] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.548] GetMessageTime () returned 0 [0085.548] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.548] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.548] GetMessageTime () returned 0 [0085.549] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.549] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.549] GetMessageTime () returned 0 [0085.549] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.549] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.549] GetMessageTime () returned 0 [0085.549] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.549] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.549] GetMessageTime () returned 0 [0085.549] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.549] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.549] GetMessageTime () returned 0 [0085.549] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.549] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.549] GetMessageTime () returned 0 [0085.549] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.549] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.549] GetMessageTime () returned 0 [0085.549] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.549] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.549] GetMessageTime () returned 0 [0085.550] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.550] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.550] GetMessageTime () returned 0 [0085.550] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.550] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.550] GetMessageTime () returned 0 [0085.550] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.550] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.550] GetMessageTime () returned 0 [0085.550] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.550] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.550] GetMessageTime () returned 0 [0085.550] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.550] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.550] GetMessageTime () returned 0 [0085.550] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.550] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.550] GetMessageTime () returned 0 [0085.550] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.550] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.550] GetMessageTime () returned 0 [0085.550] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.550] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.551] GetMessageTime () returned 0 [0085.551] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.551] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.551] GetMessageTime () returned 0 [0085.551] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.551] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.551] GetMessageTime () returned 0 [0085.551] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.551] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.551] GetMessageTime () returned 0 [0085.551] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.551] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.551] GetMessageTime () returned 0 [0085.551] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.551] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.551] GetMessageTime () returned 0 [0085.551] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.551] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.551] GetMessageTime () returned 0 [0085.551] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.551] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.552] GetMessageTime () returned 0 [0085.552] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.552] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.552] GetMessageTime () returned 0 [0085.552] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.552] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.552] GetMessageTime () returned 0 [0085.552] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.552] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.552] GetMessageTime () returned 0 [0085.552] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.552] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.552] GetMessageTime () returned 0 [0085.552] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.552] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.552] GetMessageTime () returned 0 [0085.552] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.552] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.552] GetMessageTime () returned 0 [0085.552] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.552] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.552] GetMessageTime () returned 0 [0085.553] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.553] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.553] GetMessageTime () returned 0 [0085.553] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.553] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.553] GetMessageTime () returned 0 [0085.553] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.553] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.553] GetMessageTime () returned 0 [0085.553] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.553] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.553] GetMessageTime () returned 0 [0085.553] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.553] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.553] GetMessageTime () returned 0 [0085.553] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.553] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.553] GetMessageTime () returned 0 [0085.553] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.553] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.554] GetMessageTime () returned 0 [0085.554] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.554] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.554] GetMessageTime () returned 0 [0085.554] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.554] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.554] GetMessageTime () returned 0 [0085.554] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.554] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.554] GetMessageTime () returned 0 [0085.554] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.554] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.554] GetMessageTime () returned 0 [0085.554] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.554] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.554] GetMessageTime () returned 0 [0085.554] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.554] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.554] GetMessageTime () returned 0 [0085.554] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.554] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.554] GetMessageTime () returned 0 [0085.555] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.555] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.555] GetMessageTime () returned 0 [0085.555] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.555] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.555] GetMessageTime () returned 0 [0085.555] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.555] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.555] GetMessageTime () returned 0 [0085.555] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.555] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.555] GetMessageTime () returned 0 [0085.555] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.555] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.555] GetMessageTime () returned 0 [0085.555] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.555] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.555] GetMessageTime () returned 0 [0085.555] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.555] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.555] GetMessageTime () returned 0 [0085.555] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.556] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.556] GetMessageTime () returned 0 [0085.556] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.556] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.556] GetMessageTime () returned 0 [0085.556] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.556] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.556] GetMessageTime () returned 0 [0085.556] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.556] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.556] GetMessageTime () returned 0 [0085.556] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.556] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.556] GetMessageTime () returned 0 [0085.556] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.556] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.556] GetMessageTime () returned 0 [0085.556] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.556] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.556] GetMessageTime () returned 0 [0085.556] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.557] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.557] GetMessageTime () returned 0 [0085.557] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.557] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.557] GetMessageTime () returned 0 [0085.557] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.557] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.557] GetMessageTime () returned 0 [0085.557] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.557] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.557] GetMessageTime () returned 0 [0085.557] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.557] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.557] GetMessageTime () returned 0 [0085.557] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.557] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.557] GetMessageTime () returned 0 [0085.557] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.557] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.557] GetMessageTime () returned 0 [0085.557] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.557] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.558] GetMessageTime () returned 0 [0085.558] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.558] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.558] GetMessageTime () returned 0 [0085.558] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.558] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.558] GetMessageTime () returned 0 [0085.558] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.558] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.558] GetMessageTime () returned 0 [0085.558] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.558] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.558] GetMessageTime () returned 0 [0085.558] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.558] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.558] GetMessageTime () returned 0 [0085.558] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.558] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.558] GetMessageTime () returned 0 [0085.558] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.558] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.559] GetMessageTime () returned 0 [0085.559] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.559] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.559] GetMessageTime () returned 0 [0085.559] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.559] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.559] GetMessageTime () returned 0 [0085.559] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.559] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.559] GetMessageTime () returned 0 [0085.559] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.559] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.559] GetMessageTime () returned 0 [0085.559] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.559] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.559] GetMessageTime () returned 0 [0085.559] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.559] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.559] GetMessageTime () returned 0 [0085.559] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.559] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.559] GetMessageTime () returned 0 [0085.560] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.560] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.560] GetMessageTime () returned 0 [0085.560] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.560] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.560] GetMessageTime () returned 0 [0085.560] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.560] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.560] GetMessageTime () returned 0 [0085.560] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.560] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.560] GetMessageTime () returned 0 [0085.560] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.560] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.560] GetMessageTime () returned 0 [0085.560] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.560] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.560] GetMessageTime () returned 0 [0085.560] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.560] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.560] GetMessageTime () returned 0 [0085.561] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.561] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.561] GetMessageTime () returned 0 [0085.561] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.561] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.561] GetMessageTime () returned 0 [0085.561] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.561] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.561] GetMessageTime () returned 0 [0085.561] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.561] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.561] GetMessageTime () returned 0 [0085.561] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.561] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.561] GetMessageTime () returned 0 [0085.561] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.561] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.561] GetMessageTime () returned 0 [0085.561] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.561] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.561] GetMessageTime () returned 0 [0085.562] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.562] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.562] GetMessageTime () returned 0 [0085.562] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.562] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.562] GetMessageTime () returned 0 [0085.562] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.562] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.562] GetMessageTime () returned 0 [0085.562] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.562] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.562] GetMessageTime () returned 0 [0085.562] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.562] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.562] GetMessageTime () returned 0 [0085.562] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.562] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.562] GetMessageTime () returned 0 [0085.562] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.562] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.562] GetMessageTime () returned 0 [0085.562] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.562] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.562] GetMessageTime () returned 0 [0085.563] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.563] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.563] GetMessageTime () returned 0 [0085.563] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.563] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.563] GetMessageTime () returned 0 [0085.563] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.563] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.563] GetMessageTime () returned 0 [0085.563] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.563] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.563] GetMessageTime () returned 0 [0085.563] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.563] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.563] GetMessageTime () returned 0 [0085.563] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.563] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.563] GetMessageTime () returned 0 [0085.563] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.563] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.563] GetMessageTime () returned 0 [0085.563] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.564] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.564] GetMessageTime () returned 0 [0085.564] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.564] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.564] GetMessageTime () returned 0 [0085.564] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.564] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.564] GetMessageTime () returned 0 [0085.564] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.564] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.564] GetMessageTime () returned 0 [0085.564] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.564] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.564] GetMessageTime () returned 0 [0085.564] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.564] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.564] GetMessageTime () returned 0 [0085.564] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.564] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.564] GetMessageTime () returned 0 [0085.564] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.564] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.565] GetMessageTime () returned 0 [0085.565] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.565] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.565] GetMessageTime () returned 0 [0085.565] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.565] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.565] GetMessageTime () returned 0 [0085.565] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.565] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.565] GetMessageTime () returned 0 [0085.565] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.565] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.565] GetMessageTime () returned 0 [0085.565] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.565] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.565] GetMessageTime () returned 0 [0085.565] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.565] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.565] GetMessageTime () returned 0 [0085.565] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.565] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.566] GetMessageTime () returned 0 [0085.566] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.566] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.566] GetMessageTime () returned 0 [0085.566] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.566] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.566] GetMessageTime () returned 0 [0085.566] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.566] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.566] GetMessageTime () returned 0 [0085.566] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.566] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.566] GetMessageTime () returned 0 [0085.566] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.566] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.566] GetMessageTime () returned 0 [0085.566] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.566] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.566] GetMessageTime () returned 0 [0085.566] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.566] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.566] GetMessageTime () returned 0 [0085.567] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.567] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.567] GetMessageTime () returned 0 [0085.567] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.567] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.567] GetMessageTime () returned 0 [0085.567] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.567] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.567] GetMessageTime () returned 0 [0085.567] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.567] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.567] GetMessageTime () returned 0 [0085.567] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.567] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.567] GetMessageTime () returned 0 [0085.567] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.567] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.567] GetMessageTime () returned 0 [0085.567] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.567] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.567] GetMessageTime () returned 0 [0085.567] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.567] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.568] GetMessageTime () returned 0 [0085.568] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.568] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.568] GetMessageTime () returned 0 [0085.568] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.568] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.568] GetMessageTime () returned 0 [0085.568] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.568] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.568] GetMessageTime () returned 0 [0085.568] LoadMenuA (hInstance=0x0, lpMenuName=0x0) returned 0x0 [0085.568] CharToOemBuffW (in: lpszSrc=0x0, lpszDst=0x0, cchDstLength=0x0 | out: lpszDst=0x0) returned 0 [0085.568] GetMessageTime () returned 0 [0093.130] LocalAlloc (uFlags=0x0, uBytes=0x29330) returned 0x643858 [0093.233] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x76720000 [0093.237] GetProcAddress (hModule=0x76720000, lpProcName="") returned 0x0 [0093.237] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76720000 [0093.238] GetProcAddress (hModule=0x76720000, lpProcName="VirtualProtect") returned 0x76737a50 [0093.238] VirtualProtect (in: lpAddress=0x643858, dwSize=0x29330, flNewProtect=0x40, lpflOldProtect=0x19bcb0 | out: lpflOldProtect=0x19bcb0*=0x4) returned 1 [0093.246] SetLastError (dwErrCode=0x0) [0093.246] GetLastError () returned 0x0 [0093.246] SetLastError (dwErrCode=0x0) [0093.246] GetLastError () returned 0x0 [0093.246] SetLastError (dwErrCode=0x0) [0093.246] GetLastError () returned 0x0 [0093.246] SetLastError (dwErrCode=0x0) [0093.246] GetLastError () returned 0x0 [0093.246] SetLastError (dwErrCode=0x0) [0093.246] GetLastError () returned 0x0 [0093.246] SetLastError (dwErrCode=0x0) [0093.246] GetLastError () returned 0x0 [0093.246] SetLastError (dwErrCode=0x0) [0093.246] GetLastError () returned 0x0 [0093.246] SetLastError (dwErrCode=0x0) [0093.246] GetLastError () returned 0x0 [0093.246] SetLastError (dwErrCode=0x0) [0093.246] GetLastError () returned 0x0 [0093.246] SetLastError (dwErrCode=0x0) [0093.246] GetLastError () returned 0x0 [0093.246] SetLastError (dwErrCode=0x0) [0093.246] GetLastError () returned 0x0 [0093.246] SetLastError (dwErrCode=0x0) [0093.246] GetLastError () returned 0x0 [0093.246] SetLastError (dwErrCode=0x0) [0093.246] GetLastError () returned 0x0 [0093.246] SetLastError (dwErrCode=0x0) [0093.246] GetLastError () returned 0x0 [0093.246] SetLastError (dwErrCode=0x0) [0093.247] GetLastError () returned 0x0 [0093.247] SetLastError (dwErrCode=0x0) [0093.247] GetLastError () returned 0x0 [0093.247] SetLastError (dwErrCode=0x0) [0093.247] GetLastError () returned 0x0 [0093.247] SetLastError (dwErrCode=0x0) [0093.247] GetLastError () returned 0x0 [0093.247] SetLastError (dwErrCode=0x0) [0093.247] GetLastError () returned 0x0 [0093.247] SetLastError (dwErrCode=0x0) [0093.247] GetLastError () returned 0x0 [0093.247] SetLastError (dwErrCode=0x0) [0093.247] GetLastError () returned 0x0 [0093.247] SetLastError (dwErrCode=0x0) [0093.247] GetLastError () returned 0x0 [0093.247] SetLastError (dwErrCode=0x0) [0093.247] GetLastError () returned 0x0 [0093.247] SetLastError (dwErrCode=0x0) [0093.247] GetLastError () returned 0x0 [0093.247] SetLastError (dwErrCode=0x0) [0093.247] GetLastError () returned 0x0 [0093.247] SetLastError (dwErrCode=0x0) [0093.247] GetLastError () returned 0x0 [0093.249] SetLastError (dwErrCode=0x0) [0093.249] GetLastError () returned 0x0 [0093.249] SetLastError (dwErrCode=0x0) [0093.249] GetLastError () returned 0x0 [0093.249] SetLastError (dwErrCode=0x0) [0093.249] GetLastError () returned 0x0 [0093.249] SetLastError (dwErrCode=0x0) [0093.250] GetLastError () returned 0x0 [0093.250] SetLastError (dwErrCode=0x0) [0093.250] GetLastError () returned 0x0 [0093.250] SetLastError (dwErrCode=0x0) [0093.250] GetLastError () returned 0x0 [0093.250] SetLastError (dwErrCode=0x0) [0093.250] GetLastError () returned 0x0 [0093.250] SetLastError (dwErrCode=0x0) [0093.250] GetLastError () returned 0x0 [0093.250] SetLastError (dwErrCode=0x0) [0093.250] GetLastError () returned 0x0 [0093.250] SetLastError (dwErrCode=0x0) [0093.250] GetLastError () returned 0x0 [0093.250] SetLastError (dwErrCode=0x0) [0093.250] GetLastError () returned 0x0 [0093.250] SetLastError (dwErrCode=0x0) [0093.250] GetLastError () returned 0x0 [0093.250] SetLastError (dwErrCode=0x0) [0093.250] GetLastError () returned 0x0 [0093.250] SetLastError (dwErrCode=0x0) [0093.250] GetLastError () returned 0x0 [0093.250] SetLastError (dwErrCode=0x0) [0093.250] GetLastError () returned 0x0 [0093.250] SetLastError (dwErrCode=0x0) [0093.250] GetLastError () returned 0x0 [0093.250] SetLastError (dwErrCode=0x0) [0093.250] GetLastError () returned 0x0 [0093.250] SetLastError (dwErrCode=0x0) [0093.250] GetLastError () returned 0x0 [0093.250] SetLastError (dwErrCode=0x0) [0093.250] GetLastError () returned 0x0 [0093.250] SetLastError (dwErrCode=0x0) [0093.250] GetLastError () returned 0x0 [0093.250] SetLastError (dwErrCode=0x0) [0093.250] GetLastError () returned 0x0 [0093.250] SetLastError (dwErrCode=0x0) [0093.250] GetLastError () returned 0x0 [0093.250] SetLastError (dwErrCode=0x0) [0093.251] GetLastError () returned 0x0 [0093.251] SetLastError (dwErrCode=0x0) [0093.251] GetLastError () returned 0x0 [0093.251] SetLastError (dwErrCode=0x0) [0093.251] GetLastError () returned 0x0 [0093.251] SetLastError (dwErrCode=0x0) [0093.251] GetLastError () returned 0x0 [0093.251] SetLastError (dwErrCode=0x0) [0093.251] GetLastError () returned 0x0 [0093.251] SetLastError (dwErrCode=0x0) [0093.251] GetLastError () returned 0x0 [0093.251] SetLastError (dwErrCode=0x0) [0093.251] GetLastError () returned 0x0 [0093.251] SetLastError (dwErrCode=0x0) [0093.251] GetLastError () returned 0x0 [0093.251] SetLastError (dwErrCode=0x0) [0093.251] GetLastError () returned 0x0 [0093.251] SetLastError (dwErrCode=0x0) [0093.251] GetLastError () returned 0x0 [0093.251] SetLastError (dwErrCode=0x0) [0093.251] GetLastError () returned 0x0 [0093.251] SetLastError (dwErrCode=0x0) [0093.251] GetLastError () returned 0x0 [0093.251] SetLastError (dwErrCode=0x0) [0093.251] GetLastError () returned 0x0 [0093.251] SetLastError (dwErrCode=0x0) [0093.251] GetLastError () returned 0x0 [0093.251] SetLastError (dwErrCode=0x0) [0093.251] GetLastError () returned 0x0 [0093.251] SetLastError (dwErrCode=0x0) [0093.251] GetLastError () returned 0x0 [0093.251] SetLastError (dwErrCode=0x0) [0093.251] GetLastError () returned 0x0 [0093.251] SetLastError (dwErrCode=0x0) [0093.251] GetLastError () returned 0x0 [0093.251] SetLastError (dwErrCode=0x0) [0093.251] GetLastError () returned 0x0 [0093.251] SetLastError (dwErrCode=0x0) [0093.251] GetLastError () returned 0x0 [0093.251] SetLastError (dwErrCode=0x0) [0093.252] GetLastError () returned 0x0 [0093.252] SetLastError (dwErrCode=0x0) [0093.252] GetLastError () returned 0x0 [0093.252] SetLastError (dwErrCode=0x0) [0093.252] GetLastError () returned 0x0 [0093.252] SetLastError (dwErrCode=0x0) [0093.252] GetLastError () returned 0x0 [0093.252] SetLastError (dwErrCode=0x0) [0093.252] GetLastError () returned 0x0 [0093.252] SetLastError (dwErrCode=0x0) [0093.252] GetLastError () returned 0x0 [0093.252] SetLastError (dwErrCode=0x0) [0093.252] GetLastError () returned 0x0 [0093.252] SetLastError (dwErrCode=0x0) [0093.252] GetLastError () returned 0x0 [0093.252] SetLastError (dwErrCode=0x0) [0093.252] GetLastError () returned 0x0 [0093.252] SetLastError (dwErrCode=0x0) [0093.252] GetLastError () returned 0x0 [0093.252] SetLastError (dwErrCode=0x0) [0093.252] GetLastError () returned 0x0 [0093.252] SetLastError (dwErrCode=0x0) [0093.252] GetLastError () returned 0x0 [0093.252] SetLastError (dwErrCode=0x0) [0093.252] GetLastError () returned 0x0 [0093.252] SetLastError (dwErrCode=0x0) [0093.252] GetLastError () returned 0x0 [0093.252] SetLastError (dwErrCode=0x0) [0093.252] GetLastError () returned 0x0 [0093.252] SetLastError (dwErrCode=0x0) [0093.252] GetLastError () returned 0x0 [0093.252] SetLastError (dwErrCode=0x0) [0093.252] GetLastError () returned 0x0 [0093.252] SetLastError (dwErrCode=0x0) [0093.252] GetLastError () returned 0x0 [0093.252] SetLastError (dwErrCode=0x0) [0093.252] GetLastError () returned 0x0 [0093.253] SetLastError (dwErrCode=0x0) [0093.253] GetLastError () returned 0x0 [0093.253] SetLastError (dwErrCode=0x0) [0093.253] GetLastError () returned 0x0 [0093.253] SetLastError (dwErrCode=0x0) [0093.253] GetLastError () returned 0x0 [0093.253] SetLastError (dwErrCode=0x0) [0093.253] GetLastError () returned 0x0 [0093.253] SetLastError (dwErrCode=0x0) [0093.253] GetLastError () returned 0x0 [0093.253] SetLastError (dwErrCode=0x0) [0093.253] GetLastError () returned 0x0 [0093.253] SetLastError (dwErrCode=0x0) [0093.253] GetLastError () returned 0x0 [0093.253] SetLastError (dwErrCode=0x0) [0093.253] GetLastError () returned 0x0 [0093.253] SetLastError (dwErrCode=0x0) [0093.253] GetLastError () returned 0x0 [0093.253] SetLastError (dwErrCode=0x0) [0093.253] GetLastError () returned 0x0 [0093.253] SetLastError (dwErrCode=0x0) [0093.253] GetLastError () returned 0x0 [0093.253] SetLastError (dwErrCode=0x0) [0093.253] GetLastError () returned 0x0 [0093.253] SetLastError (dwErrCode=0x0) [0093.253] GetLastError () returned 0x0 [0093.253] SetLastError (dwErrCode=0x0) [0093.253] GetLastError () returned 0x0 [0093.253] SetLastError (dwErrCode=0x0) [0093.253] GetLastError () returned 0x0 [0093.253] SetLastError (dwErrCode=0x0) [0093.253] GetLastError () returned 0x0 [0093.253] SetLastError (dwErrCode=0x0) [0093.253] GetLastError () returned 0x0 [0093.253] SetLastError (dwErrCode=0x0) [0093.253] GetLastError () returned 0x0 [0093.253] SetLastError (dwErrCode=0x0) [0093.253] GetLastError () returned 0x0 [0093.253] SetLastError (dwErrCode=0x0) [0093.253] GetLastError () returned 0x0 [0093.253] SetLastError (dwErrCode=0x0) [0093.254] GetLastError () returned 0x0 [0093.254] SetLastError (dwErrCode=0x0) [0093.254] GetLastError () returned 0x0 [0093.254] SetLastError (dwErrCode=0x0) [0093.254] GetLastError () returned 0x0 [0093.254] SetLastError (dwErrCode=0x0) [0093.254] GetLastError () returned 0x0 [0093.254] SetLastError (dwErrCode=0x0) [0093.254] GetLastError () returned 0x0 [0093.254] SetLastError (dwErrCode=0x0) [0093.254] GetLastError () returned 0x0 [0093.254] SetLastError (dwErrCode=0x0) [0093.254] GetLastError () returned 0x0 [0093.254] SetLastError (dwErrCode=0x0) [0093.254] GetLastError () returned 0x0 [0093.254] SetLastError (dwErrCode=0x0) [0093.254] GetLastError () returned 0x0 [0093.254] SetLastError (dwErrCode=0x0) [0093.254] GetLastError () returned 0x0 [0093.254] SetLastError (dwErrCode=0x0) [0093.254] GetLastError () returned 0x0 [0093.254] SetLastError (dwErrCode=0x0) [0093.254] GetLastError () returned 0x0 [0093.254] SetLastError (dwErrCode=0x0) [0093.254] GetLastError () returned 0x0 [0093.254] SetLastError (dwErrCode=0x0) [0093.254] GetLastError () returned 0x0 [0093.254] SetLastError (dwErrCode=0x0) [0093.254] GetLastError () returned 0x0 [0093.254] SetLastError (dwErrCode=0x0) [0093.254] GetLastError () returned 0x0 [0093.254] SetLastError (dwErrCode=0x0) [0093.254] GetLastError () returned 0x0 [0093.254] SetLastError (dwErrCode=0x0) [0093.254] GetLastError () returned 0x0 [0093.254] SetLastError (dwErrCode=0x0) [0093.254] GetLastError () returned 0x0 [0093.254] SetLastError (dwErrCode=0x0) [0093.254] GetLastError () returned 0x0 [0093.254] SetLastError (dwErrCode=0x0) [0093.255] GetLastError () returned 0x0 [0093.255] SetLastError (dwErrCode=0x0) [0093.255] GetLastError () returned 0x0 [0093.255] SetLastError (dwErrCode=0x0) [0093.255] GetLastError () returned 0x0 [0093.255] SetLastError (dwErrCode=0x0) [0093.255] GetLastError () returned 0x0 [0093.255] SetLastError (dwErrCode=0x0) [0093.255] GetLastError () returned 0x0 [0093.255] SetLastError (dwErrCode=0x0) [0093.255] GetLastError () returned 0x0 [0093.255] SetLastError (dwErrCode=0x0) [0093.255] GetLastError () returned 0x0 [0093.255] SetLastError (dwErrCode=0x0) [0093.255] GetLastError () returned 0x0 [0093.255] SetLastError (dwErrCode=0x0) [0093.255] GetLastError () returned 0x0 [0093.255] SetLastError (dwErrCode=0x0) [0093.255] GetLastError () returned 0x0 [0093.255] SetLastError (dwErrCode=0x0) [0093.255] GetLastError () returned 0x0 [0093.255] SetLastError (dwErrCode=0x0) [0093.255] GetLastError () returned 0x0 [0093.255] SetLastError (dwErrCode=0x0) [0093.255] GetLastError () returned 0x0 [0093.255] SetLastError (dwErrCode=0x0) [0093.255] GetLastError () returned 0x0 [0093.255] SetLastError (dwErrCode=0x0) [0093.255] GetLastError () returned 0x0 [0093.255] SetLastError (dwErrCode=0x0) [0093.255] GetLastError () returned 0x0 [0093.255] SetLastError (dwErrCode=0x0) [0093.255] GetLastError () returned 0x0 [0093.255] SetLastError (dwErrCode=0x0) [0093.255] GetLastError () returned 0x0 [0093.255] SetLastError (dwErrCode=0x0) [0093.255] GetLastError () returned 0x0 [0093.255] SetLastError (dwErrCode=0x0) [0093.255] GetLastError () returned 0x0 [0093.255] SetLastError (dwErrCode=0x0) [0093.256] GetLastError () returned 0x0 [0093.256] SetLastError (dwErrCode=0x0) [0093.256] GetLastError () returned 0x0 [0093.256] SetLastError (dwErrCode=0x0) [0093.256] GetLastError () returned 0x0 [0093.256] SetLastError (dwErrCode=0x0) [0093.256] GetLastError () returned 0x0 [0093.256] SetLastError (dwErrCode=0x0) [0093.256] GetLastError () returned 0x0 [0093.256] SetLastError (dwErrCode=0x0) [0093.256] GetLastError () returned 0x0 [0093.256] SetLastError (dwErrCode=0x0) [0093.256] GetLastError () returned 0x0 [0093.256] SetLastError (dwErrCode=0x0) [0093.256] GetLastError () returned 0x0 [0093.256] SetLastError (dwErrCode=0x0) [0093.256] GetLastError () returned 0x0 [0093.256] SetLastError (dwErrCode=0x0) [0093.256] GetLastError () returned 0x0 [0093.256] SetLastError (dwErrCode=0x0) [0093.256] GetLastError () returned 0x0 [0093.256] SetLastError (dwErrCode=0x0) [0093.256] GetLastError () returned 0x0 [0093.256] SetLastError (dwErrCode=0x0) [0093.256] GetLastError () returned 0x0 [0093.256] SetLastError (dwErrCode=0x0) [0093.256] GetLastError () returned 0x0 [0093.256] SetLastError (dwErrCode=0x0) [0093.256] GetLastError () returned 0x0 [0093.256] SetLastError (dwErrCode=0x0) [0093.256] GetLastError () returned 0x0 [0093.256] SetLastError (dwErrCode=0x0) [0093.256] GetLastError () returned 0x0 [0093.256] SetLastError (dwErrCode=0x0) [0093.256] GetLastError () returned 0x0 [0093.256] SetLastError (dwErrCode=0x0) [0093.256] GetLastError () returned 0x0 [0093.256] SetLastError (dwErrCode=0x0) [0093.257] GetLastError () returned 0x0 [0093.257] SetLastError (dwErrCode=0x0) [0093.257] GetLastError () returned 0x0 [0093.257] SetLastError (dwErrCode=0x0) [0093.257] GetLastError () returned 0x0 [0093.257] SetLastError (dwErrCode=0x0) [0093.257] GetLastError () returned 0x0 [0093.257] SetLastError (dwErrCode=0x0) [0093.257] GetLastError () returned 0x0 [0093.257] SetLastError (dwErrCode=0x0) [0093.257] GetLastError () returned 0x0 [0093.257] SetLastError (dwErrCode=0x0) [0093.257] GetLastError () returned 0x0 [0093.257] SetLastError (dwErrCode=0x0) [0093.257] GetLastError () returned 0x0 [0093.257] SetLastError (dwErrCode=0x0) [0093.257] GetLastError () returned 0x0 [0093.257] SetLastError (dwErrCode=0x0) [0093.257] GetLastError () returned 0x0 [0093.257] SetLastError (dwErrCode=0x0) [0093.257] GetLastError () returned 0x0 [0093.257] SetLastError (dwErrCode=0x0) [0093.257] GetLastError () returned 0x0 [0093.257] SetLastError (dwErrCode=0x0) [0093.257] GetLastError () returned 0x0 [0093.257] SetLastError (dwErrCode=0x0) [0093.257] GetLastError () returned 0x0 [0093.257] SetLastError (dwErrCode=0x0) [0093.257] GetLastError () returned 0x0 [0093.257] SetLastError (dwErrCode=0x0) [0093.257] GetLastError () returned 0x0 [0093.257] SetLastError (dwErrCode=0x0) [0093.257] GetLastError () returned 0x0 [0093.257] SetLastError (dwErrCode=0x0) [0093.257] GetLastError () returned 0x0 [0093.257] SetLastError (dwErrCode=0x0) [0093.257] GetLastError () returned 0x0 [0093.257] SetLastError (dwErrCode=0x0) [0093.257] GetLastError () returned 0x0 [0093.257] SetLastError (dwErrCode=0x0) [0093.258] GetLastError () returned 0x0 [0093.258] SetLastError (dwErrCode=0x0) [0093.258] GetLastError () returned 0x0 [0093.258] SetLastError (dwErrCode=0x0) [0093.258] GetLastError () returned 0x0 [0093.258] SetLastError (dwErrCode=0x0) [0093.258] GetLastError () returned 0x0 [0093.258] SetLastError (dwErrCode=0x0) [0093.258] GetLastError () returned 0x0 [0093.258] SetLastError (dwErrCode=0x0) [0093.258] GetLastError () returned 0x0 [0093.258] SetLastError (dwErrCode=0x0) [0093.258] GetLastError () returned 0x0 [0093.258] SetLastError (dwErrCode=0x0) [0093.258] GetLastError () returned 0x0 [0093.258] SetLastError (dwErrCode=0x0) [0093.258] GetLastError () returned 0x0 [0093.258] SetLastError (dwErrCode=0x0) [0093.258] GetLastError () returned 0x0 [0093.258] SetLastError (dwErrCode=0x0) [0093.258] GetLastError () returned 0x0 [0093.258] SetLastError (dwErrCode=0x0) [0093.258] GetLastError () returned 0x0 [0093.258] SetLastError (dwErrCode=0x0) [0093.258] GetLastError () returned 0x0 [0093.258] SetLastError (dwErrCode=0x0) [0093.258] GetLastError () returned 0x0 [0093.258] SetLastError (dwErrCode=0x0) [0093.258] GetLastError () returned 0x0 [0093.258] SetLastError (dwErrCode=0x0) [0093.258] GetLastError () returned 0x0 [0093.258] SetLastError (dwErrCode=0x0) [0093.258] GetLastError () returned 0x0 [0093.258] SetLastError (dwErrCode=0x0) [0093.258] GetLastError () returned 0x0 [0093.258] SetLastError (dwErrCode=0x0) [0093.258] GetLastError () returned 0x0 [0093.259] SetLastError (dwErrCode=0x0) [0093.259] GetLastError () returned 0x0 [0093.259] SetLastError (dwErrCode=0x0) [0093.259] GetLastError () returned 0x0 [0093.259] SetLastError (dwErrCode=0x0) [0093.259] GetLastError () returned 0x0 [0093.259] SetLastError (dwErrCode=0x0) [0093.259] GetLastError () returned 0x0 [0093.259] SetLastError (dwErrCode=0x0) [0093.259] GetLastError () returned 0x0 [0093.259] SetLastError (dwErrCode=0x0) [0093.259] GetLastError () returned 0x0 [0093.259] SetLastError (dwErrCode=0x0) [0093.259] GetLastError () returned 0x0 [0093.259] SetLastError (dwErrCode=0x0) [0093.259] GetLastError () returned 0x0 [0093.259] SetLastError (dwErrCode=0x0) [0093.259] GetLastError () returned 0x0 [0093.259] SetLastError (dwErrCode=0x0) [0093.259] GetLastError () returned 0x0 [0093.259] SetLastError (dwErrCode=0x0) [0093.259] GetLastError () returned 0x0 [0093.259] SetLastError (dwErrCode=0x0) [0093.259] GetLastError () returned 0x0 [0093.259] SetLastError (dwErrCode=0x0) [0093.259] GetLastError () returned 0x0 [0093.259] SetLastError (dwErrCode=0x0) [0093.259] GetLastError () returned 0x0 [0093.259] SetLastError (dwErrCode=0x0) [0093.259] GetLastError () returned 0x0 [0093.259] SetLastError (dwErrCode=0x0) [0093.259] GetLastError () returned 0x0 [0093.259] SetLastError (dwErrCode=0x0) [0093.259] GetLastError () returned 0x0 [0093.259] SetLastError (dwErrCode=0x0) [0093.259] GetLastError () returned 0x0 [0093.259] SetLastError (dwErrCode=0x0) [0093.259] GetLastError () returned 0x0 [0093.259] SetLastError (dwErrCode=0x0) [0093.259] GetLastError () returned 0x0 [0093.260] SetLastError (dwErrCode=0x0) [0093.260] GetLastError () returned 0x0 [0093.260] SetLastError (dwErrCode=0x0) [0093.260] GetLastError () returned 0x0 [0093.260] SetLastError (dwErrCode=0x0) [0093.260] GetLastError () returned 0x0 [0093.260] SetLastError (dwErrCode=0x0) [0093.260] GetLastError () returned 0x0 [0093.260] SetLastError (dwErrCode=0x0) [0093.260] GetLastError () returned 0x0 [0093.260] SetLastError (dwErrCode=0x0) [0093.260] GetLastError () returned 0x0 [0093.260] SetLastError (dwErrCode=0x0) [0093.260] GetLastError () returned 0x0 [0093.260] SetLastError (dwErrCode=0x0) [0093.260] GetLastError () returned 0x0 [0093.260] SetLastError (dwErrCode=0x0) [0093.260] GetLastError () returned 0x0 [0093.260] SetLastError (dwErrCode=0x0) [0093.260] GetLastError () returned 0x0 [0093.260] SetLastError (dwErrCode=0x0) [0093.260] GetLastError () returned 0x0 [0093.260] SetLastError (dwErrCode=0x0) [0093.260] GetLastError () returned 0x0 [0093.260] SetLastError (dwErrCode=0x0) [0093.260] GetLastError () returned 0x0 [0093.260] SetLastError (dwErrCode=0x0) [0093.260] GetLastError () returned 0x0 [0093.260] SetLastError (dwErrCode=0x0) [0093.260] GetLastError () returned 0x0 [0093.260] SetLastError (dwErrCode=0x0) [0093.260] GetLastError () returned 0x0 [0093.260] SetLastError (dwErrCode=0x0) [0093.260] GetLastError () returned 0x0 [0093.260] SetLastError (dwErrCode=0x0) [0093.260] GetLastError () returned 0x0 [0093.260] SetLastError (dwErrCode=0x0) [0093.260] GetLastError () returned 0x0 [0093.260] SetLastError (dwErrCode=0x0) [0093.261] GetLastError () returned 0x0 [0093.261] SetLastError (dwErrCode=0x0) [0093.261] GetLastError () returned 0x0 [0093.261] SetLastError (dwErrCode=0x0) [0093.261] GetLastError () returned 0x0 [0093.261] SetLastError (dwErrCode=0x0) [0093.261] GetLastError () returned 0x0 [0093.261] SetLastError (dwErrCode=0x0) [0093.261] GetLastError () returned 0x0 [0093.493] LoadLibraryA (lpLibFileName="msimg32.dll") returned 0x6f8a0000 [0093.515] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76720000 [0093.516] GetProcAddress (hModule=0x76720000, lpProcName="GlobalAlloc") returned 0x76739950 [0093.516] GetProcAddress (hModule=0x76720000, lpProcName="GetLastError") returned 0x76733870 [0093.516] GetProcAddress (hModule=0x76720000, lpProcName="Sleep") returned 0x76737990 [0093.516] GetProcAddress (hModule=0x76720000, lpProcName="VirtualAlloc") returned 0x76737810 [0093.516] GetProcAddress (hModule=0x76720000, lpProcName="CreateToolhelp32Snapshot") returned 0x76747b50 [0093.516] GetProcAddress (hModule=0x76720000, lpProcName="Module32First") returned 0x767644b0 [0093.516] GetProcAddress (hModule=0x76720000, lpProcName="CloseHandle") returned 0x76746630 [0093.518] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0xc8 [0093.527] Module32First (hSnapshot=0xc8, lpme=0x19cf4c) returned 1 [0093.529] VirtualAlloc (lpAddress=0x0, dwSize=0x37267, flAllocationType=0x1000, flProtect=0x40) returned 0x580000 [0093.540] GetProcAddress (hModule=0x76720000, lpProcName="LoadLibraryA") returned 0x76744bf0 [0093.540] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76720000 [0093.540] GetProcAddress (hModule=0x76720000, lpProcName="VirtualAlloc") returned 0x76737810 [0093.540] GetProcAddress (hModule=0x76720000, lpProcName="VirtualProtect") returned 0x76737a50 [0093.540] GetProcAddress (hModule=0x76720000, lpProcName="VirtualFree") returned 0x76737600 [0093.540] GetProcAddress (hModule=0x76720000, lpProcName="GetVersionExA") returned 0x7673a700 [0093.541] GetProcAddress (hModule=0x76720000, lpProcName="TerminateProcess") returned 0x76745100 [0093.541] GetProcAddress (hModule=0x76720000, lpProcName="ExitProcess") returned 0x76747b30 [0093.541] GetProcAddress (hModule=0x76720000, lpProcName="SetErrorMode") returned 0x76738d20 [0093.541] SetErrorMode (uMode=0x400) returned 0x0 [0093.541] SetErrorMode (uMode=0x0) returned 0x400 [0093.541] GetVersionExA (in: lpVersionInformation=0x19be7c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x8000d, dwMinorVersion=0x63a4e8, dwBuildNumber=0x8, dwPlatformId=0x19beb4, szCSDVersion="y\x04 w?`VüÈ") | out: lpVersionInformation=0x19be7c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0093.541] VirtualAlloc (lpAddress=0x0, dwSize=0x36400, flAllocationType=0x1000, flProtect=0x4) returned 0x5c0000 [0093.575] VirtualProtect (in: lpAddress=0x400000, dwSize=0x3b000, flNewProtect=0x40, lpflOldProtect=0x19cf04 | out: lpflOldProtect=0x19cf04*=0x2) returned 1 [0093.683] VirtualFree (lpAddress=0x5c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.687] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76720000 [0093.687] GetProcAddress (hModule=0x76720000, lpProcName="RaiseException") returned 0x76738c20 [0093.687] GetProcAddress (hModule=0x76720000, lpProcName="GetLastError") returned 0x76733870 [0093.687] GetProcAddress (hModule=0x76720000, lpProcName="MultiByteToWideChar") returned 0x76732ad0 [0093.687] GetProcAddress (hModule=0x76720000, lpProcName="lstrlenA") returned 0x76738c80 [0093.687] GetProcAddress (hModule=0x76720000, lpProcName="InterlockedDecrement") returned 0x76742a20 [0093.687] GetProcAddress (hModule=0x76720000, lpProcName="GetProcAddress") returned 0x767378b0 [0093.687] GetProcAddress (hModule=0x76720000, lpProcName="LoadLibraryA") returned 0x76744bf0 [0093.687] GetProcAddress (hModule=0x76720000, lpProcName="FreeResource") returned 0x76744a60 [0093.688] GetProcAddress (hModule=0x76720000, lpProcName="SizeofResource") returned 0x76738f80 [0093.688] GetProcAddress (hModule=0x76720000, lpProcName="LockResource") returned 0x76737890 [0093.688] GetProcAddress (hModule=0x76720000, lpProcName="LoadResource") returned 0x767376f0 [0093.688] GetProcAddress (hModule=0x76720000, lpProcName="FindResourceA") returned 0x7673cb90 [0093.688] GetProcAddress (hModule=0x76720000, lpProcName="GetModuleHandleA") returned 0x767399f0 [0093.688] GetProcAddress (hModule=0x76720000, lpProcName="Module32Next") returned 0x76764660 [0093.688] GetProcAddress (hModule=0x76720000, lpProcName="CloseHandle") returned 0x76746630 [0093.688] GetProcAddress (hModule=0x76720000, lpProcName="Module32First") returned 0x767644b0 [0093.688] GetProcAddress (hModule=0x76720000, lpProcName="CreateToolhelp32Snapshot") returned 0x76747b50 [0093.688] GetProcAddress (hModule=0x76720000, lpProcName="GetCurrentProcessId") returned 0x767323e0 [0093.689] GetProcAddress (hModule=0x76720000, lpProcName="SetEndOfFile") returned 0x76746c00 [0093.689] GetProcAddress (hModule=0x76720000, lpProcName="GetStringTypeW") returned 0x76737950 [0093.689] GetProcAddress (hModule=0x76720000, lpProcName="GetStringTypeA") returned 0x7673fe60 [0093.689] GetProcAddress (hModule=0x76720000, lpProcName="LCMapStringW") returned 0x76739f30 [0093.689] GetProcAddress (hModule=0x76720000, lpProcName="LCMapStringA") returned 0x767400d0 [0093.689] GetProcAddress (hModule=0x76720000, lpProcName="GetLocaleInfoA") returned 0x7673e7b0 [0093.689] GetProcAddress (hModule=0x76720000, lpProcName="HeapFree") returned 0x76731ba0 [0093.689] GetProcAddress (hModule=0x76720000, lpProcName="GetProcessHeap") returned 0x76737710 [0093.689] GetProcAddress (hModule=0x76720000, lpProcName="HeapAlloc") returned 0x77202bd0 [0093.689] GetProcAddress (hModule=0x76720000, lpProcName="GetCommandLineA") returned 0x7673ab60 [0093.690] GetProcAddress (hModule=0x76720000, lpProcName="HeapCreate") returned 0x7673a100 [0093.690] GetProcAddress (hModule=0x76720000, lpProcName="VirtualFree") returned 0x76737600 [0093.690] GetProcAddress (hModule=0x76720000, lpProcName="DeleteCriticalSection") returned 0x77220e60 [0093.690] GetProcAddress (hModule=0x76720000, lpProcName="LeaveCriticalSection") returned 0x7720f210 [0093.690] GetProcAddress (hModule=0x76720000, lpProcName="EnterCriticalSection") returned 0x7720f290 [0093.690] GetProcAddress (hModule=0x76720000, lpProcName="VirtualAlloc") returned 0x76737810 [0093.690] GetProcAddress (hModule=0x76720000, lpProcName="HeapReAlloc") returned 0x771fefe0 [0093.690] GetProcAddress (hModule=0x76720000, lpProcName="HeapSize") returned 0x771fbb20 [0093.690] GetProcAddress (hModule=0x76720000, lpProcName="TerminateProcess") returned 0x76745100 [0093.690] GetProcAddress (hModule=0x76720000, lpProcName="GetCurrentProcess") returned 0x767338c0 [0093.690] GetProcAddress (hModule=0x76720000, lpProcName="UnhandledExceptionFilter") returned 0x76762670 [0093.690] GetProcAddress (hModule=0x76720000, lpProcName="SetUnhandledExceptionFilter") returned 0x7673a940 [0093.691] GetProcAddress (hModule=0x76720000, lpProcName="IsDebuggerPresent") returned 0x7673b0b0 [0093.691] GetProcAddress (hModule=0x76720000, lpProcName="GetModuleHandleW") returned 0x76739bc0 [0093.691] GetProcAddress (hModule=0x76720000, lpProcName="Sleep") returned 0x76737990 [0093.691] GetProcAddress (hModule=0x76720000, lpProcName="ExitProcess") returned 0x76747b30 [0093.691] GetProcAddress (hModule=0x76720000, lpProcName="WriteFile") returned 0x76746ca0 [0093.691] GetProcAddress (hModule=0x76720000, lpProcName="GetStdHandle") returned 0x7673a6e0 [0093.691] GetProcAddress (hModule=0x76720000, lpProcName="GetModuleFileNameA") returned 0x7673a720 [0093.691] GetProcAddress (hModule=0x76720000, lpProcName="WideCharToMultiByte") returned 0x76733880 [0093.691] GetProcAddress (hModule=0x76720000, lpProcName="GetConsoleCP") returned 0x76746f60 [0093.691] GetProcAddress (hModule=0x76720000, lpProcName="GetConsoleMode") returned 0x76746f70 [0093.691] GetProcAddress (hModule=0x76720000, lpProcName="ReadFile") returned 0x76746bb0 [0093.691] GetProcAddress (hModule=0x76720000, lpProcName="TlsGetValue") returned 0x76731b70 [0093.692] GetProcAddress (hModule=0x76720000, lpProcName="TlsAlloc") returned 0x7673a120 [0093.692] GetProcAddress (hModule=0x76720000, lpProcName="TlsSetValue") returned 0x767329d0 [0093.692] GetProcAddress (hModule=0x76720000, lpProcName="TlsFree") returned 0x7673a040 [0093.692] GetProcAddress (hModule=0x76720000, lpProcName="InterlockedIncrement") returned 0x76742a00 [0093.692] GetProcAddress (hModule=0x76720000, lpProcName="SetLastError") returned 0x76732af0 [0093.692] GetProcAddress (hModule=0x76720000, lpProcName="GetCurrentThreadId") returned 0x76731b90 [0093.692] GetProcAddress (hModule=0x76720000, lpProcName="FlushFileBuffers") returned 0x767469b0 [0093.692] GetProcAddress (hModule=0x76720000, lpProcName="SetFilePointer") returned 0x76746c40 [0093.692] GetProcAddress (hModule=0x76720000, lpProcName="SetHandleCount") returned 0x767450e0 [0093.692] GetProcAddress (hModule=0x76720000, lpProcName="GetFileType") returned 0x76746aa0 [0093.693] GetProcAddress (hModule=0x76720000, lpProcName="GetStartupInfoA") returned 0x76739c10 [0093.693] GetProcAddress (hModule=0x76720000, lpProcName="RtlUnwind") returned 0x76738c10 [0093.693] GetProcAddress (hModule=0x76720000, lpProcName="FreeEnvironmentStringsA") returned 0x76760bf0 [0093.693] GetProcAddress (hModule=0x76720000, lpProcName="GetEnvironmentStrings") returned 0x76760e60 [0093.693] GetProcAddress (hModule=0x76720000, lpProcName="FreeEnvironmentStringsW") returned 0x7673a7e0 [0093.693] GetProcAddress (hModule=0x76720000, lpProcName="GetEnvironmentStringsW") returned 0x7673aac0 [0093.693] GetProcAddress (hModule=0x76720000, lpProcName="QueryPerformanceCounter") returned 0x767338a0 [0093.693] GetProcAddress (hModule=0x76720000, lpProcName="GetTickCount") returned 0x76745eb0 [0093.693] GetProcAddress (hModule=0x76720000, lpProcName="GetSystemTimeAsFileTime") returned 0x76737620 [0093.693] GetProcAddress (hModule=0x76720000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76746730 [0093.693] GetProcAddress (hModule=0x76720000, lpProcName="GetCPInfo") returned 0x7673a290 [0093.694] GetProcAddress (hModule=0x76720000, lpProcName="GetACP") returned 0x76738500 [0093.694] GetProcAddress (hModule=0x76720000, lpProcName="GetOEMCP") returned 0x76745140 [0093.694] GetProcAddress (hModule=0x76720000, lpProcName="IsValidCodePage") returned 0x7673a790 [0093.694] GetProcAddress (hModule=0x76720000, lpProcName="CompareStringA") returned 0x7673e1c0 [0093.694] GetProcAddress (hModule=0x76720000, lpProcName="CompareStringW") returned 0x76742630 [0093.694] GetProcAddress (hModule=0x76720000, lpProcName="SetEnvironmentVariableA") returned 0x767622f0 [0093.694] GetProcAddress (hModule=0x76720000, lpProcName="WriteConsoleA") returned 0x76747010 [0093.694] GetProcAddress (hModule=0x76720000, lpProcName="GetConsoleOutputCP") returned 0x76746f80 [0093.694] GetProcAddress (hModule=0x76720000, lpProcName="WriteConsoleW") returned 0x76747020 [0093.694] GetProcAddress (hModule=0x76720000, lpProcName="SetStdHandle") returned 0x76762430 [0093.695] GetProcAddress (hModule=0x76720000, lpProcName="CreateFileA") returned 0x76746880 [0093.695] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x74dc0000 [0097.861] GetProcAddress (hModule=0x74dc0000, lpProcName="OleInitialize") returned 0x74de8230 [0097.861] LoadLibraryA (lpLibFileName="OLEAUT32.dll") returned 0x76680000 [0097.869] GetProcAddress (hModule=0x76680000, lpProcName=0xf) returned 0x766a7dd0 [0097.869] GetProcAddress (hModule=0x76680000, lpProcName=0x17) returned 0x766a7d80 [0097.869] GetProcAddress (hModule=0x76680000, lpProcName=0x18) returned 0x76692660 [0097.869] GetProcAddress (hModule=0x76680000, lpProcName=0x10) returned 0x76696200 [0097.869] GetProcAddress (hModule=0x76680000, lpProcName=0x19b) returned 0x766a31e0 [0097.869] GetProcAddress (hModule=0x76680000, lpProcName=0x9) returned 0x76699570 [0097.870] GetProcAddress (hModule=0x76680000, lpProcName=0x8) returned 0x76692590 [0097.870] GetProcAddress (hModule=0x76680000, lpProcName=0x6) returned 0x76699d40 [0097.870] GetProcAddress (hModule=0x76680000, lpProcName=0x2) returned 0x76699c90 [0097.870] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x6f7e0000 [0098.366] GetProcAddress (hModule=0x6f7e0000, lpProcName="atexit") returned 0x6f7fc544 [0098.366] atexit (param_1=0x580920) returned 0 [0098.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19cf18 | out: lpSystemTimeAsFileTime=0x19cf18*(dwLowDateTime=0xf1cc3154, dwHighDateTime=0x1d8a8f6)) [0098.368] GetCurrentProcessId () returned 0x11b4 [0098.368] GetCurrentThreadId () returned 0x11b8 [0098.368] GetTickCount () returned 0x1761283 [0098.368] QueryPerformanceCounter (in: lpPerformanceCount=0x19cf10 | out: lpPerformanceCount=0x19cf10*=2461504967402) returned 1 [0098.620] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x1f0000 [0098.723] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76720000 [0098.723] GetProcAddress (hModule=0x76720000, lpProcName="FlsAlloc") returned 0x7673a980 [0098.723] GetProcAddress (hModule=0x76720000, lpProcName="FlsGetValue") returned 0x76737570 [0098.723] GetProcAddress (hModule=0x76720000, lpProcName="FlsSetValue") returned 0x76739e30 [0098.724] GetProcAddress (hModule=0x76720000, lpProcName="FlsFree") returned 0x76744ff0 [0098.724] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76720000 [0098.724] GetProcAddress (hModule=0x76720000, lpProcName="EncodePointer") returned 0x7722f730 [0098.865] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76720000 [0098.865] GetProcAddress (hModule=0x76720000, lpProcName="EncodePointer") returned 0x7722f730 [0098.889] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76720000 [0098.889] GetProcAddress (hModule=0x76720000, lpProcName="EncodePointer") returned 0x7722f730 [0098.889] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76720000 [0098.889] GetProcAddress (hModule=0x76720000, lpProcName="EncodePointer") returned 0x7722f730 [0098.889] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76720000 [0098.889] GetProcAddress (hModule=0x76720000, lpProcName="EncodePointer") returned 0x7722f730 [0098.889] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76720000 [0098.889] GetProcAddress (hModule=0x76720000, lpProcName="EncodePointer") returned 0x7722f730 [0098.890] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76720000 [0098.890] GetProcAddress (hModule=0x76720000, lpProcName="EncodePointer") returned 0x7722f730 [0098.890] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76720000 [0098.890] GetProcAddress (hModule=0x76720000, lpProcName="DecodePointer") returned 0x7722d830 [0098.892] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x214) returned 0x1f05a8 [0098.892] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76720000 [0098.892] GetProcAddress (hModule=0x76720000, lpProcName="DecodePointer") returned 0x7722d830 [0098.950] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76720000 [0098.950] GetProcAddress (hModule=0x76720000, lpProcName="EncodePointer") returned 0x7722f730 [0098.950] GetProcAddress (hModule=0x76720000, lpProcName="DecodePointer") returned 0x7722d830 [0098.952] GetCurrentThreadId () returned 0x11b8 [0098.952] GetStartupInfoA (in: lpStartupInfo=0x19ce84 | out: lpStartupInfo=0x19ce84*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0098.952] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x800) returned 0x1f07c8 [0098.952] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0098.952] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0098.952] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0098.952] SetHandleCount (uNumber=0x20) returned 0x20 [0098.952] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe\" " [0098.952] GetEnvironmentStringsW () returned 0x66f1f0* [0098.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1293, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1293 [0098.956] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x0, Size=0x50d) returned 0x1f0fd0 [0098.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1293, lpMultiByteStr=0x1f0fd0, cbMultiByte=1293, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1293 [0098.997] FreeEnvironmentStringsW (penv=0x66f1f0) returned 1 [0098.997] GetLastError () returned 0x0 [0098.997] SetLastError (dwErrCode=0x0) [0098.997] GetLastError () returned 0x0 [0098.997] SetLastError (dwErrCode=0x0) [0098.997] GetLastError () returned 0x0 [0098.997] SetLastError (dwErrCode=0x0) [0098.997] GetACP () returned 0x4e4 [0098.997] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x0, Size=0x220) returned 0x1f14e8 [0098.997] GetLastError () returned 0x0 [0098.997] SetLastError (dwErrCode=0x0) [0098.998] IsValidCodePage (CodePage=0x4e4) returned 1 [0098.998] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19ce64 | out: lpCPInfo=0x19ce64) returned 1 [0098.998] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19c930 | out: lpCPInfo=0x19c930) returned 1 [0098.999] GetLastError () returned 0x0 [0098.999] SetLastError (dwErrCode=0x0) [0098.999] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x19c8c0 | out: lpCharType=0x19c8c0) returned 1 [0098.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19cd44, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0098.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19cd44, cbMultiByte=256, lpWideCharStr=0x19c6a8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0098.999] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x19c944 | out: lpCharType=0x19c944) returned 1 [0098.999] GetLastError () returned 0x0 [0098.999] SetLastError (dwErrCode=0x0) [0098.999] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0099.004] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19cd44, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0099.004] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19cd44, cbMultiByte=256, lpWideCharStr=0x19c678, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ硃聇煻AĀ") returned 256 [0099.004] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ硃聇煻AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0099.004] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ硃聇煻AĀ", cchSrc=256, lpDestStr=0x19c468, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0099.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x19cc44, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ²UZì|Î\x19", lpUsedDefaultChar=0x0) returned 256 [0099.004] GetLastError () returned 0x0 [0099.004] SetLastError (dwErrCode=0x0) [0099.004] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19cd44, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0099.004] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19cd44, cbMultiByte=256, lpWideCharStr=0x19c698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ硃聇煻AĀ") returned 256 [0099.004] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ硃聇煻AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0099.004] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ硃聇煻AĀ", cchSrc=256, lpDestStr=0x19c488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0099.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x19cb44, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ²UZì|Î\x19", lpUsedDefaultChar=0x0) returned 256 [0099.004] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x423980, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe")) returned 0x62 [0099.006] GetLastError () returned 0x0 [0099.006] SetLastError (dwErrCode=0x0) [0099.006] GetLastError () returned 0x0 [0099.006] SetLastError (dwErrCode=0x0) [0099.006] GetLastError () returned 0x0 [0099.006] SetLastError (dwErrCode=0x0) [0099.006] GetLastError () returned 0x0 [0099.007] SetLastError (dwErrCode=0x0) [0099.007] GetLastError () returned 0x0 [0099.007] SetLastError (dwErrCode=0x0) [0099.007] GetLastError () returned 0x0 [0099.007] SetLastError (dwErrCode=0x0) [0099.007] GetLastError () returned 0x0 [0099.007] SetLastError (dwErrCode=0x0) [0099.007] GetLastError () returned 0x0 [0099.007] SetLastError (dwErrCode=0x0) [0099.007] GetLastError () returned 0x0 [0099.007] SetLastError (dwErrCode=0x0) [0099.007] GetLastError () returned 0x0 [0099.007] SetLastError (dwErrCode=0x0) [0099.007] GetLastError () returned 0x0 [0099.007] SetLastError (dwErrCode=0x0) [0099.007] GetLastError () returned 0x0 [0099.007] SetLastError (dwErrCode=0x0) [0099.007] GetLastError () returned 0x0 [0099.008] SetLastError (dwErrCode=0x0) [0099.008] GetLastError () returned 0x0 [0099.008] SetLastError (dwErrCode=0x0) [0099.008] GetLastError () returned 0x0 [0099.008] SetLastError (dwErrCode=0x0) [0099.008] GetLastError () returned 0x0 [0099.008] SetLastError (dwErrCode=0x0) [0099.008] GetLastError () returned 0x0 [0099.008] SetLastError (dwErrCode=0x0) [0099.008] GetLastError () returned 0x0 [0099.008] SetLastError (dwErrCode=0x0) [0099.008] GetLastError () returned 0x0 [0099.008] SetLastError (dwErrCode=0x0) [0099.008] GetLastError () returned 0x0 [0099.008] SetLastError (dwErrCode=0x0) [0099.008] GetLastError () returned 0x0 [0099.008] SetLastError (dwErrCode=0x0) [0099.008] GetLastError () returned 0x0 [0099.008] SetLastError (dwErrCode=0x0) [0099.008] GetLastError () returned 0x0 [0099.009] SetLastError (dwErrCode=0x0) [0099.009] GetLastError () returned 0x0 [0099.009] SetLastError (dwErrCode=0x0) [0099.009] GetLastError () returned 0x0 [0099.009] SetLastError (dwErrCode=0x0) [0099.009] GetLastError () returned 0x0 [0099.009] SetLastError (dwErrCode=0x0) [0099.009] GetLastError () returned 0x0 [0099.009] SetLastError (dwErrCode=0x0) [0099.009] GetLastError () returned 0x0 [0099.009] SetLastError (dwErrCode=0x0) [0099.009] GetLastError () returned 0x0 [0099.009] SetLastError (dwErrCode=0x0) [0099.009] GetLastError () returned 0x0 [0099.009] SetLastError (dwErrCode=0x0) [0099.009] GetLastError () returned 0x0 [0099.009] SetLastError (dwErrCode=0x0) [0099.009] GetLastError () returned 0x0 [0099.009] SetLastError (dwErrCode=0x0) [0099.009] GetLastError () returned 0x0 [0099.010] SetLastError (dwErrCode=0x0) [0099.010] GetLastError () returned 0x0 [0099.010] SetLastError (dwErrCode=0x0) [0099.010] GetLastError () returned 0x0 [0099.010] SetLastError (dwErrCode=0x0) [0099.010] GetLastError () returned 0x0 [0099.010] SetLastError (dwErrCode=0x0) [0099.010] GetLastError () returned 0x0 [0099.010] SetLastError (dwErrCode=0x0) [0099.010] GetLastError () returned 0x0 [0099.010] SetLastError (dwErrCode=0x0) [0099.010] GetLastError () returned 0x0 [0099.010] SetLastError (dwErrCode=0x0) [0099.010] GetLastError () returned 0x0 [0099.010] SetLastError (dwErrCode=0x0) [0099.010] GetLastError () returned 0x0 [0099.010] SetLastError (dwErrCode=0x0) [0099.010] GetLastError () returned 0x0 [0099.010] SetLastError (dwErrCode=0x0) [0099.010] GetLastError () returned 0x0 [0099.011] SetLastError (dwErrCode=0x0) [0099.011] GetLastError () returned 0x0 [0099.011] SetLastError (dwErrCode=0x0) [0099.011] GetLastError () returned 0x0 [0099.011] SetLastError (dwErrCode=0x0) [0099.011] GetLastError () returned 0x0 [0099.011] SetLastError (dwErrCode=0x0) [0099.011] GetLastError () returned 0x0 [0099.011] SetLastError (dwErrCode=0x0) [0099.011] GetLastError () returned 0x0 [0099.011] SetLastError (dwErrCode=0x0) [0099.011] GetLastError () returned 0x0 [0099.011] SetLastError (dwErrCode=0x0) [0099.011] GetLastError () returned 0x0 [0099.011] SetLastError (dwErrCode=0x0) [0099.011] GetLastError () returned 0x0 [0099.011] SetLastError (dwErrCode=0x0) [0099.011] GetLastError () returned 0x0 [0099.011] SetLastError (dwErrCode=0x0) [0099.011] GetLastError () returned 0x0 [0099.012] SetLastError (dwErrCode=0x0) [0099.012] GetLastError () returned 0x0 [0099.012] SetLastError (dwErrCode=0x0) [0099.012] GetLastError () returned 0x0 [0099.012] SetLastError (dwErrCode=0x0) [0099.012] GetLastError () returned 0x0 [0099.012] SetLastError (dwErrCode=0x0) [0099.012] GetLastError () returned 0x0 [0099.012] SetLastError (dwErrCode=0x0) [0099.012] GetLastError () returned 0x0 [0099.012] SetLastError (dwErrCode=0x0) [0099.012] GetLastError () returned 0x0 [0099.012] SetLastError (dwErrCode=0x0) [0099.012] GetLastError () returned 0x0 [0099.012] SetLastError (dwErrCode=0x0) [0099.012] GetLastError () returned 0x0 [0099.012] SetLastError (dwErrCode=0x0) [0099.012] GetLastError () returned 0x0 [0099.012] SetLastError (dwErrCode=0x0) [0099.012] GetLastError () returned 0x0 [0099.013] SetLastError (dwErrCode=0x0) [0099.013] GetLastError () returned 0x0 [0099.013] SetLastError (dwErrCode=0x0) [0099.013] GetLastError () returned 0x0 [0099.013] SetLastError (dwErrCode=0x0) [0099.013] GetLastError () returned 0x0 [0099.013] SetLastError (dwErrCode=0x0) [0099.013] GetLastError () returned 0x0 [0099.013] SetLastError (dwErrCode=0x0) [0099.013] GetLastError () returned 0x0 [0099.013] SetLastError (dwErrCode=0x0) [0099.013] GetLastError () returned 0x0 [0099.013] SetLastError (dwErrCode=0x0) [0099.013] GetLastError () returned 0x0 [0099.013] SetLastError (dwErrCode=0x0) [0099.013] GetLastError () returned 0x0 [0099.013] SetLastError (dwErrCode=0x0) [0099.013] GetLastError () returned 0x0 [0099.013] SetLastError (dwErrCode=0x0) [0099.013] GetLastError () returned 0x0 [0099.013] SetLastError (dwErrCode=0x0) [0099.014] GetLastError () returned 0x0 [0099.014] SetLastError (dwErrCode=0x0) [0099.014] GetLastError () returned 0x0 [0099.014] SetLastError (dwErrCode=0x0) [0099.014] GetLastError () returned 0x0 [0099.014] SetLastError (dwErrCode=0x0) [0099.014] GetLastError () returned 0x0 [0099.014] SetLastError (dwErrCode=0x0) [0099.014] GetLastError () returned 0x0 [0099.014] SetLastError (dwErrCode=0x0) [0099.014] GetLastError () returned 0x0 [0099.014] SetLastError (dwErrCode=0x0) [0099.014] GetLastError () returned 0x0 [0099.014] SetLastError (dwErrCode=0x0) [0099.014] GetLastError () returned 0x0 [0099.014] SetLastError (dwErrCode=0x0) [0099.014] GetLastError () returned 0x0 [0099.014] SetLastError (dwErrCode=0x0) [0099.014] GetLastError () returned 0x0 [0099.014] SetLastError (dwErrCode=0x0) [0099.014] GetLastError () returned 0x0 [0099.015] SetLastError (dwErrCode=0x0) [0099.015] GetLastError () returned 0x0 [0099.015] SetLastError (dwErrCode=0x0) [0099.015] GetLastError () returned 0x0 [0099.015] SetLastError (dwErrCode=0x0) [0099.072] GetLastError () returned 0x0 [0099.072] SetLastError (dwErrCode=0x0) [0099.072] GetLastError () returned 0x0 [0099.072] SetLastError (dwErrCode=0x0) [0099.072] GetLastError () returned 0x0 [0099.072] SetLastError (dwErrCode=0x0) [0099.073] GetLastError () returned 0x0 [0099.073] SetLastError (dwErrCode=0x0) [0099.073] GetLastError () returned 0x0 [0099.073] SetLastError (dwErrCode=0x0) [0099.073] GetLastError () returned 0x0 [0099.073] SetLastError (dwErrCode=0x0) [0099.073] GetLastError () returned 0x0 [0099.073] SetLastError (dwErrCode=0x0) [0099.073] GetLastError () returned 0x0 [0099.073] SetLastError (dwErrCode=0x0) [0099.073] GetLastError () returned 0x0 [0099.073] SetLastError (dwErrCode=0x0) [0099.073] GetLastError () returned 0x0 [0099.073] SetLastError (dwErrCode=0x0) [0099.073] GetLastError () returned 0x0 [0099.073] SetLastError (dwErrCode=0x0) [0099.073] GetLastError () returned 0x0 [0099.073] SetLastError (dwErrCode=0x0) [0099.073] GetLastError () returned 0x0 [0099.073] SetLastError (dwErrCode=0x0) [0099.073] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x0, Size=0x6b) returned 0x1f1710 [0099.073] GetLastError () returned 0x0 [0099.074] SetLastError (dwErrCode=0x0) [0099.074] GetLastError () returned 0x0 [0099.074] SetLastError (dwErrCode=0x0) [0099.074] GetLastError () returned 0x0 [0099.074] SetLastError (dwErrCode=0x0) [0099.074] GetLastError () returned 0x0 [0099.074] SetLastError (dwErrCode=0x0) [0099.074] GetLastError () returned 0x0 [0099.074] SetLastError (dwErrCode=0x0) [0099.074] GetLastError () returned 0x0 [0099.074] SetLastError (dwErrCode=0x0) [0099.074] GetLastError () returned 0x0 [0099.074] SetLastError (dwErrCode=0x0) [0099.074] GetLastError () returned 0x0 [0099.074] SetLastError (dwErrCode=0x0) [0099.074] GetLastError () returned 0x0 [0099.074] SetLastError (dwErrCode=0x0) [0099.074] GetLastError () returned 0x0 [0099.074] SetLastError (dwErrCode=0x0) [0099.074] GetLastError () returned 0x0 [0099.074] SetLastError (dwErrCode=0x0) [0099.074] GetLastError () returned 0x0 [0099.074] SetLastError (dwErrCode=0x0) [0099.074] GetLastError () returned 0x0 [0099.074] SetLastError (dwErrCode=0x0) [0099.074] GetLastError () returned 0x0 [0099.075] SetLastError (dwErrCode=0x0) [0099.075] GetLastError () returned 0x0 [0099.075] SetLastError (dwErrCode=0x0) [0099.075] GetLastError () returned 0x0 [0099.075] SetLastError (dwErrCode=0x0) [0099.075] GetLastError () returned 0x0 [0099.075] SetLastError (dwErrCode=0x0) [0099.075] GetLastError () returned 0x0 [0099.075] SetLastError (dwErrCode=0x0) [0099.075] GetLastError () returned 0x0 [0099.075] SetLastError (dwErrCode=0x0) [0099.075] GetLastError () returned 0x0 [0099.075] SetLastError (dwErrCode=0x0) [0099.075] GetLastError () returned 0x0 [0099.075] SetLastError (dwErrCode=0x0) [0099.075] GetLastError () returned 0x0 [0099.075] SetLastError (dwErrCode=0x0) [0099.075] GetLastError () returned 0x0 [0099.075] SetLastError (dwErrCode=0x0) [0099.075] GetLastError () returned 0x0 [0099.075] SetLastError (dwErrCode=0x0) [0099.076] GetLastError () returned 0x0 [0099.076] SetLastError (dwErrCode=0x0) [0099.076] GetLastError () returned 0x0 [0099.076] SetLastError (dwErrCode=0x0) [0099.076] GetLastError () returned 0x0 [0099.076] SetLastError (dwErrCode=0x0) [0099.076] GetLastError () returned 0x0 [0099.076] SetLastError (dwErrCode=0x0) [0099.076] GetLastError () returned 0x0 [0099.076] SetLastError (dwErrCode=0x0) [0099.076] GetLastError () returned 0x0 [0099.076] SetLastError (dwErrCode=0x0) [0099.076] GetLastError () returned 0x0 [0099.076] SetLastError (dwErrCode=0x0) [0099.076] GetLastError () returned 0x0 [0099.076] SetLastError (dwErrCode=0x0) [0099.076] GetLastError () returned 0x0 [0099.076] SetLastError (dwErrCode=0x0) [0099.076] GetLastError () returned 0x0 [0099.077] SetLastError (dwErrCode=0x0) [0099.077] GetLastError () returned 0x0 [0099.077] SetLastError (dwErrCode=0x0) [0099.077] GetLastError () returned 0x0 [0099.077] SetLastError (dwErrCode=0x0) [0099.077] GetLastError () returned 0x0 [0099.077] SetLastError (dwErrCode=0x0) [0099.077] GetLastError () returned 0x0 [0099.077] SetLastError (dwErrCode=0x0) [0099.077] GetLastError () returned 0x0 [0099.077] SetLastError (dwErrCode=0x0) [0099.077] GetLastError () returned 0x0 [0099.077] SetLastError (dwErrCode=0x0) [0099.077] GetLastError () returned 0x0 [0099.077] SetLastError (dwErrCode=0x0) [0099.077] GetLastError () returned 0x0 [0099.078] SetLastError (dwErrCode=0x0) [0099.078] GetLastError () returned 0x0 [0099.078] SetLastError (dwErrCode=0x0) [0099.078] GetLastError () returned 0x0 [0099.078] SetLastError (dwErrCode=0x0) [0099.078] GetLastError () returned 0x0 [0099.078] SetLastError (dwErrCode=0x0) [0099.078] GetLastError () returned 0x0 [0099.078] SetLastError (dwErrCode=0x0) [0099.078] GetLastError () returned 0x0 [0099.078] SetLastError (dwErrCode=0x0) [0099.078] GetLastError () returned 0x0 [0099.078] SetLastError (dwErrCode=0x0) [0099.078] GetLastError () returned 0x0 [0099.078] SetLastError (dwErrCode=0x0) [0099.078] GetLastError () returned 0x0 [0099.078] SetLastError (dwErrCode=0x0) [0099.078] GetLastError () returned 0x0 [0099.078] SetLastError (dwErrCode=0x0) [0099.079] GetLastError () returned 0x0 [0099.079] SetLastError (dwErrCode=0x0) [0099.079] GetLastError () returned 0x0 [0099.079] SetLastError (dwErrCode=0x0) [0099.079] GetLastError () returned 0x0 [0099.079] SetLastError (dwErrCode=0x0) [0099.079] GetLastError () returned 0x0 [0099.079] SetLastError (dwErrCode=0x0) [0099.079] GetLastError () returned 0x0 [0099.079] SetLastError (dwErrCode=0x0) [0099.079] GetLastError () returned 0x0 [0099.079] SetLastError (dwErrCode=0x0) [0099.079] GetLastError () returned 0x0 [0099.079] SetLastError (dwErrCode=0x0) [0099.079] GetLastError () returned 0x0 [0099.079] SetLastError (dwErrCode=0x0) [0099.079] GetLastError () returned 0x0 [0099.079] SetLastError (dwErrCode=0x0) [0099.079] GetLastError () returned 0x0 [0099.079] SetLastError (dwErrCode=0x0) [0099.079] GetLastError () returned 0x0 [0099.079] SetLastError (dwErrCode=0x0) [0099.079] GetLastError () returned 0x0 [0099.079] SetLastError (dwErrCode=0x0) [0099.080] GetLastError () returned 0x0 [0099.080] SetLastError (dwErrCode=0x0) [0099.080] GetLastError () returned 0x0 [0099.080] SetLastError (dwErrCode=0x0) [0099.080] GetLastError () returned 0x0 [0099.080] SetLastError (dwErrCode=0x0) [0099.080] GetLastError () returned 0x0 [0099.080] SetLastError (dwErrCode=0x0) [0099.080] GetLastError () returned 0x0 [0099.080] SetLastError (dwErrCode=0x0) [0099.080] GetLastError () returned 0x0 [0099.080] SetLastError (dwErrCode=0x0) [0099.080] GetLastError () returned 0x0 [0099.080] SetLastError (dwErrCode=0x0) [0099.080] GetLastError () returned 0x0 [0099.080] SetLastError (dwErrCode=0x0) [0099.080] GetLastError () returned 0x0 [0099.080] SetLastError (dwErrCode=0x0) [0099.080] GetLastError () returned 0x0 [0099.080] SetLastError (dwErrCode=0x0) [0099.080] GetLastError () returned 0x0 [0099.080] SetLastError (dwErrCode=0x0) [0099.080] GetLastError () returned 0x0 [0099.081] SetLastError (dwErrCode=0x0) [0099.081] GetLastError () returned 0x0 [0099.081] SetLastError (dwErrCode=0x0) [0099.081] GetLastError () returned 0x0 [0099.081] SetLastError (dwErrCode=0x0) [0099.081] GetLastError () returned 0x0 [0099.081] SetLastError (dwErrCode=0x0) [0099.081] GetLastError () returned 0x0 [0099.081] SetLastError (dwErrCode=0x0) [0099.081] GetLastError () returned 0x0 [0099.081] SetLastError (dwErrCode=0x0) [0099.081] GetLastError () returned 0x0 [0099.081] SetLastError (dwErrCode=0x0) [0099.081] GetLastError () returned 0x0 [0099.081] SetLastError (dwErrCode=0x0) [0099.081] GetLastError () returned 0x0 [0099.081] SetLastError (dwErrCode=0x0) [0099.081] GetLastError () returned 0x0 [0099.081] SetLastError (dwErrCode=0x0) [0099.081] GetLastError () returned 0x0 [0099.081] SetLastError (dwErrCode=0x0) [0099.081] GetLastError () returned 0x0 [0099.081] SetLastError (dwErrCode=0x0) [0099.081] GetLastError () returned 0x0 [0099.081] SetLastError (dwErrCode=0x0) [0099.081] GetLastError () returned 0x0 [0099.082] SetLastError (dwErrCode=0x0) [0099.082] GetLastError () returned 0x0 [0099.082] SetLastError (dwErrCode=0x0) [0099.082] GetLastError () returned 0x0 [0099.082] SetLastError (dwErrCode=0x0) [0099.082] GetLastError () returned 0x0 [0099.082] SetLastError (dwErrCode=0x0) [0099.082] GetLastError () returned 0x0 [0099.082] SetLastError (dwErrCode=0x0) [0099.082] GetLastError () returned 0x0 [0099.082] SetLastError (dwErrCode=0x0) [0099.082] GetLastError () returned 0x0 [0099.082] SetLastError (dwErrCode=0x0) [0099.082] GetLastError () returned 0x0 [0099.082] SetLastError (dwErrCode=0x0) [0099.082] GetLastError () returned 0x0 [0099.082] SetLastError (dwErrCode=0x0) [0099.082] GetLastError () returned 0x0 [0099.082] SetLastError (dwErrCode=0x0) [0099.082] GetLastError () returned 0x0 [0099.082] SetLastError (dwErrCode=0x0) [0099.082] GetLastError () returned 0x0 [0099.082] SetLastError (dwErrCode=0x0) [0099.082] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x90) returned 0x1f1788 [0099.082] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x1f) returned 0x1f1820 [0099.082] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x2e) returned 0x1f1848 [0099.082] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x37) returned 0x1f1880 [0099.082] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x3c) returned 0x1f18c0 [0099.083] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x31) returned 0x1f1908 [0099.083] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x14) returned 0x1f1948 [0099.083] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x24) returned 0x1f1968 [0099.083] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0xd) returned 0x1f1998 [0099.083] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x1d) returned 0x1f19b0 [0099.083] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x31) returned 0x1f19d8 [0099.083] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x15) returned 0x1f1a18 [0099.083] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x17) returned 0x1f1a38 [0099.083] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0xe) returned 0x1f1a58 [0099.083] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x69) returned 0x1f1a70 [0099.083] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x3e) returned 0x1f1ae8 [0099.083] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x1b) returned 0x1f1b30 [0099.083] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x1d) returned 0x1f1b58 [0099.083] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x48) returned 0x1f1b80 [0099.083] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x12) returned 0x1f1bd0 [0099.083] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x18) returned 0x1f1bf0 [0099.083] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x1b) returned 0x1f1c10 [0099.083] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x24) returned 0x1f1c38 [0099.083] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x29) returned 0x1f1c68 [0099.083] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x1e) returned 0x1f1ca0 [0099.083] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x6b) returned 0x1f1cc8 [0099.083] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x17) returned 0x1f1d40 [0099.083] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0xf) returned 0x1f1d60 [0099.083] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x16) returned 0x1f1d78 [0099.083] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x2a) returned 0x1f1d98 [0099.083] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x29) returned 0x1f1dd0 [0099.083] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x12) returned 0x1f1e08 [0099.083] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x21) returned 0x1f1e28 [0099.083] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x16) returned 0x1f1e58 [0099.083] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x22) returned 0x1f1e78 [0099.083] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x12) returned 0x1f1ea8 [0099.084] HeapFree (in: hHeap=0x1f0000, dwFlags=0x0, lpMem=0x1f0fd0 | out: hHeap=0x1f0000) returned 1 [0099.085] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76720000 [0099.085] GetProcAddress (hModule=0x76720000, lpProcName="IsProcessorFeaturePresent") returned 0x76739bf0 [0099.085] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0099.128] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x80) returned 0x1f1ec8 [0099.130] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x8, Size=0x800) returned 0x1f1f50 [0099.152] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4123af) returned 0x415f60 [0099.153] RtlSizeHeap (HeapHandle=0x1f0000, Flags=0x0, MemoryPointer=0x1f1ec8) returned 0x80 [0099.155] OleInitialize (pvReserved=0x0) returned 0x0 [0100.669] GetLastError () returned 0x0 [0100.669] SetLastError (dwErrCode=0x0) [0100.669] GetLastError () returned 0x0 [0100.669] SetLastError (dwErrCode=0x0) [0100.669] GetLastError () returned 0x0 [0100.669] SetLastError (dwErrCode=0x0) [0100.669] GetLastError () returned 0x0 [0100.669] SetLastError (dwErrCode=0x0) [0100.669] GetCurrentProcessId () returned 0x11b4 [0100.673] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x11b4) returned 0x114 [0100.677] Module32First (hSnapshot=0x114, lpme=0x19ccbc) returned 1 [0100.678] Module32Next (hSnapshot=0x114, lpme=0x19ccbc) returned 1 [0100.679] Module32Next (hSnapshot=0x114, lpme=0x19ccbc) returned 1 [0100.679] Module32Next (hSnapshot=0x114, lpme=0x19ccbc) returned 1 [0100.680] Module32Next (hSnapshot=0x114, lpme=0x19ccbc) returned 1 [0100.681] Module32Next (hSnapshot=0x114, lpme=0x19ccbc) returned 1 [0100.681] Module32Next (hSnapshot=0x114, lpme=0x19ccbc) returned 1 [0100.682] Module32Next (hSnapshot=0x114, lpme=0x19ccbc) returned 1 [0100.683] Module32Next (hSnapshot=0x114, lpme=0x19ccbc) returned 1 [0100.683] Module32Next (hSnapshot=0x114, lpme=0x19ccbc) returned 1 [0100.684] Module32Next (hSnapshot=0x114, lpme=0x19ccbc) returned 1 [0100.685] Module32Next (hSnapshot=0x114, lpme=0x19ccbc) returned 1 [0100.685] Module32Next (hSnapshot=0x114, lpme=0x19ccbc) returned 1 [0100.686] Module32Next (hSnapshot=0x114, lpme=0x19ccbc) returned 1 [0100.692] Module32Next (hSnapshot=0x114, lpme=0x19ccbc) returned 1 [0100.693] Module32Next (hSnapshot=0x114, lpme=0x19ccbc) returned 1 [0100.694] Module32Next (hSnapshot=0x114, lpme=0x19ccbc) returned 1 [0100.694] Module32Next (hSnapshot=0x114, lpme=0x19ccbc) returned 1 [0100.695] Module32Next (hSnapshot=0x114, lpme=0x19ccbc) returned 1 [0100.696] Module32Next (hSnapshot=0x114, lpme=0x19ccbc) returned 1 [0100.696] Module32Next (hSnapshot=0x114, lpme=0x19ccbc) returned 1 [0100.697] Module32Next (hSnapshot=0x114, lpme=0x19ccbc) returned 1 [0100.698] Module32Next (hSnapshot=0x114, lpme=0x19ccbc) returned 0 [0100.698] CloseHandle (hObject=0x114) returned 1 [0100.699] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0100.699] FindResourceA (hModule=0x400000, lpName="__", lpType=0xa) returned 0x4260d8 [0100.699] LoadResource (hModule=0x400000, hResInfo=0x4260d8) returned 0x426124 [0100.699] LockResource (hResData=0x426124) returned 0x426124 [0100.699] SizeofResource (hModule=0x400000, hResInfo=0x4260d8) returned 0x13d22 [0100.699] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x0, Size=0x13d22) returned 0x2150048 [0100.700] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x0, Size=0x40022) returned 0x2163d78 [0100.707] SizeofResource (hModule=0x400000, hResInfo=0x4260d8) returned 0x13d22 [0100.710] FreeResource (hResData=0x426124) returned 0 [0100.710] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x0, Size=0x2a40e) returned 0x21a3da8 [0100.711] SizeofResource (hModule=0x400000, hResInfo=0x4260d8) returned 0x13d22 [0100.713] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x0, Size=0x2530) returned 0x21ce1c0 [0100.734] HeapFree (in: hHeap=0x1f0000, dwFlags=0x0, lpMem=0x21ce1c0 | out: hHeap=0x1f0000) returned 1 [0100.735] LoadLibraryA (lpLibFileName="mscoree.dll") returned 0x6f780000 [0101.203] GetProcAddress (hModule=0x6f780000, lpProcName="CLRCreateInstance") returned 0x6f7ae840 [0101.587] lstrlenA (lpString="v4.0.30319") returned 10 [0101.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x21a3da8, cbMultiByte=11, lpWideCharStr=0x19cbbc, cchWideChar=11 | out: lpWideCharStr="v4.0.30319") returned 11 [0108.752] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x0, Size=0xc) returned 0x1f0fd0 [0108.752] RtlAllocateHeap (HeapHandle=0x1f0000, Flags=0x0, Size=0xc) returned 0x1f0fe8 [0108.761] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x80010106 [0108.763] RoInitialize () returned 0x1 [0108.764] RoUninitialize () returned 0x0 [0108.927] SafeArrayAccessData (in: psa=0x67dbc8, ppvData=0x19ca8c | out: ppvData=0x19ca8c) returned 0x0 [0108.927] SafeArrayUnaccessData (psa=0x67dbc8) returned 0x0 [0109.149] SafeArrayGetDim (psa=0x67dbc8) returned 0x1 [0109.149] SafeArrayGetDim (psa=0x67dbc8) returned 0x1 [0109.149] SafeArrayGetLBound (in: psa=0x67dbc8, nDim=0x1, plLbound=0x19c80c | out: plLbound=0x19c80c) returned 0x0 [0109.150] SafeArrayGetVartype (in: psa=0x67dbc8, pvt=0x19c77c | out: pvt=0x19c77c) returned 0x0 [0109.198] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2a400, lpName=0x0) returned 0x260 [0109.198] memcpy (in: _Dst=0x2350000, _Src=0x36854f0, _Size=0x2a400 | out: _Dst=0x2350000) returned 0x2350000 [0109.204] CloseHandle (hObject=0x260) returned 1 [0109.963] SysStringByteLen (bstr="_._") returned 0x6 [0110.035] SafeArrayCreateVector (vt=0xc, lLbound=0, cElements=0x0) returned 0x6d6b08 [0110.047] SysStringByteLen (bstr="___") returned 0x6 [0111.877] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x28c00, lpName=0x0) returned 0x294 [0111.877] memcpy (in: _Dst=0x25a0000, _Src=0x36b38f0, _Size=0x28c00 | out: _Dst=0x25a0000) returned 0x25a0000 [0111.880] CloseHandle (hObject=0x294) returned 1 [0112.173] EtwEventRegister (in: ProviderId=0x2687eb4, EnableCallback=0x4b149ce, CallbackContext=0x0, RegHandle=0x2687e90 | out: RegHandle=0x2687e90) returned 0x0 [0112.176] EtwEventSetInformation (RegHandle=0x6a5508, InformationClass=0x2b, EventInformation=0x2, InformationLength=0x2687e24) returned 0x0 [0113.107] CoTaskMemAlloc (cb=0x8) returned 0x6e0988 [0113.340] GetCurrentProcessId () returned 0x11b4 [0113.459] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x19a944 | out: lpLuid=0x19a944*(LowPart=0x14, HighPart=0)) returned 1 [0113.464] GetCurrentProcess () returned 0xffffffff [0113.464] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x19a940 | out: TokenHandle=0x19a940*=0x2ac) returned 1 [0113.471] AdjustTokenPrivileges (in: TokenHandle=0x2ac, DisableAllPrivileges=0, NewState=0x268a740*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0113.473] CloseHandle (hObject=0x2ac) returned 1 [0113.479] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11b4) returned 0x2ac [0113.565] EnumProcessModules (in: hProcess=0x2ac, lphModule=0x268a784, cb=0x100, lpcbNeeded=0x19b0b4 | out: lphModule=0x268a784, lpcbNeeded=0x19b0b4) returned 1 [0113.650] GetModuleInformation (in: hProcess=0x2ac, hModule=0x400000, lpmodinfo=0x268a8c4, cb=0xc | out: lpmodinfo=0x268a8c4*(lpBaseOfDll=0x400000, SizeOfImage=0x71000, EntryPoint=0x40b2b0)) returned 1 [0113.650] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0113.650] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x400000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe") returned 0x44 [0113.833] CoTaskMemFree (pv=0x6b7510) [0113.833] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0113.833] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x400000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe")) returned 0x62 [0113.834] CoTaskMemFree (pv=0x6b7510) [0113.837] CloseHandle (hObject=0x2ac) returned 1 [0113.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32.dll", cchWideChar=12, lpMultiByteStr=0x19b084, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32.dll÷\x99", lpUsedDefaultChar=0x0) returned 12 [0113.878] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76720000 [0113.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FindResourceA", cchWideChar=13, lpMultiByteStr=0x19b08c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FindResourceA\x9b", lpUsedDefaultChar=0x0) returned 13 [0113.893] GetProcAddress (hModule=0x76720000, lpProcName="FindResourceA") returned 0x7673cb90 [0113.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="__", cchWideChar=2, lpMultiByteStr=0x19b094, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="__", lpUsedDefaultChar=0x0) returned 2 [0113.912] FindResourceA (hModule=0x400000, lpName="__", lpType=0xa) returned 0x4260d8 [0113.924] GetCurrentProcessId () returned 0x11b4 [0114.166] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11b4) returned 0x2ac [0114.166] EnumProcessModules (in: hProcess=0x2ac, lphModule=0x268ceb8, cb=0x100, lpcbNeeded=0x19b0c0 | out: lphModule=0x268ceb8, lpcbNeeded=0x19b0c0) returned 1 [0114.168] GetModuleInformation (in: hProcess=0x2ac, hModule=0x400000, lpmodinfo=0x268cff8, cb=0xc | out: lpmodinfo=0x268cff8*(lpBaseOfDll=0x400000, SizeOfImage=0x71000, EntryPoint=0x40b2b0)) returned 1 [0114.168] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.168] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x400000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe") returned 0x44 [0114.169] CoTaskMemFree (pv=0x6b7510) [0114.169] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.169] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x400000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe")) returned 0x62 [0114.169] CoTaskMemFree (pv=0x6b7510) [0114.169] GetModuleInformation (in: hProcess=0x2ac, hModule=0x771d0000, lpmodinfo=0x268f21c, cb=0xc | out: lpmodinfo=0x268f21c*(lpBaseOfDll=0x771d0000, SizeOfImage=0x17b000, EntryPoint=0x0)) returned 1 [0114.169] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.169] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x771d0000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0114.170] CoTaskMemFree (pv=0x6b7510) [0114.170] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.170] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x771d0000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0114.170] CoTaskMemFree (pv=0x6b7510) [0114.170] GetModuleInformation (in: hProcess=0x2ac, hModule=0x76720000, lpmodinfo=0x2691320, cb=0xc | out: lpmodinfo=0x2691320*(lpBaseOfDll=0x76720000, SizeOfImage=0xe0000, EntryPoint=0x76733980)) returned 1 [0114.170] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.170] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x76720000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="KERNEL32.DLL") returned 0xc [0114.171] CoTaskMemFree (pv=0x6b7510) [0114.171] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.171] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x76720000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\KERNEL32.DLL" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0114.172] CoTaskMemFree (pv=0x6b7510) [0114.172] GetModuleInformation (in: hProcess=0x2ac, hModule=0x76910000, lpmodinfo=0x2693434, cb=0xc | out: lpmodinfo=0x2693434*(lpBaseOfDll=0x76910000, SizeOfImage=0x17e000, EntryPoint=0x769c1b90)) returned 1 [0114.172] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.172] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x76910000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0114.172] CoTaskMemFree (pv=0x6b7510) [0114.172] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.172] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x76910000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0114.173] CoTaskMemFree (pv=0x6b7510) [0114.173] GetModuleInformation (in: hProcess=0x2ac, hModule=0x73e50000, lpmodinfo=0x2695550, cb=0xc | out: lpmodinfo=0x2695550*(lpBaseOfDll=0x73e50000, SizeOfImage=0x92000, EntryPoint=0x73e90380)) returned 1 [0114.173] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.173] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x73e50000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="apphelp.dll") returned 0xb [0114.173] CoTaskMemFree (pv=0x6b7510) [0114.173] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.173] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x73e50000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll")) returned 0x1f [0114.174] CoTaskMemFree (pv=0x6b7510) [0114.174] GetModuleInformation (in: hProcess=0x2ac, hModule=0x743d0000, lpmodinfo=0x2697688, cb=0xc | out: lpmodinfo=0x2697688*(lpBaseOfDll=0x743d0000, SizeOfImage=0x147000, EntryPoint=0x743e1cf0)) returned 1 [0114.174] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.174] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x743d0000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0114.175] CoTaskMemFree (pv=0x6b7510) [0114.175] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.175] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x743d0000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0114.175] CoTaskMemFree (pv=0x6b7510) [0114.175] GetModuleInformation (in: hProcess=0x2ac, hModule=0x74ab0000, lpmodinfo=0x2699794, cb=0xc | out: lpmodinfo=0x2699794*(lpBaseOfDll=0x74ab0000, SizeOfImage=0x14f000, EntryPoint=0x74b66820)) returned 1 [0114.175] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.175] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x74ab0000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0114.176] CoTaskMemFree (pv=0x6b7510) [0114.176] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.176] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x74ab0000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0114.176] CoTaskMemFree (pv=0x6b7510) [0114.176] GetModuleInformation (in: hProcess=0x2ac, hModule=0x76600000, lpmodinfo=0x269b898, cb=0xc | out: lpmodinfo=0x269b898*(lpBaseOfDll=0x76600000, SizeOfImage=0x7b000, EntryPoint=0x7661e970)) returned 1 [0114.177] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.177] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x76600000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0114.177] CoTaskMemFree (pv=0x6b7510) [0114.177] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.177] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x76600000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0114.178] CoTaskMemFree (pv=0x6b7510) [0114.178] GetModuleInformation (in: hProcess=0x2ac, hModule=0x76a90000, lpmodinfo=0x269d9ac, cb=0xc | out: lpmodinfo=0x269d9ac*(lpBaseOfDll=0x76a90000, SizeOfImage=0xbe000, EntryPoint=0x76ac5630)) returned 1 [0114.178] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.178] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x76a90000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0114.178] CoTaskMemFree (pv=0x6b7510) [0114.178] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.179] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x76a90000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0114.179] CoTaskMemFree (pv=0x6b7510) [0114.179] GetModuleInformation (in: hProcess=0x2ac, hModule=0x76cb0000, lpmodinfo=0x269fb04, cb=0xc | out: lpmodinfo=0x269fb04*(lpBaseOfDll=0x76cb0000, SizeOfImage=0x44000, EntryPoint=0x76cc9d80)) returned 1 [0114.179] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.179] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x76cb0000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0114.180] CoTaskMemFree (pv=0x6b7510) [0114.180] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.180] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x76cb0000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0114.180] CoTaskMemFree (pv=0x6b7510) [0114.180] GetModuleInformation (in: hProcess=0x2ac, hModule=0x76c00000, lpmodinfo=0x26a1c10, cb=0xc | out: lpmodinfo=0x26a1c10*(lpBaseOfDll=0x76c00000, SizeOfImage=0xad000, EntryPoint=0x76c14f00)) returned 1 [0114.181] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.181] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x76c00000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0114.182] CoTaskMemFree (pv=0x6b7510) [0114.182] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.182] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x76c00000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0114.182] CoTaskMemFree (pv=0x6b7510) [0114.182] GetModuleInformation (in: hProcess=0x2ac, hModule=0x73f00000, lpmodinfo=0x26a3d1c, cb=0xc | out: lpmodinfo=0x26a3d1c*(lpBaseOfDll=0x73f00000, SizeOfImage=0x1e000, EntryPoint=0x73f0b640)) returned 1 [0114.183] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.183] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x73f00000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0114.183] CoTaskMemFree (pv=0x6b7510) [0114.183] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.183] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x73f00000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0114.184] CoTaskMemFree (pv=0x6b7510) [0114.184] GetModuleInformation (in: hProcess=0x2ac, hModule=0x73ef0000, lpmodinfo=0x26a5e28, cb=0xc | out: lpmodinfo=0x26a5e28*(lpBaseOfDll=0x73ef0000, SizeOfImage=0xa000, EntryPoint=0x73ef2a00)) returned 1 [0114.184] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.184] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x73ef0000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0114.185] CoTaskMemFree (pv=0x6b7510) [0114.185] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.185] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x73ef0000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0114.185] CoTaskMemFree (pv=0x6b7510) [0114.185] GetModuleInformation (in: hProcess=0x2ac, hModule=0x76840000, lpmodinfo=0x26a7f3c, cb=0xc | out: lpmodinfo=0x26a7f3c*(lpBaseOfDll=0x76840000, SizeOfImage=0x58000, EntryPoint=0x768825c0)) returned 1 [0114.186] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.186] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x76840000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="bcryptPrimitives.dll") returned 0x14 [0114.186] CoTaskMemFree (pv=0x6b7510) [0114.186] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.186] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x76840000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\bcryptPrimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")) returned 0x28 [0114.187] CoTaskMemFree (pv=0x6b7510) [0114.187] GetModuleInformation (in: hProcess=0x2ac, hModule=0x741b0000, lpmodinfo=0x26aa070, cb=0xc | out: lpmodinfo=0x26aa070*(lpBaseOfDll=0x741b0000, SizeOfImage=0x2b000, EntryPoint=0x741b5680)) returned 1 [0114.188] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.188] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x741b0000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0114.188] CoTaskMemFree (pv=0x6b7510) [0114.188] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.188] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x741b0000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\IMM32.DLL" (normalized: "c:\\windows\\syswow64\\imm32.dll")) returned 0x1d [0114.189] CoTaskMemFree (pv=0x6b7510) [0114.189] GetModuleInformation (in: hProcess=0x2ac, hModule=0x6f8a0000, lpmodinfo=0x26ac174, cb=0xc | out: lpmodinfo=0x26ac174*(lpBaseOfDll=0x6f8a0000, SizeOfImage=0x6000, EntryPoint=0x6f8a1490)) returned 1 [0114.189] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.189] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x6f8a0000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="msimg32.dll") returned 0xb [0114.190] CoTaskMemFree (pv=0x6b7510) [0114.190] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.190] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x6f8a0000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\msimg32.dll" (normalized: "c:\\windows\\syswow64\\msimg32.dll")) returned 0x1f [0114.191] CoTaskMemFree (pv=0x6b7510) [0114.191] GetModuleInformation (in: hProcess=0x2ac, hModule=0x74dc0000, lpmodinfo=0x26ae280, cb=0xc | out: lpmodinfo=0x26ae280*(lpBaseOfDll=0x74dc0000, SizeOfImage=0xeb000, EntryPoint=0x74dfd650)) returned 1 [0114.191] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.191] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x74dc0000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0114.192] CoTaskMemFree (pv=0x6b7510) [0114.192] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.192] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x74dc0000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0114.193] CoTaskMemFree (pv=0x6b7510) [0114.193] GetModuleInformation (in: hProcess=0x2ac, hModule=0x762b0000, lpmodinfo=0x26b0410, cb=0xc | out: lpmodinfo=0x26b0410*(lpBaseOfDll=0x762b0000, SizeOfImage=0x1bd000, EntryPoint=0x76392a10)) returned 1 [0114.194] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.194] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x762b0000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="combase.dll") returned 0xb [0114.194] CoTaskMemFree (pv=0x6b7510) [0114.194] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.194] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x762b0000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")) returned 0x1f [0114.196] CoTaskMemFree (pv=0x6b7510) [0114.196] GetModuleInformation (in: hProcess=0x2ac, hModule=0x76680000, lpmodinfo=0x26b251c, cb=0xc | out: lpmodinfo=0x26b251c*(lpBaseOfDll=0x76680000, SizeOfImage=0x92000, EntryPoint=0x766b8cf0)) returned 1 [0114.196] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.196] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x76680000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0114.197] CoTaskMemFree (pv=0x6b7510) [0114.197] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.197] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x76680000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0114.198] CoTaskMemFree (pv=0x6b7510) [0114.198] GetModuleInformation (in: hProcess=0x2ac, hModule=0x6f7e0000, lpmodinfo=0x26b4630, cb=0xc | out: lpmodinfo=0x26b4630*(lpBaseOfDll=0x6f7e0000, SizeOfImage=0xbf000, EntryPoint=0x6f7f1dfc)) returned 1 [0114.201] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.202] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x6f7e0000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="msvcr100.dll") returned 0xc [0114.202] CoTaskMemFree (pv=0x6b7510) [0114.202] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.202] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x6f7e0000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\msvcr100.dll" (normalized: "c:\\windows\\syswow64\\msvcr100.dll")) returned 0x20 [0114.203] CoTaskMemFree (pv=0x6b7510) [0114.203] GetModuleInformation (in: hProcess=0x2ac, hModule=0x76d50000, lpmodinfo=0x26b6744, cb=0xc | out: lpmodinfo=0x26b6744*(lpBaseOfDll=0x76d50000, SizeOfImage=0xc000, EntryPoint=0x76d53930)) returned 1 [0114.203] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.204] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x76d50000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="kernel.appcore.dll") returned 0x12 [0114.204] CoTaskMemFree (pv=0x6b7510) [0114.204] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.204] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x76d50000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")) returned 0x26 [0114.205] CoTaskMemFree (pv=0x6b7510) [0114.205] GetModuleInformation (in: hProcess=0x2ac, hModule=0x72cb0000, lpmodinfo=0x26b8870, cb=0xc | out: lpmodinfo=0x26b8870*(lpBaseOfDll=0x72cb0000, SizeOfImage=0x75000, EntryPoint=0x72ce9a60)) returned 1 [0114.206] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.206] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x72cb0000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0114.206] CoTaskMemFree (pv=0x6b7510) [0114.206] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.206] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x72cb0000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")) returned 0x1f [0114.207] CoTaskMemFree (pv=0x6b7510) [0114.207] GetModuleInformation (in: hProcess=0x2ac, hModule=0x6f780000, lpmodinfo=0x26ba97c, cb=0xc | out: lpmodinfo=0x26ba97c*(lpBaseOfDll=0x6f780000, SizeOfImage=0x59000, EntryPoint=0x6f790780)) returned 1 [0114.208] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.208] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x6f780000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="mscoree.dll") returned 0xb [0114.208] CoTaskMemFree (pv=0x6b7510) [0114.209] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.209] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x6f780000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll")) returned 0x1f [0114.209] CoTaskMemFree (pv=0x6b7510) [0114.209] GetModuleInformation (in: hProcess=0x2ac, hModule=0x6f700000, lpmodinfo=0x26bca88, cb=0xc | out: lpmodinfo=0x26bca88*(lpBaseOfDll=0x6f700000, SizeOfImage=0x7d000, EntryPoint=0x6f710db0)) returned 1 [0114.210] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.210] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x6f700000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0114.211] CoTaskMemFree (pv=0x6b7510) [0114.211] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.211] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x6f700000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0114.211] CoTaskMemFree (pv=0x6b7510) [0114.211] GetModuleInformation (in: hProcess=0x2ac, hModule=0x6f010000, lpmodinfo=0x26bebd0, cb=0xc | out: lpmodinfo=0x26bebd0*(lpBaseOfDll=0x6f010000, SizeOfImage=0x6e1000, EntryPoint=0x6f03cd70)) returned 1 [0114.212] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.212] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x6f010000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0114.213] CoTaskMemFree (pv=0x6b7510) [0114.213] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.213] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x6f010000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0114.214] CoTaskMemFree (pv=0x6b7510) [0114.214] GetModuleInformation (in: hProcess=0x2ac, hModule=0x76d00000, lpmodinfo=0x26c0d00, cb=0xc | out: lpmodinfo=0x26c0d00*(lpBaseOfDll=0x76d00000, SizeOfImage=0x45000, EntryPoint=0x76d1de90)) returned 1 [0114.215] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.215] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x76d00000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0114.215] CoTaskMemFree (pv=0x6b7510) [0114.216] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.216] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x76d00000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0114.217] CoTaskMemFree (pv=0x6b7510) [0114.217] GetModuleInformation (in: hProcess=0x2ac, hModule=0x6ef10000, lpmodinfo=0x26c2e0c, cb=0xc | out: lpmodinfo=0x26c2e0c*(lpBaseOfDll=0x6ef10000, SizeOfImage=0xf5000, EntryPoint=0x6ef64160)) returned 1 [0114.218] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.218] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x6ef10000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0114.218] CoTaskMemFree (pv=0x6b7510) [0114.218] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.218] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x6ef10000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll")) returned 0x28 [0114.219] CoTaskMemFree (pv=0x6b7510) [0114.219] GetModuleInformation (in: hProcess=0x2ac, hModule=0x6dc50000, lpmodinfo=0x26c4f40, cb=0xc | out: lpmodinfo=0x26c4f40*(lpBaseOfDll=0x6dc50000, SizeOfImage=0x12b2000, EntryPoint=0x0)) returned 1 [0114.220] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.220] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x6dc50000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0114.221] CoTaskMemFree (pv=0x6b7510) [0114.221] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.221] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x6dc50000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\7582400666d289c016013ad0f6e0e3e6\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\7582400666d289c016013ad0f6e0e3e6\\mscorlib.ni.dll")) returned 0x68 [0114.222] CoTaskMemFree (pv=0x6b7510) [0114.222] GetModuleInformation (in: hProcess=0x2ac, hModule=0x70ac0000, lpmodinfo=0x26c70e8, cb=0xc | out: lpmodinfo=0x26c70e8*(lpBaseOfDll=0x70ac0000, SizeOfImage=0x13000, EntryPoint=0x70ac9950)) returned 1 [0114.222] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.222] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x70ac0000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0114.223] CoTaskMemFree (pv=0x6b7510) [0114.223] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.223] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x70ac0000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\CRYPTSP.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")) returned 0x1f [0114.224] CoTaskMemFree (pv=0x6b7510) [0114.224] GetModuleInformation (in: hProcess=0x2ac, hModule=0x70230000, lpmodinfo=0x26c91f4, cb=0xc | out: lpmodinfo=0x26c91f4*(lpBaseOfDll=0x70230000, SizeOfImage=0x2f000, EntryPoint=0x702495e0)) returned 1 [0114.225] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.225] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x70230000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0114.226] CoTaskMemFree (pv=0x6b7510) [0114.226] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.226] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x70230000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")) returned 0x1e [0114.227] CoTaskMemFree (pv=0x6b7510) [0114.227] GetModuleInformation (in: hProcess=0x2ac, hModule=0x71560000, lpmodinfo=0x26cb300, cb=0xc | out: lpmodinfo=0x26cb300*(lpBaseOfDll=0x71560000, SizeOfImage=0x1b000, EntryPoint=0x71569050)) returned 1 [0114.228] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.228] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x71560000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="bcrypt.dll") returned 0xa [0114.229] CoTaskMemFree (pv=0x6b7510) [0114.229] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.229] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x71560000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")) returned 0x1e [0114.230] CoTaskMemFree (pv=0x6b7510) [0114.230] GetModuleInformation (in: hProcess=0x2ac, hModule=0x6dbd0000, lpmodinfo=0x26cd40c, cb=0xc | out: lpmodinfo=0x26cd40c*(lpBaseOfDll=0x6dbd0000, SizeOfImage=0x80000, EntryPoint=0x6dbd1180)) returned 1 [0114.230] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.230] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x6dbd0000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0114.231] CoTaskMemFree (pv=0x6b7510) [0114.232] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.232] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x6dbd0000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0114.232] CoTaskMemFree (pv=0x6b7510) [0114.232] GetModuleInformation (in: hProcess=0x2ac, hModule=0x6d200000, lpmodinfo=0x26cf54c, cb=0xc | out: lpmodinfo=0x26cf54c*(lpBaseOfDll=0x6d200000, SizeOfImage=0x9cc000, EntryPoint=0x0)) returned 1 [0114.233] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.233] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x6d200000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0114.234] CoTaskMemFree (pv=0x6b7510) [0114.234] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.234] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x6d200000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\1be7a15b1f33bf22e4f53aaf45518c77\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\1be7a15b1f33bf22e4f53aaf45518c77\\system.ni.dll")) returned 0x64 [0114.235] CoTaskMemFree (pv=0x6b7510) [0114.235] GetModuleInformation (in: hProcess=0x2ac, hModule=0x6d070000, lpmodinfo=0x26d17f4, cb=0xc | out: lpmodinfo=0x26d17f4*(lpBaseOfDll=0x6d070000, SizeOfImage=0x18f000, EntryPoint=0x0)) returned 1 [0114.237] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.237] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x6d070000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0114.238] CoTaskMemFree (pv=0x6b7510) [0114.238] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.238] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x6d070000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\1d52bd4ac5e0a6422058a5d62c9f6d9d\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\1d52bd4ac5e0a6422058a5d62c9f6d9d\\system.drawing.ni.dll")) returned 0x74 [0114.239] CoTaskMemFree (pv=0x6b7510) [0114.239] GetModuleInformation (in: hProcess=0x2ac, hModule=0x6c400000, lpmodinfo=0x26d39c0, cb=0xc | out: lpmodinfo=0x26d39c0*(lpBaseOfDll=0x6c400000, SizeOfImage=0xc67000, EntryPoint=0x0)) returned 1 [0114.240] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.240] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x6c400000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0114.241] CoTaskMemFree (pv=0x6b7510) [0114.241] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.241] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x6c400000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\fb06ad4bc55b9c3ca68a3f9259d826cd\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\fb06ad4bc55b9c3ca68a3f9259d826cd\\system.windows.forms.ni.dll")) returned 0x80 [0114.242] CoTaskMemFree (pv=0x6b7510) [0114.242] GetModuleInformation (in: hProcess=0x2ac, hModule=0x764d0000, lpmodinfo=0x26d5bb0, cb=0xc | out: lpmodinfo=0x26d5bb0*(lpBaseOfDll=0x764d0000, SizeOfImage=0x6000, EntryPoint=0x764d1460)) returned 1 [0114.243] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.243] GetModuleBaseNameW (in: hProcess=0x2ac, hModule=0x764d0000, lpBaseName=0x6b7510, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0114.244] CoTaskMemFree (pv=0x6b7510) [0114.244] CoTaskMemAlloc (cb=0x804) returned 0x6b7510 [0114.244] GetModuleFileNameExW (in: hProcess=0x2ac, hModule=0x764d0000, lpFilename=0x6b7510, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0114.245] CoTaskMemFree (pv=0x6b7510) [0114.245] CloseHandle (hObject=0x2ac) returned 1 [0114.277] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x199ae8 | out: phkResult=0x199ae8*=0x0) returned 0x2 [0114.286] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll", nBufferLength=0x105, lpBuffer=0x19ab64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll", lpFilePart=0x0) returned 0x38 [0114.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19b00c) returned 1 [0114.287] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll"), fInfoLevelId=0x0, lpFileInformation=0x19b088 | out: lpFileInformation=0x19b088*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dc2605d, ftCreationTime.dwHighDateTime=0x1d8a73a, ftLastAccessTime.dwLowDateTime=0x8dc2605d, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0x8dc2d672, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x7f4a0)) returned 1 [0114.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19b008) returned 1 [0114.479] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll", lpdwHandle=0x19b0fc | out: lpdwHandle=0x19b0fc) returned 0x804 [0114.480] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll", dwHandle=0x0, dwLen=0x804, lpData=0x26d968c | out: lpData=0x26d968c) returned 1 [0114.481] VerQueryValueW (in: pBlock=0x26d968c, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19b0d0, puLen=0x19b0cc | out: lplpBuffer=0x19b0d0*=0x26d9a88, puLen=0x19b0cc) returned 1 [0114.484] VerQueryValueW (in: pBlock=0x26d968c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x19b050, puLen=0x19b04c | out: lplpBuffer=0x19b050*=0x26d9744, puLen=0x19b04c) returned 1 [0114.484] VerQueryValueW (in: pBlock=0x26d968c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x19b050, puLen=0x19b04c | out: lplpBuffer=0x19b050*=0x26d9798, puLen=0x19b04c) returned 1 [0114.484] VerQueryValueW (in: pBlock=0x26d968c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x19b050, puLen=0x19b04c | out: lplpBuffer=0x19b050*=0x26d9814, puLen=0x19b04c) returned 1 [0114.484] VerQueryValueW (in: pBlock=0x26d968c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x19b050, puLen=0x19b04c | out: lplpBuffer=0x19b050*=0x26d9874, puLen=0x19b04c) returned 1 [0114.484] VerQueryValueW (in: pBlock=0x26d968c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x19b050, puLen=0x19b04c | out: lplpBuffer=0x19b050*=0x26d98b0, puLen=0x19b04c) returned 1 [0114.484] VerQueryValueW (in: pBlock=0x26d968c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x19b050, puLen=0x19b04c | out: lplpBuffer=0x19b050*=0x26d9938, puLen=0x19b04c) returned 1 [0114.484] VerQueryValueW (in: pBlock=0x26d968c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x19b050, puLen=0x19b04c | out: lplpBuffer=0x19b050*=0x26d9970, puLen=0x19b04c) returned 1 [0114.484] VerQueryValueW (in: pBlock=0x26d968c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x19b050, puLen=0x19b04c | out: lplpBuffer=0x19b050*=0x26d99c8, puLen=0x19b04c) returned 1 [0114.484] VerQueryValueW (in: pBlock=0x26d968c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x19b050, puLen=0x19b04c | out: lplpBuffer=0x19b050*=0x26d99f8, puLen=0x19b04c) returned 1 [0114.485] VerQueryValueW (in: pBlock=0x26d968c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x19b050, puLen=0x19b04c | out: lplpBuffer=0x19b050*=0x0, puLen=0x19b04c) returned 0 [0114.485] VerQueryValueW (in: pBlock=0x26d968c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x19b050, puLen=0x19b04c | out: lplpBuffer=0x19b050*=0x26d9a34, puLen=0x19b04c) returned 1 [0114.485] VerQueryValueW (in: pBlock=0x26d968c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x19b050, puLen=0x19b04c | out: lplpBuffer=0x19b050*=0x0, puLen=0x19b04c) returned 0 [0114.485] VerQueryValueW (in: pBlock=0x26d968c, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19b044, puLen=0x19b040 | out: lplpBuffer=0x19b044*=0x26d9a88, puLen=0x19b040) returned 1 [0114.485] VerLanguageNameW (in: wLang=0x409, szLang=0x19add4, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0115.047] VerQueryValueW (in: pBlock=0x26d968c, lpSubBlock="\\", lplpBuffer=0x19b054, puLen=0x19b050 | out: lplpBuffer=0x19b054*=0x26d96b4, puLen=0x19b050) returned 1 [0115.706] GetCurrentProcessId () returned 0x11b4 [0115.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OpenProcess", cchWideChar=11, lpMultiByteStr=0x19b08c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OpenProcessoU\x9b", lpUsedDefaultChar=0x0) returned 11 [0115.712] GetProcAddress (hModule=0x76720000, lpProcName="OpenProcess") returned 0x76738bf0 [0115.723] OpenProcess (dwDesiredAccess=0x38, bInheritHandle=1, dwProcessId=0x11b4) returned 0x2ac [0115.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualProtect", cchWideChar=14, lpMultiByteStr=0x19b094, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VirtualProtect", lpUsedDefaultChar=0x0) returned 14 [0115.731] GetProcAddress (hModule=0x76720000, lpProcName="VirtualProtect") returned 0x76737a50 [0115.744] VirtualProtect (in: lpAddress=0x25a0258, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.745] VirtualProtect (in: lpAddress=0x25a0258, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.746] VirtualProtect (in: lpAddress=0x25a0718, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.746] VirtualProtect (in: lpAddress=0x25a0718, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.746] VirtualProtect (in: lpAddress=0x25a0918, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.746] VirtualProtect (in: lpAddress=0x25a0918, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.747] VirtualProtect (in: lpAddress=0x25a0bc0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.747] VirtualProtect (in: lpAddress=0x25a0bc0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.747] VirtualProtect (in: lpAddress=0x25a0d80, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.747] VirtualProtect (in: lpAddress=0x25a0d80, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.748] VirtualProtect (in: lpAddress=0x25a0f00, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.748] VirtualProtect (in: lpAddress=0x25a0f00, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.748] VirtualProtect (in: lpAddress=0x25a0f78, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.749] VirtualProtect (in: lpAddress=0x25a0f78, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.749] VirtualProtect (in: lpAddress=0x25a110c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.750] VirtualProtect (in: lpAddress=0x25a110c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.750] VirtualProtect (in: lpAddress=0x25a1150, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.750] VirtualProtect (in: lpAddress=0x25a1150, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.750] VirtualProtect (in: lpAddress=0x25a11f8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.751] VirtualProtect (in: lpAddress=0x25a11f8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.751] VirtualProtect (in: lpAddress=0x25a12d0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.751] VirtualProtect (in: lpAddress=0x25a12d0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.752] VirtualProtect (in: lpAddress=0x25a14a4, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.752] VirtualProtect (in: lpAddress=0x25a14a4, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.752] VirtualProtect (in: lpAddress=0x25a14bc, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.752] VirtualProtect (in: lpAddress=0x25a14bc, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.753] VirtualProtect (in: lpAddress=0x25a1694, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.753] VirtualProtect (in: lpAddress=0x25a1694, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.753] VirtualProtect (in: lpAddress=0x25a1810, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.753] VirtualProtect (in: lpAddress=0x25a1810, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.753] VirtualProtect (in: lpAddress=0x25a18ac, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.754] VirtualProtect (in: lpAddress=0x25a18ac, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.754] VirtualProtect (in: lpAddress=0x25a1950, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.754] VirtualProtect (in: lpAddress=0x25a1950, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.754] VirtualProtect (in: lpAddress=0x25a1b94, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.755] VirtualProtect (in: lpAddress=0x25a1b94, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.755] VirtualProtect (in: lpAddress=0x25a1bac, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.755] VirtualProtect (in: lpAddress=0x25a1bac, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.755] VirtualProtect (in: lpAddress=0x25a1be4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.756] VirtualProtect (in: lpAddress=0x25a1be4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.756] VirtualProtect (in: lpAddress=0x25a1c20, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.756] VirtualProtect (in: lpAddress=0x25a1c20, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.757] VirtualProtect (in: lpAddress=0x25a1c68, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.757] VirtualProtect (in: lpAddress=0x25a1c68, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.757] VirtualProtect (in: lpAddress=0x25a1d24, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.757] VirtualProtect (in: lpAddress=0x25a1d24, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.758] VirtualProtect (in: lpAddress=0x25a1d70, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.758] VirtualProtect (in: lpAddress=0x25a1d70, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.758] VirtualProtect (in: lpAddress=0x25a270c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.758] VirtualProtect (in: lpAddress=0x25a270c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.759] VirtualProtect (in: lpAddress=0x25a28e0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.759] VirtualProtect (in: lpAddress=0x25a28e0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.759] VirtualProtect (in: lpAddress=0x25a2b64, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.759] VirtualProtect (in: lpAddress=0x25a2b64, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.760] VirtualProtect (in: lpAddress=0x25a2f6c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.760] VirtualProtect (in: lpAddress=0x25a2f6c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.760] VirtualProtect (in: lpAddress=0x25a3134, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.760] VirtualProtect (in: lpAddress=0x25a3134, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.761] VirtualProtect (in: lpAddress=0x25a3184, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.761] VirtualProtect (in: lpAddress=0x25a3184, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.761] VirtualProtect (in: lpAddress=0x25a33a8, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.762] VirtualProtect (in: lpAddress=0x25a33a8, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.762] VirtualProtect (in: lpAddress=0x25a33c0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.762] VirtualProtect (in: lpAddress=0x25a33c0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.762] VirtualProtect (in: lpAddress=0x25a3430, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.763] VirtualProtect (in: lpAddress=0x25a3430, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.763] VirtualProtect (in: lpAddress=0x25a3438, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.763] VirtualProtect (in: lpAddress=0x25a3438, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.763] VirtualProtect (in: lpAddress=0x25a3774, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.763] VirtualProtect (in: lpAddress=0x25a3774, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.764] VirtualProtect (in: lpAddress=0x25a378c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.764] VirtualProtect (in: lpAddress=0x25a378c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.764] VirtualProtect (in: lpAddress=0x25a3874, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.764] VirtualProtect (in: lpAddress=0x25a3874, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.765] VirtualProtect (in: lpAddress=0x25a3b8c, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.765] VirtualProtect (in: lpAddress=0x25a3b8c, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.765] VirtualProtect (in: lpAddress=0x25a3ba4, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.765] VirtualProtect (in: lpAddress=0x25a3ba4, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.766] VirtualProtect (in: lpAddress=0x25a3bac, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.766] VirtualProtect (in: lpAddress=0x25a3bac, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.766] VirtualProtect (in: lpAddress=0x25a3c68, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.766] VirtualProtect (in: lpAddress=0x25a3c68, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.766] VirtualProtect (in: lpAddress=0x25a3c74, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.767] VirtualProtect (in: lpAddress=0x25a3c74, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.767] VirtualProtect (in: lpAddress=0x25a3c8c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.767] VirtualProtect (in: lpAddress=0x25a3c8c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.767] VirtualProtect (in: lpAddress=0x25a3d00, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.767] VirtualProtect (in: lpAddress=0x25a3d00, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.768] VirtualProtect (in: lpAddress=0x25a3e44, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.768] VirtualProtect (in: lpAddress=0x25a3e44, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.768] VirtualProtect (in: lpAddress=0x25a3e5c, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.768] VirtualProtect (in: lpAddress=0x25a3e5c, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.768] VirtualProtect (in: lpAddress=0x25a3e64, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.769] VirtualProtect (in: lpAddress=0x25a3e64, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.769] VirtualProtect (in: lpAddress=0x25a3f2c, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.769] VirtualProtect (in: lpAddress=0x25a3f2c, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.769] VirtualProtect (in: lpAddress=0x25a3f44, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.770] VirtualProtect (in: lpAddress=0x25a3f44, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.770] VirtualProtect (in: lpAddress=0x25a3f4c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.770] VirtualProtect (in: lpAddress=0x25a3f4c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.770] VirtualProtect (in: lpAddress=0x25a3ff0, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.770] VirtualProtect (in: lpAddress=0x25a3ff0, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.771] VirtualProtect (in: lpAddress=0x25a4010, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.771] VirtualProtect (in: lpAddress=0x25a4010, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.771] VirtualProtect (in: lpAddress=0x25a4018, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.771] VirtualProtect (in: lpAddress=0x25a4018, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.771] VirtualProtect (in: lpAddress=0x25a4020, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.772] VirtualProtect (in: lpAddress=0x25a4020, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.772] VirtualProtect (in: lpAddress=0x25a4028, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.772] VirtualProtect (in: lpAddress=0x25a4028, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.772] VirtualProtect (in: lpAddress=0x25a4200, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.772] VirtualProtect (in: lpAddress=0x25a4200, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.773] VirtualProtect (in: lpAddress=0x25a420c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.773] VirtualProtect (in: lpAddress=0x25a420c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.773] VirtualProtect (in: lpAddress=0x25a43e0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.773] VirtualProtect (in: lpAddress=0x25a43e0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.773] VirtualProtect (in: lpAddress=0x25a4470, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.774] VirtualProtect (in: lpAddress=0x25a4470, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.774] VirtualProtect (in: lpAddress=0x25a44f8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.774] VirtualProtect (in: lpAddress=0x25a44f8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.774] VirtualProtect (in: lpAddress=0x25a4528, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.774] VirtualProtect (in: lpAddress=0x25a4528, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.775] VirtualProtect (in: lpAddress=0x25a453c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.775] VirtualProtect (in: lpAddress=0x25a453c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.775] VirtualProtect (in: lpAddress=0x25a4560, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.775] VirtualProtect (in: lpAddress=0x25a4560, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.776] VirtualProtect (in: lpAddress=0x25a4608, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.776] VirtualProtect (in: lpAddress=0x25a4608, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.776] VirtualProtect (in: lpAddress=0x25a461c, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.776] VirtualProtect (in: lpAddress=0x25a461c, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.777] VirtualProtect (in: lpAddress=0x25a462c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.777] VirtualProtect (in: lpAddress=0x25a462c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.777] VirtualProtect (in: lpAddress=0x25a4724, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.777] VirtualProtect (in: lpAddress=0x25a4724, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.778] VirtualProtect (in: lpAddress=0x25a4738, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.778] VirtualProtect (in: lpAddress=0x25a4738, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.778] VirtualProtect (in: lpAddress=0x25a474c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.778] VirtualProtect (in: lpAddress=0x25a474c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.779] VirtualProtect (in: lpAddress=0x25a4770, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.779] VirtualProtect (in: lpAddress=0x25a4770, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.779] VirtualProtect (in: lpAddress=0x25a4784, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.779] VirtualProtect (in: lpAddress=0x25a4784, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.779] VirtualProtect (in: lpAddress=0x25a4798, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.780] VirtualProtect (in: lpAddress=0x25a4798, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.791] VirtualProtect (in: lpAddress=0x25a47b0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.792] VirtualProtect (in: lpAddress=0x25a47b0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.792] VirtualProtect (in: lpAddress=0x25a47e8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.792] VirtualProtect (in: lpAddress=0x25a47e8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.792] VirtualProtect (in: lpAddress=0x25a4834, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.793] VirtualProtect (in: lpAddress=0x25a4834, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.793] VirtualProtect (in: lpAddress=0x25a4858, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.793] VirtualProtect (in: lpAddress=0x25a4858, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.793] VirtualProtect (in: lpAddress=0x25a4878, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.793] VirtualProtect (in: lpAddress=0x25a4878, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.794] VirtualProtect (in: lpAddress=0x25a4934, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.794] VirtualProtect (in: lpAddress=0x25a4934, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.794] VirtualProtect (in: lpAddress=0x25a4964, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.794] VirtualProtect (in: lpAddress=0x25a4964, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.795] VirtualProtect (in: lpAddress=0x25a4990, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.795] VirtualProtect (in: lpAddress=0x25a4990, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.795] VirtualProtect (in: lpAddress=0x25a49f4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.796] VirtualProtect (in: lpAddress=0x25a49f4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.796] VirtualProtect (in: lpAddress=0x25a4ac4, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.796] VirtualProtect (in: lpAddress=0x25a4ac4, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.796] VirtualProtect (in: lpAddress=0x25a4acc, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.797] VirtualProtect (in: lpAddress=0x25a4acc, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.797] VirtualProtect (in: lpAddress=0x25a4b30, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.797] VirtualProtect (in: lpAddress=0x25a4b30, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.798] VirtualProtect (in: lpAddress=0x25a4bc0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.798] VirtualProtect (in: lpAddress=0x25a4bc0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.798] VirtualProtect (in: lpAddress=0x25a5088, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.798] VirtualProtect (in: lpAddress=0x25a5088, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.799] VirtualProtect (in: lpAddress=0x25a5208, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.799] VirtualProtect (in: lpAddress=0x25a5208, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.799] VirtualProtect (in: lpAddress=0x25a56dc, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.799] VirtualProtect (in: lpAddress=0x25a56dc, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.800] VirtualProtect (in: lpAddress=0x25a5754, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.800] VirtualProtect (in: lpAddress=0x25a5754, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.800] VirtualProtect (in: lpAddress=0x25a57c0, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.800] VirtualProtect (in: lpAddress=0x25a57c0, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.800] VirtualProtect (in: lpAddress=0x25a57cc, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.801] VirtualProtect (in: lpAddress=0x25a57cc, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.801] VirtualProtect (in: lpAddress=0x25a585c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.801] VirtualProtect (in: lpAddress=0x25a585c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.801] VirtualProtect (in: lpAddress=0x25a59ac, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.801] VirtualProtect (in: lpAddress=0x25a59ac, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.801] VirtualProtect (in: lpAddress=0x25a59b8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.802] VirtualProtect (in: lpAddress=0x25a59b8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.802] VirtualProtect (in: lpAddress=0x25a59d8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.802] VirtualProtect (in: lpAddress=0x25a59d8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.802] VirtualProtect (in: lpAddress=0x25a5aa0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.803] VirtualProtect (in: lpAddress=0x25a5aa0, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.803] VirtualProtect (in: lpAddress=0x25a5b60, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.803] VirtualProtect (in: lpAddress=0x25a5b60, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.803] VirtualProtect (in: lpAddress=0x25a5b90, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.804] VirtualProtect (in: lpAddress=0x25a5b90, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.804] VirtualProtect (in: lpAddress=0x25a5bd4, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.804] VirtualProtect (in: lpAddress=0x25a5bd4, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.804] VirtualProtect (in: lpAddress=0x25a5bec, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.805] VirtualProtect (in: lpAddress=0x25a5bec, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.805] VirtualProtect (in: lpAddress=0x25a5c04, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.805] VirtualProtect (in: lpAddress=0x25a5c04, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.805] VirtualProtect (in: lpAddress=0x25a5c20, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.806] VirtualProtect (in: lpAddress=0x25a5c20, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.806] VirtualProtect (in: lpAddress=0x25a5d84, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.806] VirtualProtect (in: lpAddress=0x25a5d84, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.806] VirtualProtect (in: lpAddress=0x25a5e38, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.807] VirtualProtect (in: lpAddress=0x25a5e38, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.807] VirtualProtect (in: lpAddress=0x25a5e78, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.807] VirtualProtect (in: lpAddress=0x25a5e78, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.807] VirtualProtect (in: lpAddress=0x25a5ea8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.807] VirtualProtect (in: lpAddress=0x25a5ea8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.808] VirtualProtect (in: lpAddress=0x25a5ed8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.808] VirtualProtect (in: lpAddress=0x25a5ed8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.808] VirtualProtect (in: lpAddress=0x25a5f20, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.808] VirtualProtect (in: lpAddress=0x25a5f20, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.808] VirtualProtect (in: lpAddress=0x25a5f4c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.809] VirtualProtect (in: lpAddress=0x25a5f4c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.809] VirtualProtect (in: lpAddress=0x25a5f80, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.809] VirtualProtect (in: lpAddress=0x25a5f80, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.809] VirtualProtect (in: lpAddress=0x25a5fb4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.809] VirtualProtect (in: lpAddress=0x25a5fb4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.810] VirtualProtect (in: lpAddress=0x25a5ffc, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.810] VirtualProtect (in: lpAddress=0x25a5ffc, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.810] VirtualProtect (in: lpAddress=0x25a6048, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.810] VirtualProtect (in: lpAddress=0x25a6048, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.810] VirtualProtect (in: lpAddress=0x25a60f4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.811] VirtualProtect (in: lpAddress=0x25a60f4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.811] VirtualProtect (in: lpAddress=0x25a61e4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.811] VirtualProtect (in: lpAddress=0x25a61e4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.811] VirtualProtect (in: lpAddress=0x25a6224, dwSize=0x18, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.812] VirtualProtect (in: lpAddress=0x25a6224, dwSize=0x18, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.812] VirtualProtect (in: lpAddress=0x25a6278, dwSize=0x18, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.812] VirtualProtect (in: lpAddress=0x25a6278, dwSize=0x18, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.812] VirtualProtect (in: lpAddress=0x25a62f8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.812] VirtualProtect (in: lpAddress=0x25a62f8, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.813] VirtualProtect (in: lpAddress=0x25a6344, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.813] VirtualProtect (in: lpAddress=0x25a6344, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.813] VirtualProtect (in: lpAddress=0x25a63d4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.813] VirtualProtect (in: lpAddress=0x25a63d4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.813] VirtualProtect (in: lpAddress=0x25a640c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.814] VirtualProtect (in: lpAddress=0x25a640c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.814] VirtualProtect (in: lpAddress=0x25a6454, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.814] VirtualProtect (in: lpAddress=0x25a6454, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.814] VirtualProtect (in: lpAddress=0x25a648c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.814] VirtualProtect (in: lpAddress=0x25a648c, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.815] VirtualProtect (in: lpAddress=0x25a6570, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.815] VirtualProtect (in: lpAddress=0x25a6570, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.815] VirtualProtect (in: lpAddress=0x25a65cc, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x19b518 | out: lpflOldProtect=0x19b518*=0x4) returned 1 [0115.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=11, lpMultiByteStr=0x19b098, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandleoU\x9b", lpUsedDefaultChar=0x0) returned 11 [0115.835] GetProcAddress (hModule=0x76720000, lpProcName="CloseHandle") returned 0x76746630 [0115.845] CloseHandle (hObject=0x2ac) returned 1 [0121.090] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x6b22a0 [0121.117] ??2@YAPAXI@Z () returned 0x6bad58 [0121.122] SetProcessDPIAware () returned 1 [0121.126] GetEnvironmentVariableW (in: lpName="COMPLUS_Version", lpBuffer=0x1999a8, nSize=0x104 | out: lpBuffer="") returned 0x0 [0121.178] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Net Framework Setup\\NDP\\v4\\Client", ulOptions=0x0, samDesired=0x20019, phkResult=0x199984 | out: phkResult=0x199984*=0x2ac) returned 0x0 [0121.179] RegQueryValueExW (in: hKey=0x2ac, lpValueName="InstallPath", lpReserved=0x0, lpType=0x199980, lpData=0x199bdc, lpcbData=0x19997c*=0x208 | out: lpType=0x199980*=0x1, lpData="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpcbData=0x19997c*=0x5e) returned 0x0 [0121.179] RegCloseKey (hKey=0x2ac) returned 0x0 [0121.185] PathAppendW (in: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", pMore="WPF" | out: pszPath="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF") returned 1 [0121.186] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76720000 [0121.187] GetProcAddress (hModule=0x76720000, lpProcName="AddDllDirectory") returned 0x76a445e0 [0121.188] LoadLibraryExW (lpLibFileName="dwrite.dll", hFile=0x0, dwFlags=0x800) returned 0x70d10000 [0121.549] GetProcAddress (hModule=0x70d10000, lpProcName="DWriteCreateFactory") returned 0x70d8e750 [0121.551] PathCombineW (in: pszDest=0x1999b0, pszDir="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF", pszFile="wpfgfx_v0400.dll" | out: pszDest="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\wpfgfx_v0400.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\wpfgfx_v0400.dll" [0121.552] LoadLibraryW (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\wpfgfx_v0400.dll") returned 0x69960000 [0122.140] PathCombineW (in: pszDest=0x1999b0, pszDir="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF", pszFile="PresentationNative_v0400.dll" | out: pszDest="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\PresentationNative_v0400.dll") returned="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\PresentationNative_v0400.dll" [0122.140] LoadLibraryW (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\PresentationNative_v0400.dll") returned 0x69890000 [0125.534] CoTaskMemAlloc (cb=0x20c) returned 0x6b59f0 [0125.534] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6b59f0, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe")) returned 0x62 [0125.535] CoTaskMemFree (pv=0x6b59f0) [0125.535] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe", nBufferLength=0x105, lpBuffer=0x19b114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe", lpFilePart=0x0) returned 0x62 [0125.543] GetCurrentProcess () returned 0xffffffff [0125.543] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19b450 | out: TokenHandle=0x19b450*=0x2c8) returned 1 [0125.546] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x19aee8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0125.548] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19b448 | out: lpFileInformation=0x19b448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0125.549] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x19aeb4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0125.551] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19b450 | out: lpFileInformation=0x19b450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0125.552] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x19ae50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0125.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19b388) returned 1 [0125.553] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0125.553] GetFileType (hFile=0x2d0) returned 0x1 [0125.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19b384) returned 1 [0125.553] GetFileType (hFile=0x2d0) returned 0x1 [0125.570] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x19b444 | out: lpFileSizeHigh=0x19b444*=0x0) returned 0x8c8f [0125.571] ReadFile (in: hFile=0x2d0, lpBuffer=0x26f0704, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19b400, lpOverlapped=0x0 | out: lpBuffer=0x26f0704*, lpNumberOfBytesRead=0x19b400*=0x1000, lpOverlapped=0x0) returned 1 [0125.589] ReadFile (in: hFile=0x2d0, lpBuffer=0x26f0704, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19b2b0, lpOverlapped=0x0 | out: lpBuffer=0x26f0704*, lpNumberOfBytesRead=0x19b2b0*=0x1000, lpOverlapped=0x0) returned 1 [0125.590] ReadFile (in: hFile=0x2d0, lpBuffer=0x26f0704, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19b164, lpOverlapped=0x0 | out: lpBuffer=0x26f0704*, lpNumberOfBytesRead=0x19b164*=0x1000, lpOverlapped=0x0) returned 1 [0125.590] ReadFile (in: hFile=0x2d0, lpBuffer=0x26f0704, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19b164, lpOverlapped=0x0 | out: lpBuffer=0x26f0704*, lpNumberOfBytesRead=0x19b164*=0x1000, lpOverlapped=0x0) returned 1 [0125.591] ReadFile (in: hFile=0x2d0, lpBuffer=0x26f0704, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19b164, lpOverlapped=0x0 | out: lpBuffer=0x26f0704*, lpNumberOfBytesRead=0x19b164*=0x1000, lpOverlapped=0x0) returned 1 [0125.591] ReadFile (in: hFile=0x2d0, lpBuffer=0x26f0704, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19b09c, lpOverlapped=0x0 | out: lpBuffer=0x26f0704*, lpNumberOfBytesRead=0x19b09c*=0x1000, lpOverlapped=0x0) returned 1 [0125.595] ReadFile (in: hFile=0x2d0, lpBuffer=0x26f0704, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19b21c, lpOverlapped=0x0 | out: lpBuffer=0x26f0704*, lpNumberOfBytesRead=0x19b21c*=0x1000, lpOverlapped=0x0) returned 1 [0125.596] ReadFile (in: hFile=0x2d0, lpBuffer=0x26f0704, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19b12c, lpOverlapped=0x0 | out: lpBuffer=0x26f0704*, lpNumberOfBytesRead=0x19b12c*=0x1000, lpOverlapped=0x0) returned 1 [0125.596] ReadFile (in: hFile=0x2d0, lpBuffer=0x26f0704, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19b12c, lpOverlapped=0x0 | out: lpBuffer=0x26f0704*, lpNumberOfBytesRead=0x19b12c*=0xc8f, lpOverlapped=0x0) returned 1 [0125.596] ReadFile (in: hFile=0x2d0, lpBuffer=0x26f0704, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19b1ec, lpOverlapped=0x0 | out: lpBuffer=0x26f0704*, lpNumberOfBytesRead=0x19b1ec*=0x0, lpOverlapped=0x0) returned 1 [0125.596] CloseHandle (hObject=0x2d0) returned 1 [0125.597] CoTaskMemAlloc (cb=0x20c) returned 0x6b59f0 [0125.597] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6b59f0, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe")) returned 0x62 [0125.597] CoTaskMemFree (pv=0x6b59f0) [0125.597] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe", nBufferLength=0x105, lpBuffer=0x19b110, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe", lpFilePart=0x0) returned 0x62 [0125.598] GetCurrentProcess () returned 0xffffffff [0125.598] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19b594 | out: TokenHandle=0x19b594*=0x2d0) returned 1 [0125.598] GetCurrentProcess () returned 0xffffffff [0125.598] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19b594 | out: TokenHandle=0x19b594*=0x2d4) returned 1 [0125.599] GetCurrentProcess () returned 0xffffffff [0125.599] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19b450 | out: TokenHandle=0x19b450*=0x2d8) returned 1 [0125.599] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe.config" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19b448 | out: lpFileInformation=0x19b448*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0125.599] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe.config", nBufferLength=0x105, lpBuffer=0x19aeb4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe.config", lpFilePart=0x0) returned 0x69 [0125.600] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe.config" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19b450 | out: lpFileInformation=0x19b450*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0125.600] GetCurrentProcess () returned 0xffffffff [0125.600] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19b594 | out: TokenHandle=0x19b594*=0x2dc) returned 1 [0125.600] GetCurrentProcess () returned 0xffffffff [0125.600] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19b594 | out: TokenHandle=0x19b594*=0x2e0) returned 1 [0125.622] GetCurrentProcess () returned 0xffffffff [0125.622] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19b3f4 | out: TokenHandle=0x19b3f4*=0x2e4) returned 1 [0125.676] GetCurrentProcess () returned 0xffffffff [0125.676] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19b404 | out: TokenHandle=0x19b404*=0x2e8) returned 1 [0125.735] GetCurrentProcess () returned 0xffffffff [0125.735] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ac18 | out: TokenHandle=0x19ac18*=0x2ec) returned 1 [0125.746] GetCurrentProcess () returned 0xffffffff [0125.746] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ac28 | out: TokenHandle=0x19ac28*=0x2f0) returned 1 [0129.333] GetCurrentProcess () returned 0xffffffff [0129.333] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19bb14 | out: TokenHandle=0x19bb14*=0x2f4) returned 1 [0129.345] GetCurrentProcess () returned 0xffffffff [0129.345] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19bb24 | out: TokenHandle=0x19bb24*=0x2f8) returned 1 [0130.271] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76720000 [0130.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="AppPolicyGetClrCompat", cchWideChar=21, lpMultiByteStr=0x19bc14, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AppPolicyGetClrCompatÂ\x19", lpUsedDefaultChar=0x0) returned 21 [0130.276] GetProcAddress (hModule=0x76720000, lpProcName="AppPolicyGetClrCompat") returned 0x0 [0130.276] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76720000 [0130.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="GetCurrentPackageId", cchWideChar=19, lpMultiByteStr=0x19bc14, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentPackageId", lpUsedDefaultChar=0x0) returned 19 [0130.276] GetProcAddress (hModule=0x76720000, lpProcName="GetCurrentPackageId") returned 0x769cded0 [0130.281] GetCurrentPackageId () returned 0x3d54 [0135.498] EtwEventRegister (in: ProviderId=0x2727fc4, EnableCallback=0x4b14a66, CallbackContext=0x0, RegHandle=0x2727fa0 | out: RegHandle=0x2727fa0) returned 0x0 [0139.918] CoCreateGuid (in: pguid=0x19bbac | out: pguid=0x19bbac*(Data1=0x824a4db5, Data2=0x52ea, Data3=0x47f1, Data4=([0]=0xb6, [1]=0x35, [2]=0x13, [3]=0x4c, [4]=0xc, [5]=0x84, [6]=0x46, [7]=0x1c))) returned 0x0 [0140.271] CoCreateGuid (in: pguid=0x19baec | out: pguid=0x19baec*(Data1=0x848afa33, Data2=0x583a, Data3=0x4722, Data4=([0]=0x95, [1]=0xb8, [2]=0xf6, [3]=0xe4, [4]=0xf2, [5]=0xdc, [6]=0xe5, [7]=0x7d))) returned 0x0 [0140.758] CoCreateGuid (in: pguid=0x19b954 | out: pguid=0x19b954*(Data1=0x439d1507, Data2=0x6322, Data3=0x4b4f, Data4=([0]=0xaf, [1]=0x28, [2]=0xa7, [3]=0xb8, [4]=0xaf, [5]=0xc8, [6]=0x3b, [7]=0xc0))) returned 0x0 [0142.669] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19b5e8 | out: lpWSAData=0x19b5e8) returned 0 [0142.681] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x330 [0143.086] setsockopt (s=0x330, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0143.086] closesocket (s=0x330) returned 0 [0143.086] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x330 [0143.088] setsockopt (s=0x330, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0143.088] closesocket (s=0x330) returned 0 [0143.098] GetCurrentProcess () returned 0xffffffff [0143.098] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19b430 | out: TokenHandle=0x19b430*=0x330) returned 1 [0143.102] GetCurrentProcess () returned 0xffffffff [0143.102] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19b440 | out: TokenHandle=0x19b440*=0x334) returned 1 [0143.121] GetAddrInfoW (in: pNodeName="stcontact.top", pServiceName=0x0, pHints=0x19b7d0*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x19b778 | out: ppResult=0x19b778*=0x72bd10*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="stcontact.top", ai_addr=0x72ab08*(sa_family=2, sin_port=0x0, sin_addr="91.203.192.233"), ai_next=0x0)) returned 0 [0144.330] FreeAddrInfoW (pAddrInfo=0x72bd10*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="stcontact.top", ai_addr=0x72ab08*(sa_family=2, sin_port=0x0, sin_addr="91.203.192.233"), ai_next=0x0)) [0144.337] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x360 [0144.350] WSAConnect (in: s=0x360, name=0x273174c*(sa_family=2, sin_port=0x50, sin_addr="91.203.192.233"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0144.474] setsockopt (s=0x360, level=65535, optname=4098, optval="", optlen=4) returned 0 [0144.474] setsockopt (s=0x360, level=65535, optname=4097, optval="", optlen=4) returned 0 [0144.670] setsockopt (s=0x360, level=6, optname=1, optval="\x01", optlen=4) returned 0 [0144.686] setsockopt (s=0x360, level=65535, optname=4101, optval="qh\x1b", optlen=4) returned 0 [0144.686] send (s=0x360, buf=0x272b224*, len=37, flags=0) returned 37 [0144.711] setsockopt (s=0x360, level=65535, optname=4102, optval="åg\x1b", optlen=4) returned 0 [0144.711] recv (in: s=0x360, buf=0x2751b6c, len=1, flags=0 | out: buf=0x2751b6c*) returned 1 [0145.493] send (s=0x360, buf=0x275250f*, len=202, flags=0) returned 202 [0145.511] recv (in: s=0x360, buf=0x2754dd8, len=8192, flags=0 | out: buf=0x2754dd8*) returned 142 [0146.156] CoCreateGuid (in: pguid=0x19bba4 | out: pguid=0x19bba4*(Data1=0xd0c5dbaa, Data2=0x7ef3, Data3=0x4130, Data4=([0]=0xae, [1]=0xd8, [2]=0xc7, [3]=0x87, [4]=0xfa, [5]=0xea, [6]=0xf, [7]=0x77))) returned 0x0 [0146.184] CoCreateGuid (in: pguid=0x19bae4 | out: pguid=0x19bae4*(Data1=0x4c1b3806, Data2=0xdc87, Data3=0x4907, Data4=([0]=0xa7, [1]=0x40, [2]=0x34, [3]=0x48, [4]=0x12, [5]=0x21, [6]=0xaf, [7]=0xdb))) returned 0x0 [0146.200] send (s=0x360, buf=0x275250f*, len=154, flags=0) returned 154 [0146.203] recv (in: s=0x360, buf=0x2754dd8, len=8192, flags=0 | out: buf=0x2754dd8*) returned 2920 [0146.321] recv (in: s=0x360, buf=0x2754dd8, len=8192, flags=0 | out: buf=0x2754dd8*) returned 3881 [0146.483] GetCurrentProcess () returned 0xffffffff [0146.483] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19b3b8 | out: TokenHandle=0x19b3b8*=0x364) returned 1 [0146.485] GetCurrentProcess () returned 0xffffffff [0146.485] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19b3c8 | out: TokenHandle=0x19b3c8*=0x368) returned 1 [0147.009] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x19bd20 | out: pFixedInfo=0x0, pOutBufLen=0x19bd20) returned 0x6f [0147.549] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x70d0f0 [0147.549] GetNetworkParams (in: pFixedInfo=0x70d0f0, pOutBufLen=0x19bd20 | out: pFixedInfo=0x70d0f0, pOutBufLen=0x19bd20) returned 0x0 [0147.566] LocalFree (hMem=0x70d0f0) returned 0x0 [0147.567] GetAdaptersAddresses (in: Family=0x0, Flags=0xc0, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x19be24*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x19be24*=0xef4) returned 0x6f [0147.576] LocalAlloc (uFlags=0x0, uBytes=0xef4) returned 0x7257b8 [0147.576] GetAdaptersAddresses (in: Family=0x0, Flags=0xc0, Reserved=0x0, AdapterAddresses=0x7257b8, SizePointer=0x19be24*=0xef4 | out: AdapterAddresses=0x7257b8*(Alignment=0x600000178, Length=0x178, IfIndex=0x6, Next=0x725cb8, AdapterName="{E96D977E-F067-4CE9-924D-F6E0A04729E4}", FirstUnicastAddress=0x7259dc, FirstAnycastAddress=0x0, FirstMulticastAddress=0x725a68, FirstDnsServerAddress=0x725c68, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #2", FriendlyName="Ethernet 2", PhysicalAddress=([0]=0x0, [1]=0x26, [2]=0x29, [3]=0xb4, [4]=0x50, [5]=0x94, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x1c5, DdnsEnabled=0x1c5, RegisterAdapterSuffix=0x1c5, Dhcpv4Enabled=0x1c5, ReceiveOnly=0x1c5, NoMulticast=0x1c5, Ipv6OtherStatefulConfig=0x1c5, NetbiosOverTcpipEnabled=0x1c5, Ipv4Enabled=0x1c5, Ipv6Enabled=0x1c5, Ipv6ManagedAddressConfigurationSupported=0x1c5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x6, ZoneIndices=([0]=0x6, [1]=0x6, [2]=0x6, [3]=0x6, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x725c90, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6008002000000, Dhcpv4Server.lpSockaddr=0x725930*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11eb6c9dc20d55b0, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x28, [5]=0xb6, [6]=0x28, [7]=0x5e, [8]=0x0, [9]=0xf, [10]=0xf3, [11]=0xe1, [12]=0x61, [13]=0x38, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x6000ff3, FirstDnsSuffix=0x0), SizePointer=0x19be24*=0xef4) returned 0x0 [0147.594] GetPerAdapterInfo (in: IfIndex=0x6, pPerAdapterInfo=0x0, pOutBufLen=0x19ba8c | out: pPerAdapterInfo=0x0, pOutBufLen=0x19ba8c) returned 0x6f [0147.605] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6d2bb0 [0147.605] GetPerAdapterInfo (in: IfIndex=0x6, pPerAdapterInfo=0x6d2bb0, pOutBufLen=0x19ba8c | out: pPerAdapterInfo=0x6d2bb0, pOutBufLen=0x19ba8c) returned 0x0 [0147.670] LocalFree (hMem=0x6d2bb0) returned 0x0 [0147.671] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x19ba8c | out: pPerAdapterInfo=0x0, pOutBufLen=0x19ba8c) returned 0x6f [0147.680] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6d2d50 [0147.680] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6d2d50, pOutBufLen=0x19ba8c | out: pPerAdapterInfo=0x6d2d50, pOutBufLen=0x19ba8c) returned 0x0 [0147.689] LocalFree (hMem=0x6d2d50) returned 0x0 [0147.691] LocalFree (hMem=0x7257b8) returned 0x0 [0148.108] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3a8 [0148.108] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x36c [0148.116] GetCurrentProcess () returned 0xffffffff [0148.116] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ba44 | out: TokenHandle=0x19ba44*=0x3b4) returned 1 [0148.119] GetCurrentProcess () returned 0xffffffff [0148.119] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ba54 | out: TokenHandle=0x19ba54*=0x3ac) returned 1 [0148.121] QueryPerformanceFrequency (in: lpFrequency=0x1f65680 | out: lpFrequency=0x1f65680*=100000000) returned 1 [0148.121] QueryPerformanceCounter (in: lpPerformanceCount=0x19bdc8 | out: lpPerformanceCount=0x19bdc8*=2466455261326) returned 1 [0148.123] GetCurrentProcess () returned 0xffffffff [0148.123] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ba24 | out: TokenHandle=0x19ba24*=0x3b8) returned 1 [0148.125] GetCurrentProcess () returned 0xffffffff [0148.125] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ba34 | out: TokenHandle=0x19ba34*=0x3bc) returned 1 [0148.130] GetCurrentProcess () returned 0xffffffff [0148.130] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19bcac | out: TokenHandle=0x19bcac*=0x3c0) returned 1 [0148.137] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ade4 | out: phkResult=0x19ade4*=0x3c4) returned 0x0 [0148.138] RegQueryValueExW (in: hKey=0x3c4, lpValueName="InstallationType", lpReserved=0x0, lpType=0x19ae04, lpData=0x0, lpcbData=0x19ae00*=0x0 | out: lpType=0x19ae04*=0x1, lpData=0x0, lpcbData=0x19ae00*=0xe) returned 0x0 [0148.139] RegQueryValueExW (in: hKey=0x3c4, lpValueName="InstallationType", lpReserved=0x0, lpType=0x19ae04, lpData=0x279f388, lpcbData=0x19ae00*=0xe | out: lpType=0x19ae04*=0x1, lpData="Client", lpcbData=0x19ae00*=0xe) returned 0x0 [0148.139] RegCloseKey (hKey=0x3c4) returned 0x0 [0148.860] CoTaskMemAlloc (cb=0xcc0) returned 0x51bdf80 [0148.860] RasEnumConnectionsW (in: param_1=0x51bdf80, param_2=0x19bcbc, param_3=0x19bcc0 | out: param_1=0x51bdf80, param_2=0x19bcbc, param_3=0x19bcc0) returned 0x0 [0149.112] CoTaskMemFree (pv=0x51bdf80) [0149.112] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x3f4 [0149.113] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3f8 [0149.114] ioctlsocket (in: s=0x3f4, cmd=-2147195266, argp=0x19bcc4 | out: argp=0x19bcc4) returned 0 [0149.114] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x3fc [0149.115] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x404 [0149.115] ioctlsocket (in: s=0x3fc, cmd=-2147195266, argp=0x19bcc4 | out: argp=0x19bcc4) returned 0 [0149.116] WSAIoctl (in: s=0x3f4, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19bcac, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19bcac, lpOverlapped=0x0) returned -1 [0149.117] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19b9dc, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0149.150] WSAEventSelect (s=0x3f4, hEventObject=0x3f8, lNetworkEvents=512) returned 0 [0149.151] WSAIoctl (in: s=0x3fc, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19bcac, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19bcac, lpOverlapped=0x0) returned -1 [0149.151] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19b9dc, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0149.151] WSAEventSelect (s=0x3fc, hEventObject=0x404, lNetworkEvents=512) returned 0 [0149.151] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x40c [0149.151] RasConnectionNotificationW (param_1=0xffffffff, param_2=0x40c, param_3=0x3) returned 0x0 [0149.161] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x19bcd8 | out: phkResult=0x19bcd8*=0x424) returned 0x0 [0149.162] RegOpenKeyExW (in: hKey=0x424, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bc8c | out: phkResult=0x19bc8c*=0x428) returned 0x0 [0149.162] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x42c [0149.163] RegNotifyChangeKeyValue (hKey=0x428, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x42c, fAsynchronous=1) returned 0x0 [0149.164] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bc90 | out: phkResult=0x19bc90*=0x430) returned 0x0 [0149.164] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x434 [0149.164] RegNotifyChangeKeyValue (hKey=0x430, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x434, fAsynchronous=1) returned 0x0 [0149.165] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bc90 | out: phkResult=0x19bc90*=0x438) returned 0x0 [0149.165] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x43c [0149.165] RegNotifyChangeKeyValue (hKey=0x438, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x43c, fAsynchronous=1) returned 0x0 [0149.165] GetCurrentProcess () returned 0xffffffff [0149.165] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19bc80 | out: TokenHandle=0x19bc80*=0x440) returned 1 [0149.168] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x19b588 | out: phkResult=0x19b588*=0x444) returned 0x0 [0149.169] RegQueryValueExW (in: hKey=0x444, lpValueName="LegacyWPADSupport", lpReserved=0x0, lpType=0x19b5a4, lpData=0x0, lpcbData=0x19b5a0*=0x0 | out: lpType=0x19b5a4*=0x0, lpData=0x0, lpcbData=0x19b5a0*=0x0) returned 0x2 [0149.169] RegCloseKey (hKey=0x444) returned 0x0 [0149.591] WinHttpOpen (pszAgentW=0x0, dwAccessType=0x1, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0x634fc8 [0149.823] WinHttpSetTimeouts (hInternet=0x634fc8, nResolveTimeout=60000, nConnectTimeout=60000, nSendTimeout=60000, nReceiveTimeout=60000) returned 1 [0149.826] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x19bc8c | out: pProxyConfig=0x19bc8c) returned 1 [0149.845] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_Disabled", lpBuffer=0x19b4b0, nSize=0xa8 | out: lpBuffer="") returned 0x0 [0149.845] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_MinCount", lpBuffer=0x19b4b0, nSize=0xa8 | out: lpBuffer="") returned 0x0 [0149.853] EtwEventRegister (in: ProviderId=0x27a1f18, EnableCallback=0x4b14bb6, CallbackContext=0x0, RegHandle=0x27a1ef4 | out: RegHandle=0x27a1ef4) returned 0x0 [0149.853] EtwEventSetInformation (RegHandle=0x6a4668, InformationClass=0x41, EventInformation=0x2, InformationLength=0x27a1eb4) returned 0x0 [0149.857] GetCurrentProcess () returned 0xffffffff [0149.857] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19b9ec | out: TokenHandle=0x19b9ec*=0x488) returned 1 [0149.859] GetCurrentProcess () returned 0xffffffff [0149.859] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19b9fc | out: TokenHandle=0x19b9fc*=0x494) returned 1 [0149.865] SetEvent (hEvent=0x3a8) returned 1 [0149.880] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19bbf8*=0x40c, lpdwindex=0x19ba14 | out: lpdwindex=0x19ba14) returned 0x80010115 [0150.004] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19bbd8*=0x3f8, lpdwindex=0x19b9f4 | out: lpdwindex=0x19b9f4) returned 0x80010115 [0150.004] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19bbd8*=0x404, lpdwindex=0x19b9f4 | out: lpdwindex=0x19b9f4) returned 0x80010115 [0150.004] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19bc2c*=0x42c, lpdwindex=0x19ba4c | out: lpdwindex=0x19ba4c) returned 0x80010115 [0150.005] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19bc2c*=0x434, lpdwindex=0x19ba4c | out: lpdwindex=0x19ba4c) returned 0x80010115 [0150.005] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19bc2c*=0x43c, lpdwindex=0x19ba4c | out: lpdwindex=0x19ba4c) returned 0x80010115 [0150.012] GetCurrentProcess () returned 0xffffffff [0150.012] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19b968 | out: TokenHandle=0x19b968*=0x4c0) returned 1 [0150.013] GetCurrentProcess () returned 0xffffffff [0150.013] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19b978 | out: TokenHandle=0x19b978*=0x4c4) returned 1 [0150.014] GetTimeZoneInformation (in: lpTimeZoneInformation=0x19bae8 | out: lpTimeZoneInformation=0x19bae8) returned 0x2 [0150.016] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x19b944 | out: pTimeZoneInformation=0x19b944) returned 0x2 [0150.017] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ba28 | out: phkResult=0x19ba28*=0x4c8) returned 0x0 [0150.018] RegQueryValueExW (in: hKey=0x4c8, lpValueName="TZI", lpReserved=0x0, lpType=0x19ba44, lpData=0x0, lpcbData=0x19ba40*=0x0 | out: lpType=0x19ba44*=0x3, lpData=0x0, lpcbData=0x19ba40*=0x2c) returned 0x0 [0150.019] RegQueryValueExW (in: hKey=0x4c8, lpValueName="TZI", lpReserved=0x0, lpType=0x19ba44, lpData=0x27a4e74, lpcbData=0x19ba40*=0x2c | out: lpType=0x19ba44*=0x3, lpData=0x27a4e74*, lpcbData=0x19ba40*=0x2c) returned 0x0 [0150.019] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0x19b87c | out: phkResult=0x19b87c*=0x0) returned 0x2 [0150.020] RegQueryValueExW (in: hKey=0x4c8, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x19ba1c, lpData=0x0, lpcbData=0x19ba18*=0x0 | out: lpType=0x19ba1c*=0x1, lpData=0x0, lpcbData=0x19ba18*=0x20) returned 0x0 [0150.020] RegQueryValueExW (in: hKey=0x4c8, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x19ba1c, lpData=0x27a5298, lpcbData=0x19ba18*=0x20 | out: lpType=0x19ba1c*=0x1, lpData="@tzres.dll,-320", lpcbData=0x19ba18*=0x20) returned 0x0 [0150.020] RegQueryValueExW (in: hKey=0x4c8, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x19ba1c, lpData=0x0, lpcbData=0x19ba18*=0x0 | out: lpType=0x19ba1c*=0x1, lpData=0x0, lpcbData=0x19ba18*=0x20) returned 0x0 [0150.020] RegQueryValueExW (in: hKey=0x4c8, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x19ba1c, lpData=0x27a52f0, lpcbData=0x19ba18*=0x20 | out: lpType=0x19ba1c*=0x1, lpData="@tzres.dll,-322", lpcbData=0x19ba18*=0x20) returned 0x0 [0150.020] RegQueryValueExW (in: hKey=0x4c8, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x19ba1c, lpData=0x0, lpcbData=0x19ba18*=0x0 | out: lpType=0x19ba1c*=0x1, lpData=0x0, lpcbData=0x19ba18*=0x20) returned 0x0 [0150.020] RegQueryValueExW (in: hKey=0x4c8, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x19ba1c, lpData=0x27a5348, lpcbData=0x19ba18*=0x20 | out: lpType=0x19ba1c*=0x1, lpData="@tzres.dll,-321", lpcbData=0x19ba18*=0x20) returned 0x0 [0156.877] CoTaskMemAlloc (cb=0x20c) returned 0x6b5c18 [0156.877] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x6b5c18 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0156.884] CoTaskMemFree (pv=0x6b5c18) [0156.896] CoTaskMemAlloc (cb=0x20c) returned 0x6b59f0 [0156.897] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x19ba38, pwszFileMUIPath=0x6b59f0, pcchFileMUIPath=0x19ba3c, pululEnumerator=0x19ba30 | out: pwszLanguage=0x0, pcchLanguage=0x19ba38, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x19ba3c, pululEnumerator=0x19ba30) returned 1 [0157.284] CoTaskMemFree (pv=0x0) [0157.284] CoTaskMemFree (pv=0x6b59f0) [0157.285] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x5b70001 [0157.478] CoTaskMemAlloc (cb=0x3ec) returned 0x51bfd18 [0157.478] LoadStringW (in: hInstance=0x5b70001, uID=0x140, lpBuffer=0x51bfd18, cchBufferMax=500 | out: lpBuffer="(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna") returned 0x3c [0157.478] CoTaskMemFree (pv=0x51bfd18) [0157.478] FreeLibrary (hLibModule=0x5b70001) returned 1 [0157.479] CoTaskMemAlloc (cb=0x20c) returned 0x6b5378 [0157.479] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x6b5378 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0157.479] CoTaskMemFree (pv=0x6b5378) [0157.479] CoTaskMemAlloc (cb=0x20c) returned 0x6b5c18 [0157.479] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x19ba38, pwszFileMUIPath=0x6b5c18, pcchFileMUIPath=0x19ba3c, pululEnumerator=0x19ba30 | out: pwszLanguage=0x0, pcchLanguage=0x19ba38, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x19ba3c, pululEnumerator=0x19ba30) returned 1 [0157.483] CoTaskMemFree (pv=0x0) [0157.483] CoTaskMemFree (pv=0x6b5c18) [0157.483] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x5b70001 [0157.485] CoTaskMemAlloc (cb=0x3ec) returned 0x51c0930 [0157.485] LoadStringW (in: hInstance=0x5b70001, uID=0x142, lpBuffer=0x51c0930, cchBufferMax=500 | out: lpBuffer="W. Europe Standard Time") returned 0x17 [0157.486] CoTaskMemFree (pv=0x51c0930) [0157.486] FreeLibrary (hLibModule=0x5b70001) returned 1 [0157.486] CoTaskMemAlloc (cb=0x20c) returned 0x6b59f0 [0157.486] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x6b59f0 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0157.487] CoTaskMemFree (pv=0x6b59f0) [0157.487] CoTaskMemAlloc (cb=0x20c) returned 0x6b5378 [0157.487] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x19ba38, pwszFileMUIPath=0x6b5378, pcchFileMUIPath=0x19ba3c, pululEnumerator=0x19ba30 | out: pwszLanguage=0x0, pcchLanguage=0x19ba38, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x19ba3c, pululEnumerator=0x19ba30) returned 1 [0157.490] CoTaskMemFree (pv=0x0) [0157.490] CoTaskMemFree (pv=0x6b5378) [0157.490] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x5b70001 [0157.492] CoTaskMemAlloc (cb=0x3ec) returned 0x51c1548 [0157.492] LoadStringW (in: hInstance=0x5b70001, uID=0x141, lpBuffer=0x51c1548, cchBufferMax=500 | out: lpBuffer="W. Europe Daylight Time") returned 0x17 [0157.493] CoTaskMemFree (pv=0x51c1548) [0157.493] FreeLibrary (hLibModule=0x5b70001) returned 1 [0157.494] RegCloseKey (hKey=0x4c8) returned 0x0 [0157.495] SetEvent (hEvent=0x3a8) returned 1 [0157.497] GetACP () returned 0x4e4 [0157.514] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x19bc44 | out: pFixedInfo=0x0, pOutBufLen=0x19bc44) returned 0x6f [0157.533] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x70eb68 [0157.533] GetNetworkParams (in: pFixedInfo=0x70eb68, pOutBufLen=0x19bc44 | out: pFixedInfo=0x70eb68, pOutBufLen=0x19bc44) returned 0x0 [0157.543] LocalFree (hMem=0x70eb68) returned 0x0 [0157.544] CoTaskMemAlloc (cb=0x20c) returned 0x6b5378 [0157.544] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_Disabled", lpBuffer=0x6b5378, nSize=0x104 | out: lpBuffer="") returned 0x0 [0157.545] CoTaskMemFree (pv=0x6b5378) [0157.545] CoTaskMemAlloc (cb=0x20c) returned 0x6b5378 [0157.545] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_MinCount", lpBuffer=0x6b5378, nSize=0x104 | out: lpBuffer="") returned 0x0 [0157.545] CoTaskMemFree (pv=0x6b5378) [0157.548] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x540 [0157.549] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x538 [0157.550] GetAddrInfoW (in: pNodeName="api.ip.sb", pServiceName=0x0, pHints=0x19bb2c*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x19bad4 | out: ppResult=0x19bad4*=0x51a8a38*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="api.ip.sb.cdn.cloudflare.net", ai_addr=0x72a100*(sa_family=2, sin_port=0x0, sin_addr="172.67.75.172"), ai_next=0x51a8a60*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x72a178*(sa_family=2, sin_port=0x0, sin_addr="104.26.12.31"), ai_next=0x51a8588*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x72a4d8*(sa_family=2, sin_port=0x0, sin_addr="104.26.13.31"), ai_next=0x0)))) returned 0 [0157.634] FreeAddrInfoW (pAddrInfo=0x51a8a38*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="api.ip.sb.cdn.cloudflare.net", ai_addr=0x72a100*(sa_family=2, sin_port=0x0, sin_addr="172.67.75.172"), ai_next=0x51a8a60*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x72a178*(sa_family=2, sin_port=0x0, sin_addr="104.26.12.31"), ai_next=0x51a8588*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x72a4d8*(sa_family=2, sin_port=0x0, sin_addr="104.26.13.31"), ai_next=0x0)))) [0157.636] GetAddrInfoW (in: pNodeName="api.ip.sb", pServiceName=0x0, pHints=0x19bb2c*(ai_flags=131072, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x19bad4 | out: ppResult=0x19bad4*=0x51a8a38*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="api.ip.sb", ai_addr=0x72a3d0*(sa_family=2, sin_port=0x0, sin_addr="172.67.75.172"), ai_next=0x51a8a60*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x72a3b8*(sa_family=2, sin_port=0x0, sin_addr="104.26.12.31"), ai_next=0x51a8588*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x72a358*(sa_family=2, sin_port=0x0, sin_addr="104.26.13.31"), ai_next=0x0)))) returned 0 [0157.641] FreeAddrInfoW (pAddrInfo=0x51a8a38*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="api.ip.sb", ai_addr=0x72a3d0*(sa_family=2, sin_port=0x0, sin_addr="172.67.75.172"), ai_next=0x51a8a60*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x72a3b8*(sa_family=2, sin_port=0x0, sin_addr="104.26.12.31"), ai_next=0x51a8588*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x72a358*(sa_family=2, sin_port=0x0, sin_addr="104.26.13.31"), ai_next=0x0)))) [0157.642] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4ac [0157.642] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x548 [0157.642] ioctlsocket (in: s=0x4ac, cmd=-2147195266, argp=0x19bb04 | out: argp=0x19bb04) returned 0 [0157.642] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x54c [0157.642] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x550 [0157.643] ioctlsocket (in: s=0x54c, cmd=-2147195266, argp=0x19bb04 | out: argp=0x19bb04) returned 0 [0157.643] WSAIoctl (in: s=0x4ac, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19baec, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19baec, lpOverlapped=0x0) returned -1 [0157.643] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19b81c, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0157.643] WSAEventSelect (s=0x4ac, hEventObject=0x548, lNetworkEvents=512) returned 0 [0157.644] WSAIoctl (in: s=0x54c, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19baec, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19baec, lpOverlapped=0x0) returned -1 [0157.644] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19b81c, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0157.644] WSAEventSelect (s=0x54c, hEventObject=0x550, lNetworkEvents=512) returned 0 [0157.644] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x19bae8*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x19bae8*=0xa80) returned 0x6f [0157.649] LocalAlloc (uFlags=0x0, uBytes=0xa80) returned 0x51d2c78 [0157.649] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x51d2c78, SizePointer=0x19bae8*=0xa80 | out: AdapterAddresses=0x51d2c78*(Alignment=0x600000178, Length=0x178, IfIndex=0x6, Next=0x51d2f28, AdapterName="{E96D977E-F067-4CE9-924D-F6E0A04729E4}", FirstUnicastAddress=0x51d2e9c, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #2", FriendlyName="Ethernet 2", PhysicalAddress=([0]=0x0, [1]=0x26, [2]=0x29, [3]=0xb4, [4]=0x50, [5]=0x94, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x1c5, DdnsEnabled=0x1c5, RegisterAdapterSuffix=0x1c5, Dhcpv4Enabled=0x1c5, ReceiveOnly=0x1c5, NoMulticast=0x1c5, Ipv6OtherStatefulConfig=0x1c5, NetbiosOverTcpipEnabled=0x1c5, Ipv4Enabled=0x1c5, Ipv6Enabled=0x1c5, Ipv6ManagedAddressConfigurationSupported=0x1c5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x6, ZoneIndices=([0]=0x6, [1]=0x6, [2]=0x6, [3]=0x6, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6008002000000, Dhcpv4Server.lpSockaddr=0x51d2df0*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11eb6c9dc20d55b0, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x28, [5]=0xb6, [6]=0x28, [7]=0x5e, [8]=0x0, [9]=0xf, [10]=0xf3, [11]=0xe1, [12]=0x61, [13]=0x38, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x6000ff3, FirstDnsSuffix=0x0), SizePointer=0x19bae8*=0xa80) returned 0x0 [0157.658] LocalFree (hMem=0x51d2c78) returned 0x0 [0157.661] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bb04 | out: phkResult=0x19bb04*=0x554) returned 0x0 [0157.661] RegQueryValueExW (in: hKey=0x554, lpValueName="HWRPortReuseOnSocketBind", lpReserved=0x0, lpType=0x19bb20, lpData=0x0, lpcbData=0x19bb1c*=0x0 | out: lpType=0x19bb20*=0x0, lpData=0x0, lpcbData=0x19bb1c*=0x0) returned 0x2 [0157.663] RegCloseKey (hKey=0x554) returned 0x0 [0157.663] WSAConnect (in: s=0x540, name=0x27b228c*(sa_family=2, sin_port=0x1bb, sin_addr="172.67.75.172"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0157.685] closesocket (s=0x538) returned 0 [0157.702] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ba50 | out: phkResult=0x19ba50*=0x538) returned 0x0 [0157.702] RegQueryValueExW (in: hKey=0x538, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x19ba6c, lpData=0x0, lpcbData=0x19ba68*=0x0 | out: lpType=0x19ba6c*=0x4, lpData=0x0, lpcbData=0x19ba68*=0x4) returned 0x0 [0157.703] RegQueryValueExW (in: hKey=0x538, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x19ba6c, lpData=0x19ba58, lpcbData=0x19ba68*=0x4 | out: lpType=0x19ba6c*=0x4, lpData=0x19ba58*=0x1, lpcbData=0x19ba68*=0x4) returned 0x0 [0157.703] RegQueryValueExW (in: hKey=0x538, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x19baa4, lpData=0x0, lpcbData=0x19baa0*=0x0 | out: lpType=0x19baa4*=0x4, lpData=0x0, lpcbData=0x19baa0*=0x4) returned 0x0 [0157.704] RegCloseKey (hKey=0x538) returned 0x0 [0157.708] GetCurrentProcessId () returned 0x11b4 [0157.708] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11b4) returned 0x538 [0157.708] EnumProcessModules (in: hProcess=0x538, lphModule=0x27b402c, cb=0x100, lpcbNeeded=0x19ba58 | out: lphModule=0x27b402c, lpcbNeeded=0x19ba58) returned 1 [0157.710] EnumProcessModules (in: hProcess=0x538, lphModule=0x27b4138, cb=0x200, lpcbNeeded=0x19ba58 | out: lphModule=0x27b4138, lpcbNeeded=0x19ba58) returned 1 [0157.712] GetModuleInformation (in: hProcess=0x538, hModule=0x400000, lpmodinfo=0x27b4378, cb=0xc | out: lpmodinfo=0x27b4378*(lpBaseOfDll=0x400000, SizeOfImage=0x71000, EntryPoint=0x40b2b0)) returned 1 [0157.712] CoTaskMemAlloc (cb=0x804) returned 0x51d2c78 [0157.712] GetModuleBaseNameW (in: hProcess=0x538, hModule=0x400000, lpBaseName=0x51d2c78, nSize=0x800 | out: lpBaseName="a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe") returned 0x44 [0157.712] CoTaskMemFree (pv=0x51d2c78) [0157.712] CoTaskMemAlloc (cb=0x804) returned 0x51d2c78 [0157.712] GetModuleFileNameExW (in: hProcess=0x538, hModule=0x400000, lpFilename=0x51d2c78, nSize=0x800 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe")) returned 0x62 [0157.713] CoTaskMemFree (pv=0x51d2c78) [0157.713] CloseHandle (hObject=0x538) returned 1 [0157.713] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe", nBufferLength=0x105, lpBuffer=0x19b560, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe", lpFilePart=0x0) returned 0x62 [0157.713] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.SecurityProtocol", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ba50 | out: phkResult=0x19ba50*=0x0) returned 0x2 [0157.723] GetCurrentProcessId () returned 0x11b4 [0157.723] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11b4) returned 0x538 [0157.723] EnumProcessModules (in: hProcess=0x538, lphModule=0x27b6f18, cb=0x100, lpcbNeeded=0x19ba60 | out: lphModule=0x27b6f18, lpcbNeeded=0x19ba60) returned 1 [0157.724] EnumProcessModules (in: hProcess=0x538, lphModule=0x27b7024, cb=0x200, lpcbNeeded=0x19ba60 | out: lphModule=0x27b7024, lpcbNeeded=0x19ba60) returned 1 [0157.726] GetModuleInformation (in: hProcess=0x538, hModule=0x400000, lpmodinfo=0x27b7264, cb=0xc | out: lpmodinfo=0x27b7264*(lpBaseOfDll=0x400000, SizeOfImage=0x71000, EntryPoint=0x40b2b0)) returned 1 [0157.726] CoTaskMemAlloc (cb=0x804) returned 0x51c7910 [0157.726] GetModuleBaseNameW (in: hProcess=0x538, hModule=0x400000, lpBaseName=0x51c7910, nSize=0x800 | out: lpBaseName="a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe") returned 0x44 [0157.726] CoTaskMemFree (pv=0x51c7910) [0157.726] CoTaskMemAlloc (cb=0x804) returned 0x51c7910 [0157.726] GetModuleFileNameExW (in: hProcess=0x538, hModule=0x400000, lpFilename=0x51c7910, nSize=0x800 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe")) returned 0x62 [0157.727] CoTaskMemFree (pv=0x51c7910) [0157.727] CloseHandle (hObject=0x538) returned 1 [0157.727] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe", nBufferLength=0x105, lpBuffer=0x19b568, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe", lpFilePart=0x0) returned 0x62 [0157.727] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.SchSendAuxRecord", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ba58 | out: phkResult=0x19ba58*=0x0) returned 0x2 [0157.727] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ba58 | out: phkResult=0x19ba58*=0x538) returned 0x0 [0157.727] RegQueryValueExW (in: hKey=0x538, lpValueName="SchSendAuxRecord", lpReserved=0x0, lpType=0x19ba74, lpData=0x0, lpcbData=0x19ba70*=0x0 | out: lpType=0x19ba74*=0x0, lpData=0x0, lpcbData=0x19ba70*=0x0) returned 0x2 [0157.727] RegCloseKey (hKey=0x538) returned 0x0 [0157.856] EnumerateSecurityPackagesW (in: pcPackages=0x19ba7c, ppPackageInfo=0x19ba10 | out: pcPackages=0x19ba7c, ppPackageInfo=0x19ba10) returned 0x0 [0157.867] FreeContextBuffer (in: pvContextBuffer=0x51c7910 | out: pvContextBuffer=0x51c7910) returned 0x0 [0157.873] GetCurrentProcess () returned 0xffffffff [0157.873] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19b85c | out: TokenHandle=0x19b85c*=0x558) returned 1 [0157.875] AcquireCredentialsHandleW (in: pPrincipal=0x0, pPackage=0x27b99d4, fCredentialUse=0x2, pvLogonId=0x0, pAuthData=0x19b8b0, pGetKeyFn=0x0, pvGetKeyArgument=0x0, phCredential=0x27baecc, ptsExpiry=0x19b834 | out: phCredential=0x27baecc, ptsExpiry=0x19b834) returned 0x0 [0159.161] InitializeSecurityContextW (in: phCredential=0x19b874, phContext=0x0, pTargetName=0x27b2358, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x0, Reserved2=0x0, phNewContext=0x27bb0d0, pOutput=0x27bb068, pfContextAttr=0x27b99a8, ptsExpiry=0x19b86c | out: phNewContext=0x27bb0d0, pOutput=0x27bb068, pfContextAttr=0x27b99a8, ptsExpiry=0x19b86c) returned 0x90312 [0159.164] FreeContextBuffer (in: pvContextBuffer=0x6d2758 | out: pvContextBuffer=0x6d2758) returned 0x0 [0159.166] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76720000 [0159.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="AppPolicyGetClrCompat", cchWideChar=21, lpMultiByteStr=0x19b8b0, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AppPolicyGetClrCompatÃAmÿgH{(ú\x01o\x80Â\x19", lpUsedDefaultChar=0x0) returned 21 [0159.167] GetProcAddress (hModule=0x76720000, lpProcName="AppPolicyGetClrCompat") returned 0x0 [0159.167] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76720000 [0159.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="GetCurrentPackageId", cchWideChar=19, lpMultiByteStr=0x19b8b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentPackageId", lpUsedDefaultChar=0x0) returned 19 [0159.167] GetProcAddress (hModule=0x76720000, lpProcName="GetCurrentPackageId") returned 0x769cded0 [0159.168] GetCurrentPackageId () returned 0x3d54 [0159.169] send (s=0x540, buf=0x27bb0e4*, len=173, flags=0) returned 173 [0159.170] recv (in: s=0x540, buf=0x27bb0e4, len=5, flags=0 | out: buf=0x27bb0e4*) returned 5 [0159.200] recv (in: s=0x540, buf=0x27bb0e9, len=67, flags=0 | out: buf=0x27bb0e9*) returned 67 [0159.201] InitializeSecurityContextW (in: phCredential=0x19b7d8, phContext=0x19b864, pTargetName=0x27b2358, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x27bb424, Reserved2=0x0, phNewContext=0x27bb0d0, pOutput=0x27bb438, pfContextAttr=0x27b99a8, ptsExpiry=0x19b7d0 | out: phNewContext=0x27bb0d0, pOutput=0x27bb438, pfContextAttr=0x27b99a8, ptsExpiry=0x19b7d0) returned 0x90312 [0159.202] recv (in: s=0x540, buf=0x27bb4c8, len=5, flags=0 | out: buf=0x27bb4c8*) returned 5 [0159.202] recv (in: s=0x540, buf=0x27bb4e1, len=2308, flags=0 | out: buf=0x27bb4e1*) returned 2308 [0159.202] InitializeSecurityContextW (in: phCredential=0x19b740, phContext=0x19b7cc, pTargetName=0x27b2358, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x27bbe58, Reserved2=0x0, phNewContext=0x27bb0d0, pOutput=0x27bbe6c, pfContextAttr=0x27b99a8, ptsExpiry=0x19b738 | out: phNewContext=0x27bb0d0, pOutput=0x27bbe6c, pfContextAttr=0x27b99a8, ptsExpiry=0x19b738) returned 0x90312 [0159.204] recv (in: s=0x540, buf=0x27bbefc, len=5, flags=0 | out: buf=0x27bbefc*) returned 5 [0159.204] recv (in: s=0x540, buf=0x27bbf15, len=148, flags=0 | out: buf=0x27bbf15*) returned 148 [0159.205] InitializeSecurityContextW (in: phCredential=0x19b6a8, phContext=0x19b734, pTargetName=0x27b2358, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x27bc01c, Reserved2=0x0, phNewContext=0x27bb0d0, pOutput=0x27bc030, pfContextAttr=0x27b99a8, ptsExpiry=0x19b6a0 | out: phNewContext=0x27bb0d0, pOutput=0x27bc030, pfContextAttr=0x27b99a8, ptsExpiry=0x19b6a0) returned 0x90312 [0159.205] recv (in: s=0x540, buf=0x27bc0c0, len=5, flags=0 | out: buf=0x27bc0c0*) returned 5 [0159.205] recv (in: s=0x540, buf=0x27bc0d9, len=4, flags=0 | out: buf=0x27bc0d9*) returned 4 [0159.205] InitializeSecurityContextW (in: phCredential=0x19b610, phContext=0x19b69c, pTargetName=0x27b2358, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x27bc150, Reserved2=0x0, phNewContext=0x27bb0d0, pOutput=0x27bc164, pfContextAttr=0x27b99a8, ptsExpiry=0x19b608 | out: phNewContext=0x27bb0d0, pOutput=0x27bc164, pfContextAttr=0x27b99a8, ptsExpiry=0x19b608) returned 0x90312 [0159.459] FreeContextBuffer (in: pvContextBuffer=0x6c53c8 | out: pvContextBuffer=0x6c53c8) returned 0x0 [0159.460] send (s=0x540, buf=0x27bc1e0*, len=126, flags=0) returned 126 [0159.460] recv (in: s=0x540, buf=0x27bc1e0, len=5, flags=0 | out: buf=0x27bc1e0*) returned 5 [0159.477] recv (in: s=0x540, buf=0x27bc285, len=202, flags=0 | out: buf=0x27bc285*) returned 202 [0159.478] InitializeSecurityContextW (in: phCredential=0x19b578, phContext=0x19b604, pTargetName=0x27b2358, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x27bc3c0, Reserved2=0x0, phNewContext=0x27bb0d0, pOutput=0x27bc3d4, pfContextAttr=0x27b99a8, ptsExpiry=0x19b570 | out: phNewContext=0x27bb0d0, pOutput=0x27bc3d4, pfContextAttr=0x27b99a8, ptsExpiry=0x19b570) returned 0x90312 [0159.478] recv (in: s=0x540, buf=0x27bc464, len=5, flags=0 | out: buf=0x27bc464*) returned 5 [0159.479] recv (in: s=0x540, buf=0x27bc47d, len=1, flags=0 | out: buf=0x27bc47d*) returned 1 [0159.479] InitializeSecurityContextW (in: phCredential=0x19b4e0, phContext=0x19b56c, pTargetName=0x27b2358, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x27bc4f0, Reserved2=0x0, phNewContext=0x27bb0d0, pOutput=0x27bc504, pfContextAttr=0x27b99a8, ptsExpiry=0x19b4d8 | out: phNewContext=0x27bb0d0, pOutput=0x27bc504, pfContextAttr=0x27b99a8, ptsExpiry=0x19b4d8) returned 0x90312 [0159.479] recv (in: s=0x540, buf=0x27bc594, len=5, flags=0 | out: buf=0x27bc594*) returned 5 [0159.479] recv (in: s=0x540, buf=0x27bc5ad, len=40, flags=0 | out: buf=0x27bc5ad*) returned 40 [0159.480] InitializeSecurityContextW (in: phCredential=0x19b448, phContext=0x19b4d4, pTargetName=0x27b2358, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x27bc648, Reserved2=0x0, phNewContext=0x27bb0d0, pOutput=0x27bc65c, pfContextAttr=0x27b99a8, ptsExpiry=0x19b440 | out: phNewContext=0x27bb0d0, pOutput=0x27bc65c, pfContextAttr=0x27b99a8, ptsExpiry=0x19b440) returned 0x0 [0160.563] QueryContextAttributesW (in: phContext=0x27bb0d0, ulAttribute=0x4, pBuffer=0x27bc708 | out: pBuffer=0x27bc708) returned 0x0 [0160.563] QueryContextAttributesW (in: phContext=0x27bb0d0, ulAttribute=0x5a, pBuffer=0x27bc760 | out: pBuffer=0x27bc760) returned 0x0 [0160.570] QueryContextAttributesW (in: phContext=0x27bb0d0, ulAttribute=0x53, pBuffer=0x27bca14 | out: pBuffer=0x27bca14) returned 0x0 [0160.581] CertDuplicateCertificateContext (pCertContext=0x724e50) returned 0x724e50 [0160.581] CertDuplicateStore (hCertStore=0x6f7b10) returned 0x6f7b10 [0160.582] CertEnumCertificatesInStore (hCertStore=0x6f7b10, pPrevCertContext=0x0) returned 0x724ef0 [0160.582] CertDuplicateCertificateContext (pCertContext=0x724ef0) returned 0x724ef0 [0160.582] CertEnumCertificatesInStore (hCertStore=0x6f7b10, pPrevCertContext=0x724ef0) returned 0x724e50 [0160.583] CertDuplicateCertificateContext (pCertContext=0x724e50) returned 0x724e50 [0160.583] CertEnumCertificatesInStore (hCertStore=0x6f7b10, pPrevCertContext=0x724e50) returned 0x0 [0160.583] CertCloseStore (hCertStore=0x6f7b10, dwFlags=0x0) returned 1 [0160.583] CertFreeCertificateContext (pCertContext=0x724e50) returned 1 [0160.597] CertOpenStore (lpszStoreProvider=0x2, dwEncodingType=0x10001, hCryptProv=0x0, dwFlags=0x2204, pvPara=0x0) returned 0x6f7ed0 [0160.599] CertAddCRLLinkToStore (in: hCertStore=0x6f7ed0, pCrlContext=0x724ef0, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0160.601] CertAddCRLLinkToStore (in: hCertStore=0x6f7ed0, pCrlContext=0x724e50, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0160.607] CertGetCertificateChain (in: hChainEngine=0x0, pCertContext=0x724e50, pTime=0x19b454, hAdditionalStore=0x6f7ed0, pChainPara=0x19b394, dwFlags=0x0, pvReserved=0x0, ppChainContext=0x19b388 | out: ppChainContext=0x19b388) returned 1 [0160.622] CertDuplicateCertificateChain (pChainContext=0x51d8528) returned 0x51d8528 [0160.623] CertDuplicateCertificateContext (pCertContext=0x724e50) returned 0x724e50 [0160.623] CertDuplicateCertificateContext (pCertContext=0x724900) returned 0x724900 [0160.623] CertDuplicateCertificateContext (pCertContext=0x724cc0) returned 0x724cc0 [0160.623] CertFreeCertificateChain (pChainContext=0x51d8528) [0160.624] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x1, pChainContext=0x51d8528, pPolicyPara=0x19b534, pPolicyStatus=0x19b520 | out: pPolicyStatus=0x19b520) returned 1 [0160.624] SetLastError (dwErrCode=0x0) [0160.626] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x4, pChainContext=0x51d8528, pPolicyPara=0x19b5a0, pPolicyStatus=0x19b548 | out: pPolicyStatus=0x19b548) returned 1 [0160.632] CertFreeCertificateChain (pChainContext=0x51d8528) [0160.632] CertFreeCertificateContext (pCertContext=0x724e50) returned 1 [0160.640] CoTaskMemAlloc (cb=0x20c) returned 0x6b5378 [0160.640] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x6b5378, nSize=0x104 | out: lpBuffer="") returned 0x0 [0160.640] CoTaskMemFree (pv=0x6b5378) [0160.641] CoTaskMemAlloc (cb=0x20c) returned 0x6b59f0 [0160.641] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x6b59f0, nSize=0x104 | out: lpBuffer="") returned 0x0 [0160.641] CoTaskMemFree (pv=0x6b59f0) [0160.641] CoTaskMemAlloc (cb=0x20c) returned 0x6b5378 [0160.641] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x6b5378, nSize=0x104 | out: lpBuffer="") returned 0x0 [0160.641] CoTaskMemFree (pv=0x6b5378) [0160.641] CoTaskMemAlloc (cb=0x20c) returned 0x6b59f0 [0160.641] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x6b59f0, nSize=0x104 | out: lpBuffer="") returned 0x0 [0160.641] CoTaskMemFree (pv=0x6b59f0) [0160.643] EncryptMessage (in: phContext=0x27bb0d0, fQOP=0x0, pMessage=0x27c4b58, MessageSeqNo=0x0 | out: pMessage=0x27c4b58) returned 0x0 [0160.643] send (s=0x540, buf=0x27c3630*, len=90, flags=0) returned 90 [0160.645] setsockopt (s=0x540, level=65535, optname=4102, optval="\x98:", optlen=4) returned 0 [0160.647] recv (in: s=0x540, buf=0x27d0e3c, len=5, flags=0 | out: buf=0x27d0e3c*) returned 5 [0160.693] recv (in: s=0x540, buf=0x27d0e41, len=828, flags=0 | out: buf=0x27d0e41*) returned 828 [0160.693] DecryptMessage (in: phContext=0x27bb0d0, pMessage=0x27d4efc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x27d4efc, pfQOP=0x0) returned 0x0 [0160.709] setsockopt (s=0x540, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0160.723] recv (in: s=0x540, buf=0x27d0e3c, len=5, flags=0 | out: buf=0x27d0e3c*) returned 5 [0160.723] recv (in: s=0x540, buf=0x27d0e41, len=43, flags=0 | out: buf=0x27d0e41*) returned 43 [0160.724] DecryptMessage (in: phContext=0x27bb0d0, pMessage=0x27d8660, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x27d8660, pfQOP=0x0) returned 0x0 [0160.724] recv (in: s=0x540, buf=0x27d0e3c, len=5, flags=0 | out: buf=0x27d0e3c*) returned 5 [0160.724] recv (in: s=0x540, buf=0x27d0e41, len=29, flags=0 | out: buf=0x27d0e41*) returned 29 [0160.724] DecryptMessage (in: phContext=0x27bb0d0, pMessage=0x27d8780, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x27d8780, pfQOP=0x0) returned 0x0 [0160.725] SetEvent (hEvent=0x3a8) returned 1 [0160.744] CoTaskMemAlloc (cb=0x20c) returned 0x6b5378 [0160.745] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x6b5378 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0160.749] CoTaskMemFree (pv=0x6b5378) [0160.749] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19b838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0160.750] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windоws", nBufferLength=0x105, lpBuffer=0x19b8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windоws", lpFilePart=0x0) returned 0x35 [0160.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd6c) returned 1 [0160.750] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windоws" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windоws"), fInfoLevelId=0x0, lpFileInformation=0x19bde8 | out: lpFileInformation=0x19bde8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0160.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bd68) returned 1 [0160.750] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windоws", nBufferLength=0x105, lpBuffer=0x19b8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windоws", lpFilePart=0x0) returned 0x35 [0160.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bcfc) returned 1 [0160.751] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windоws" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windоws"), fInfoLevelId=0x0, lpFileInformation=0x19bd78 | out: lpFileInformation=0x19bd78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0160.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcf8) returned 1 [0160.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bcfc) returned 1 [0160.751] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windоws" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windоws"), fInfoLevelId=0x0, lpFileInformation=0x19bd78 | out: lpFileInformation=0x19bd78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0160.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcf8) returned 1 [0160.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bcfc) returned 1 [0160.751] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft"), fInfoLevelId=0x0, lpFileInformation=0x19bd78 | out: lpFileInformation=0x19bd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6078303, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0160.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcf8) returned 1 [0160.752] CreateDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windоws" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windоws"), lpSecurityAttributes=0x0) returned 1 [0160.891] CoTaskMemAlloc (cb=0x20c) returned 0x6b5378 [0160.891] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6b5378, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe")) returned 0x62 [0160.892] CoTaskMemFree (pv=0x6b5378) [0160.910] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe", nBufferLength=0x105, lpBuffer=0x19b8cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe", lpFilePart=0x0) returned 0x62 [0160.911] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe", nBufferLength=0x105, lpBuffer=0x19b87c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe", lpFilePart=0x0) returned 0x62 [0160.914] GetUserNameW (in: lpBuffer=0x19bbf8, pcbBuffer=0x19be70 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x19be70) returned 1 [0160.960] CoTaskMemAlloc (cb=0x804) returned 0x51de228 [0160.960] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x51de228, nSize=0x19be5c | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0x19be5c) returned 0x1 [0160.961] CoTaskMemFree (pv=0x51de228) [0160.961] GetUserNameW (in: lpBuffer=0x19bbf0, pcbBuffer=0x19be68 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x19be68) returned 1 [0161.146] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x648 [0161.148] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x638 [0161.156] SetEvent (hEvent=0x638) returned 1 [0161.157] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19b65c*=0x648, lpdwindex=0x19b47c | out: lpdwindex=0x19b47c) returned 0x0 [0162.094] CoGetContextToken (in: pToken=0x19b528 | out: pToken=0x19b528) returned 0x0 [0162.094] CoGetContextToken (in: pToken=0x19b488 | out: pToken=0x19b488) returned 0x0 [0162.094] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7b70, riid=0x19b558*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19b554 | out: ppvObject=0x19b554*=0x51d7b70) returned 0x0 [0162.095] WbemDefPath:IUnknown:AddRef (This=0x51d7b70) returned 0x3 [0162.095] WbemDefPath:IUnknown:Release (This=0x51d7b70) returned 0x2 [0162.097] WbemDefPath:IWbemPath:SetText (This=0x51d7b70, uMode=0x4, pszPath="//./root/cimv2") returned 0x0 [0162.098] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bddc | out: puCount=0x19bddc*=0x2) returned 0x0 [0162.098] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bdd8*=0x0, pszText=0x0 | out: puBuffLength=0x19bdd8*=0xf, pszText=0x0) returned 0x0 [0162.098] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bdd8*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bdd8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.292] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc84*=0x698, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0166.921] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0166.921] CoGetContextToken (in: pToken=0x19b9f0 | out: pToken=0x19b9f0) returned 0x0 [0166.921] IUnknown:QueryInterface (in: This=0x66f9c0, riid=0x6f12da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b9cc | out: ppvObject=0x19b9cc*=0x66f9d0) returned 0x0 [0166.921] CObjectContext::ContextCallback () returned 0x0 [0166.994] IUnknown:Release (This=0x66f9d0) returned 0x1 [0166.995] CoUnmarshalInterface (in: pStm=0x51e1030, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19ba3c | out: ppv=0x19ba3c*=0x717650) returned 0x0 [0166.995] CoMarshalInterface (pStm=0x51e1030, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x717650, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0166.996] WbemLocator:IUnknown:QueryInterface (in: This=0x717650, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b8dc | out: ppvObject=0x19b8dc*=0x717650) returned 0x0 [0166.996] WbemLocator:IUnknown:QueryInterface (in: This=0x717650, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b898 | out: ppvObject=0x19b898*=0x0) returned 0x80004002 [0166.997] WbemLocator:IUnknown:QueryInterface (in: This=0x717650, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b6b4 | out: ppvObject=0x19b6b4*=0x0) returned 0x80004002 [0166.997] WbemLocator:IUnknown:QueryInterface (in: This=0x717650, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b48c | out: ppvObject=0x19b48c*=0x0) returned 0x80004002 [0166.998] WbemLocator:IUnknown:AddRef (This=0x717650) returned 0x3 [0166.998] WbemLocator:IUnknown:QueryInterface (in: This=0x717650, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b1ec | out: ppvObject=0x19b1ec*=0x0) returned 0x80004002 [0166.998] WbemLocator:IUnknown:QueryInterface (in: This=0x717650, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19b19c | out: ppvObject=0x19b19c*=0x0) returned 0x80004002 [0166.998] WbemLocator:IUnknown:QueryInterface (in: This=0x717650, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b1a8 | out: ppvObject=0x19b1a8*=0x7175ac) returned 0x0 [0166.998] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x7175ac, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b1b0 | out: pCid=0x19b1b0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0166.998] WbemLocator:IUnknown:Release (This=0x7175ac) returned 0x3 [0166.998] CoGetContextToken (in: pToken=0x19b208 | out: pToken=0x19b208) returned 0x0 [0166.998] IUnknown:QueryInterface (in: This=0x66f908, riid=0x6f1138a4*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b1c4 | out: ppvObject=0x19b1c4*=0x66f914) returned 0x0 [0166.998] IComThreadingInfo:GetCurrentApartmentType (in: This=0x66f914, pAptType=0x19b1f4 | out: pAptType=0x19b1f4*=3) returned 0x0 [0166.998] IUnknown:Release (This=0x66f914) returned 0x0 [0166.998] CoGetObjectContext (in: riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x72cbc4 | out: ppv=0x72cbc4*=0x66f908) returned 0x0 [0166.999] CoGetContextToken (in: pToken=0x19b610 | out: pToken=0x19b610) returned 0x0 [0166.999] WbemLocator:IUnknown:QueryInterface (in: This=0x717650, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b69c | out: ppvObject=0x19b69c*=0x717634) returned 0x0 [0166.999] WbemLocator:IRpcOptions:Query (in: This=0x717634, pPrx=0x717650, dwProperty=2, pdwValue=0x19b6a8 | out: pdwValue=0x19b6a8) returned 0x0 [0166.999] WbemLocator:IUnknown:Release (This=0x717634) returned 0x3 [0166.999] WbemLocator:IUnknown:Release (This=0x717650) returned 0x2 [0166.999] WbemLocator:IUnknown:Release (This=0x717650) returned 0x1 [0166.999] CoGetContextToken (in: pToken=0x19b988 | out: pToken=0x19b988) returned 0x0 [0166.999] WbemLocator:IUnknown:AddRef (This=0x717650) returned 0x2 [0166.999] WbemLocator:IUnknown:QueryInterface (in: This=0x717650, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bc3c | out: ppvObject=0x19bc3c*=0x71762c) returned 0x0 [0166.999] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x71762c, pProxy=0x717650, pAuthnSvc=0x19bc8c, pAuthzSvc=0x19bc88, pServerPrincName=0x19bc80, pAuthnLevel=0x19bc84, pImpLevel=0x19bc74, pAuthInfo=0x19bc78, pCapabilites=0x19bc7c | out: pAuthnSvc=0x19bc8c*=0xa, pAuthzSvc=0x19bc88*=0x0, pServerPrincName=0x19bc80, pAuthnLevel=0x19bc84*=0x6, pImpLevel=0x19bc74*=0x2, pAuthInfo=0x19bc78, pCapabilites=0x19bc7c*=0x1) returned 0x0 [0166.999] WbemLocator:IUnknown:Release (This=0x71762c) returned 0x2 [0166.999] WbemLocator:IUnknown:QueryInterface (in: This=0x717650, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bc30 | out: ppvObject=0x19bc30*=0x717650) returned 0x0 [0167.000] WbemLocator:IUnknown:QueryInterface (in: This=0x717650, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bc1c | out: ppvObject=0x19bc1c*=0x71762c) returned 0x0 [0167.000] WbemLocator:IClientSecurity:SetBlanket (This=0x71762c, pProxy=0x717650, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0167.000] WbemLocator:IUnknown:Release (This=0x71762c) returned 0x3 [0167.000] WbemLocator:IUnknown:Release (This=0x717650) returned 0x2 [0167.000] CoTaskMemFree (pv=0x51f0c30) [0167.000] WbemLocator:IUnknown:Release (This=0x717650) returned 0x1 [0167.000] SysStringLen (param_1=0x0) returned 0x0 [0167.000] CoGetContextToken (in: pToken=0x19bbf8 | out: pToken=0x19bbf8) returned 0x0 [0167.000] CoGetContextToken (in: pToken=0x19bb58 | out: pToken=0x19bb58) returned 0x0 [0167.000] WbemLocator:IUnknown:QueryInterface (in: This=0x717650, riid=0x19bc28*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19bc24 | out: ppvObject=0x19bc24*=0x725630) returned 0x0 [0167.001] WbemLocator:IUnknown:AddRef (This=0x725630) returned 0x3 [0167.001] WbemLocator:IUnknown:Release (This=0x725630) returned 0x2 [0167.001] CoGetContextToken (in: pToken=0x19bbb8 | out: pToken=0x19bbb8) returned 0x0 [0167.001] WbemLocator:IUnknown:AddRef (This=0x725630) returned 0x3 [0167.001] WbemLocator:IUnknown:QueryInterface (in: This=0x725630, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bc3c | out: ppvObject=0x19bc3c*=0x71762c) returned 0x0 [0167.001] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x71762c, pProxy=0x725630, pAuthnSvc=0x19bc8c, pAuthzSvc=0x19bc88, pServerPrincName=0x19bc80, pAuthnLevel=0x19bc84, pImpLevel=0x19bc74, pAuthInfo=0x19bc78, pCapabilites=0x19bc7c | out: pAuthnSvc=0x19bc8c*=0xa, pAuthzSvc=0x19bc88*=0x0, pServerPrincName=0x19bc80, pAuthnLevel=0x19bc84*=0x6, pImpLevel=0x19bc74*=0x2, pAuthInfo=0x19bc78, pCapabilites=0x19bc7c*=0x1) returned 0x0 [0167.001] WbemLocator:IUnknown:Release (This=0x71762c) returned 0x3 [0167.001] WbemLocator:IUnknown:QueryInterface (in: This=0x725630, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bc30 | out: ppvObject=0x19bc30*=0x717650) returned 0x0 [0167.002] WbemLocator:IUnknown:QueryInterface (in: This=0x725630, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bc1c | out: ppvObject=0x19bc1c*=0x71762c) returned 0x0 [0167.002] WbemLocator:IClientSecurity:SetBlanket (This=0x71762c, pProxy=0x725630, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0167.002] WbemLocator:IUnknown:Release (This=0x71762c) returned 0x4 [0167.002] WbemLocator:IUnknown:Release (This=0x717650) returned 0x3 [0167.002] CoTaskMemFree (pv=0x51f0b40) [0167.002] WbemLocator:IUnknown:Release (This=0x725630) returned 0x2 [0167.002] SysStringLen (param_1=0x0) returned 0x0 [0167.002] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0167.002] WbemLocator:IUnknown:AddRef (This=0x725630) returned 0x3 [0167.002] IWbemServices:ExecQuery (in: This=0x725630, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_DiskDrive", lFlags=16, pCtx=0x0, ppEnum=0x19bd4c | out: ppEnum=0x19bd4c*=0x6d2718) returned 0x0 [0167.009] IUnknown:QueryInterface (in: This=0x6d2718, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bba8 | out: ppvObject=0x19bba8*=0x6d271c) returned 0x0 [0167.009] IClientSecurity:QueryBlanket (in: This=0x6d271c, pProxy=0x6d2718, pAuthnSvc=0x19bbf8, pAuthzSvc=0x19bbf4, pServerPrincName=0x19bbec, pAuthnLevel=0x19bbf0, pImpLevel=0x19bbe0, pAuthInfo=0x19bbe4, pCapabilites=0x19bbe8 | out: pAuthnSvc=0x19bbf8*=0xa, pAuthzSvc=0x19bbf4*=0x0, pServerPrincName=0x19bbec, pAuthnLevel=0x19bbf0*=0x6, pImpLevel=0x19bbe0*=0x2, pAuthInfo=0x19bbe4, pCapabilites=0x19bbe8*=0x1) returned 0x0 [0167.010] IUnknown:Release (This=0x6d271c) returned 0x1 [0167.010] IUnknown:QueryInterface (in: This=0x6d2718, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb9c | out: ppvObject=0x19bb9c*=0x717450) returned 0x0 [0167.010] IUnknown:QueryInterface (in: This=0x6d2718, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb88 | out: ppvObject=0x19bb88*=0x6d271c) returned 0x0 [0167.010] IClientSecurity:SetBlanket (This=0x6d271c, pProxy=0x6d2718, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0167.150] IUnknown:Release (This=0x6d271c) returned 0x2 [0167.150] WbemLocator:IUnknown:Release (This=0x717450) returned 0x1 [0167.150] CoTaskMemFree (pv=0x51f0bd0) [0167.151] IUnknown:QueryInterface (in: This=0x6d2718, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b794 | out: ppvObject=0x19b794*=0x717450) returned 0x0 [0167.151] WbemLocator:IUnknown:QueryInterface (in: This=0x717450, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b750 | out: ppvObject=0x19b750*=0x0) returned 0x80004002 [0167.166] WbemLocator:IUnknown:QueryInterface (in: This=0x717450, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b56c | out: ppvObject=0x19b56c*=0x0) returned 0x80004002 [0167.167] IUnknown:QueryInterface (in: This=0x6d2718, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b344 | out: ppvObject=0x19b344*=0x0) returned 0x80004002 [0167.167] WbemLocator:IUnknown:AddRef (This=0x717450) returned 0x3 [0167.167] WbemLocator:IUnknown:QueryInterface (in: This=0x717450, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b0a4 | out: ppvObject=0x19b0a4*=0x0) returned 0x80004002 [0167.168] WbemLocator:IUnknown:QueryInterface (in: This=0x717450, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19b054 | out: ppvObject=0x19b054*=0x0) returned 0x80004002 [0167.168] WbemLocator:IUnknown:QueryInterface (in: This=0x717450, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b060 | out: ppvObject=0x19b060*=0x7173ac) returned 0x0 [0167.168] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x7173ac, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b068 | out: pCid=0x19b068*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0167.168] WbemLocator:IUnknown:Release (This=0x7173ac) returned 0x3 [0167.168] CoGetContextToken (in: pToken=0x19b0c0 | out: pToken=0x19b0c0) returned 0x0 [0167.168] CoGetContextToken (in: pToken=0x19b4c8 | out: pToken=0x19b4c8) returned 0x0 [0167.168] WbemLocator:IUnknown:QueryInterface (in: This=0x717450, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b554 | out: ppvObject=0x19b554*=0x717434) returned 0x0 [0167.168] WbemLocator:IRpcOptions:Query (in: This=0x717434, pPrx=0x717450, dwProperty=2, pdwValue=0x19b560 | out: pdwValue=0x19b560) returned 0x80004002 [0167.168] WbemLocator:IUnknown:Release (This=0x717434) returned 0x3 [0167.168] WbemLocator:IUnknown:Release (This=0x717450) returned 0x2 [0167.168] CoGetContextToken (in: pToken=0x19baa8 | out: pToken=0x19baa8) returned 0x0 [0167.168] CoGetContextToken (in: pToken=0x19ba08 | out: pToken=0x19ba08) returned 0x0 [0167.168] WbemLocator:IUnknown:QueryInterface (in: This=0x717450, riid=0x19bad8*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19bad4 | out: ppvObject=0x19bad4*=0x6d2718) returned 0x0 [0167.168] IUnknown:AddRef (This=0x6d2718) returned 0x4 [0167.168] IUnknown:Release (This=0x6d2718) returned 0x3 [0167.168] IUnknown:Release (This=0x6d2718) returned 0x2 [0167.168] WbemLocator:IUnknown:Release (This=0x725630) returned 0x2 [0167.169] SysStringLen (param_1=0x0) returned 0x0 [0167.169] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0167.169] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0167.169] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0167.169] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0167.169] IUnknown:AddRef (This=0x6d2718) returned 0x3 [0167.169] IEnumWbemClassObject:Clone (in: This=0x6d2718, ppEnum=0x19bda4 | out: ppEnum=0x19bda4*=0x6d1c28) returned 0x0 [0167.170] IUnknown:QueryInterface (in: This=0x6d1c28, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bc60 | out: ppvObject=0x19bc60*=0x6d1c2c) returned 0x0 [0167.171] IClientSecurity:QueryBlanket (in: This=0x6d1c2c, pProxy=0x6d1c28, pAuthnSvc=0x19bcb0, pAuthzSvc=0x19bcac, pServerPrincName=0x19bca4, pAuthnLevel=0x19bca8, pImpLevel=0x19bc98, pAuthInfo=0x19bc9c, pCapabilites=0x19bca0 | out: pAuthnSvc=0x19bcb0*=0xa, pAuthzSvc=0x19bcac*=0x0, pServerPrincName=0x19bca4, pAuthnLevel=0x19bca8*=0x6, pImpLevel=0x19bc98*=0x2, pAuthInfo=0x19bc9c, pCapabilites=0x19bca0*=0x1) returned 0x0 [0167.171] IUnknown:Release (This=0x6d1c2c) returned 0x1 [0167.171] IUnknown:QueryInterface (in: This=0x6d1c28, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bc54 | out: ppvObject=0x19bc54*=0x717950) returned 0x0 [0167.171] IUnknown:QueryInterface (in: This=0x6d1c28, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bc40 | out: ppvObject=0x19bc40*=0x6d1c2c) returned 0x0 [0167.171] IClientSecurity:SetBlanket (This=0x6d1c2c, pProxy=0x6d1c28, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0167.173] IUnknown:Release (This=0x6d1c2c) returned 0x2 [0167.173] WbemLocator:IUnknown:Release (This=0x717950) returned 0x1 [0167.173] CoTaskMemFree (pv=0x51f0bd0) [0167.173] IUnknown:QueryInterface (in: This=0x6d1c28, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b83c | out: ppvObject=0x19b83c*=0x717950) returned 0x0 [0167.173] WbemLocator:IUnknown:QueryInterface (in: This=0x717950, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b7f8 | out: ppvObject=0x19b7f8*=0x0) returned 0x80004002 [0167.174] WbemLocator:IUnknown:QueryInterface (in: This=0x717950, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b614 | out: ppvObject=0x19b614*=0x0) returned 0x80004002 [0167.174] IUnknown:QueryInterface (in: This=0x6d1c28, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b3ec | out: ppvObject=0x19b3ec*=0x0) returned 0x80004002 [0167.175] WbemLocator:IUnknown:AddRef (This=0x717950) returned 0x3 [0167.175] WbemLocator:IUnknown:QueryInterface (in: This=0x717950, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b14c | out: ppvObject=0x19b14c*=0x0) returned 0x80004002 [0167.175] WbemLocator:IUnknown:QueryInterface (in: This=0x717950, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0167.175] WbemLocator:IUnknown:QueryInterface (in: This=0x717950, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b108 | out: ppvObject=0x19b108*=0x7178ac) returned 0x0 [0167.175] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x7178ac, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b110 | out: pCid=0x19b110*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0167.175] WbemLocator:IUnknown:Release (This=0x7178ac) returned 0x3 [0167.175] CoGetContextToken (in: pToken=0x19b168 | out: pToken=0x19b168) returned 0x0 [0167.176] CoGetContextToken (in: pToken=0x19b570 | out: pToken=0x19b570) returned 0x0 [0167.176] WbemLocator:IUnknown:QueryInterface (in: This=0x717950, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b5fc | out: ppvObject=0x19b5fc*=0x717934) returned 0x0 [0167.176] WbemLocator:IRpcOptions:Query (in: This=0x717934, pPrx=0x717950, dwProperty=2, pdwValue=0x19b608 | out: pdwValue=0x19b608) returned 0x80004002 [0167.176] WbemLocator:IUnknown:Release (This=0x717934) returned 0x3 [0167.176] WbemLocator:IUnknown:Release (This=0x717950) returned 0x2 [0167.176] CoGetContextToken (in: pToken=0x19bb50 | out: pToken=0x19bb50) returned 0x0 [0167.176] CoGetContextToken (in: pToken=0x19bab0 | out: pToken=0x19bab0) returned 0x0 [0167.176] WbemLocator:IUnknown:QueryInterface (in: This=0x717950, riid=0x19bb80*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19bb7c | out: ppvObject=0x19bb7c*=0x6d1c28) returned 0x0 [0167.176] IUnknown:AddRef (This=0x6d1c28) returned 0x4 [0167.176] IUnknown:Release (This=0x6d1c28) returned 0x3 [0167.176] IUnknown:Release (This=0x6d1c28) returned 0x2 [0167.176] IUnknown:Release (This=0x6d2718) returned 0x2 [0167.176] SysStringLen (param_1=0x0) returned 0x0 [0167.177] IEnumWbemClassObject:Reset (This=0x6d1c28) returned 0x0 [0167.216] CoTaskMemAlloc (cb=0x4) returned 0x51debc8 [0167.216] IEnumWbemClassObject:Next (in: This=0x6d1c28, lTimeout=-1, uCount=0x1, apObjects=0x51debc8, puReturned=0x27e03b0 | out: apObjects=0x51debc8*=0x51cfff0, puReturned=0x27e03b0*=0x1) returned 0x0 [0167.222] IUnknown:QueryInterface (in: This=0x51cfff0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b400 | out: ppvObject=0x19b400*=0x51cfff0) returned 0x0 [0167.222] IUnknown:QueryInterface (in: This=0x51cfff0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b3bc | out: ppvObject=0x19b3bc*=0x0) returned 0x80004002 [0167.222] IUnknown:QueryInterface (in: This=0x51cfff0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1dc | out: ppvObject=0x19b1dc*=0x0) returned 0x80004002 [0167.222] IUnknown:QueryInterface (in: This=0x51cfff0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19afb4 | out: ppvObject=0x19afb4*=0x0) returned 0x80004002 [0167.223] IUnknown:AddRef (This=0x51cfff0) returned 0x3 [0167.223] IUnknown:QueryInterface (in: This=0x51cfff0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ad14 | out: ppvObject=0x19ad14*=0x0) returned 0x80004002 [0167.223] IUnknown:QueryInterface (in: This=0x51cfff0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19acc4 | out: ppvObject=0x19acc4*=0x0) returned 0x80004002 [0167.223] IUnknown:QueryInterface (in: This=0x51cfff0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19acd0 | out: ppvObject=0x19acd0*=0x51cfff4) returned 0x0 [0167.223] IMarshal:GetUnmarshalClass (in: This=0x51cfff4, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19acd8 | out: pCid=0x19acd8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0167.223] IUnknown:Release (This=0x51cfff4) returned 0x3 [0167.223] CoGetContextToken (in: pToken=0x19ad30 | out: pToken=0x19ad30) returned 0x0 [0167.223] CoGetContextToken (in: pToken=0x19b138 | out: pToken=0x19b138) returned 0x0 [0167.223] IUnknown:QueryInterface (in: This=0x51cfff0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b1c4 | out: ppvObject=0x19b1c4*=0x0) returned 0x80004002 [0167.223] IUnknown:Release (This=0x51cfff0) returned 0x2 [0167.223] CoGetContextToken (in: pToken=0x19b710 | out: pToken=0x19b710) returned 0x0 [0167.223] CoGetContextToken (in: pToken=0x19b670 | out: pToken=0x19b670) returned 0x0 [0167.223] IUnknown:QueryInterface (in: This=0x51cfff0, riid=0x19b740*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b73c | out: ppvObject=0x19b73c*=0x51cfff0) returned 0x0 [0167.223] IUnknown:AddRef (This=0x51cfff0) returned 0x4 [0167.223] IUnknown:Release (This=0x51cfff0) returned 0x3 [0167.223] IUnknown:Release (This=0x51cfff0) returned 0x2 [0167.223] CoTaskMemFree (pv=0x51debc8) [0167.223] CoGetContextToken (in: pToken=0x19ba80 | out: pToken=0x19ba80) returned 0x0 [0167.223] IUnknown:AddRef (This=0x51cfff0) returned 0x3 [0167.225] IWbemClassObject:Get (in: This=0x51cfff0, wszName="__GENUS", lFlags=0, pVal=0x19bd94*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19be14*=0, plFlavor=0x19be10*=0 | out: pVal=0x19bd94*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19be14*=3, plFlavor=0x19be10*=64) returned 0x0 [0167.268] IWbemClassObject:Get (in: This=0x51cfff0, wszName="__PATH", lFlags=0, pVal=0x19bd78*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdfc*=0, plFlavor=0x19bdf8*=0 | out: pVal=0x19bd78*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_DiskDrive.DeviceID=\"\\\\\\\\.\\\\PHYSICALDRIVE0\"", varVal2=0x0), pType=0x19bdfc*=8, plFlavor=0x19bdf8*=64) returned 0x0 [0167.270] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_DiskDrive.DeviceID=\"\\\\\\\\.\\\\PHYSICALDRIVE0\"") returned 0x88 [0167.270] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_DiskDrive.DeviceID=\"\\\\\\\\.\\\\PHYSICALDRIVE0\"") returned 0x88 [0167.270] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x6ec [0167.270] SetEvent (hEvent=0x638) returned 1 [0167.270] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd50*=0x6ec, lpdwindex=0x19bb6c | out: lpdwindex=0x19bb6c) returned 0x0 [0167.274] CoGetContextToken (in: pToken=0x19bc20 | out: pToken=0x19bc20) returned 0x0 [0167.274] CoGetContextToken (in: pToken=0x19bb80 | out: pToken=0x19bb80) returned 0x0 [0167.274] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7da0, riid=0x19bc50*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc4c | out: ppvObject=0x19bc4c*=0x51d7da0) returned 0x0 [0167.274] WbemDefPath:IUnknown:AddRef (This=0x51d7da0) returned 0x3 [0167.274] WbemDefPath:IUnknown:Release (This=0x51d7da0) returned 0x2 [0167.274] WbemDefPath:IWbemPath:SetText (This=0x51d7da0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_DiskDrive.DeviceID=\"\\\\\\\\.\\\\PHYSICALDRIVE0\"") returned 0x0 [0167.274] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bdd0 | out: puCount=0x19bdd0*=0x2) returned 0x0 [0167.274] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bdcc*=0x0, pszText=0x0 | out: puBuffLength=0x19bdcc*=0xf, pszText=0x0) returned 0x0 [0167.274] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bdcc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bdcc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0167.275] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd9c | out: puCount=0x19bd9c*=0x2) returned 0x0 [0167.275] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd98*=0x0, pszText=0x0 | out: puBuffLength=0x19bd98*=0xf, pszText=0x0) returned 0x0 [0167.275] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd98*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd98*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0167.275] IWbemClassObject:Get (in: This=0x51cfff0, wszName="SerialNumber", lFlags=0, pVal=0x19bd98*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e0cac*=0, plFlavor=0x27e0cb0*=0 | out: pVal=0x19bd98*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="P8WFLPVVE6G", varVal2=0x0), pType=0x27e0cac*=8, plFlavor=0x27e0cb0*=0) returned 0x0 [0167.275] SysStringByteLen (bstr="P8WFLPVVE6G") returned 0x16 [0167.275] SysStringByteLen (bstr="P8WFLPVVE6G") returned 0x16 [0167.275] IWbemClassObject:Get (in: This=0x51cfff0, wszName="SerialNumber", lFlags=0, pVal=0x19bda0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27e0cac*=8, plFlavor=0x27e0cb0*=0 | out: pVal=0x19bda0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="P8WFLPVVE6G", varVal2=0x0), pType=0x27e0cac*=8, plFlavor=0x27e0cb0*=0) returned 0x0 [0167.275] SysStringByteLen (bstr="P8WFLPVVE6G") returned 0x16 [0167.275] SysStringByteLen (bstr="P8WFLPVVE6G") returned 0x16 [0167.317] CoGetContextToken (in: pToken=0x19bcc8 | out: pToken=0x19bcc8) returned 0x0 [0167.317] WbemLocator:IUnknown:Release (This=0x717950) returned 0x1 [0167.317] IUnknown:Release (This=0x6d1c28) returned 0x0 [0167.318] CoGetContextToken (in: pToken=0x19bcc8 | out: pToken=0x19bcc8) returned 0x0 [0167.319] WbemLocator:IUnknown:Release (This=0x717450) returned 0x1 [0167.319] IUnknown:Release (This=0x6d2718) returned 0x0 [0167.370] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x19be38 | out: pfEnabled=0x19be38) returned 0x0 [0169.445] GdiplusStartup (in: token=0x1f65ad8, input=0x19b2d8, output=0x19b328 | out: token=0x1f65ad8, output=0x19b328) returned 0x0 [0170.348] GdipCreateFromHWND (hwnd=0x0, graphics=0x19bdd4) returned 0x0 [0170.363] GdipGetDC (graphics=0x60e1f08, hdc=0x19bde4) returned 0x0 [0170.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gdi32", cchWideChar=5, lpMultiByteStr=0x19bd84, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gdi32'÷\x05ÿgH{(ú\x01o\x80Â\x19", lpUsedDefaultChar=0x0) returned 5 [0170.385] LoadLibraryA (lpLibFileName="gdi32") returned 0x74ab0000 [0170.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetDeviceCaps", cchWideChar=13, lpMultiByteStr=0x19bd7c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetDeviceCaps(÷\x05ÿgH{(ú\x01o\x80Â\x19", lpUsedDefaultChar=0x0) returned 13 [0170.406] GetProcAddress (hModule=0x74ab0000, lpProcName="GetDeviceCaps") returned 0x74b30fe0 [0170.468] GetDeviceCaps (hdc=0xc0100ae, index=10) returned 900 [0170.468] GetDeviceCaps (hdc=0xc0100ae, index=117) returned 900 [0170.469] GdipReleaseDC (graphics=0x60e1f08, hdc=0xc0100ae) returned 0x0 [0170.470] GdipDeleteGraphics (graphics=0x60e1f08) returned 0x0 [0170.471] GetSystemMetrics (nIndex=80) returned 1 [0170.478] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x4b14bde, dwData=0x0) returned 1 [0170.484] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19bb94 | out: lpmi=0x19bb94) returned 1 [0170.485] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x6a010685 [0170.490] GetDeviceCaps (hdc=0x6a010685, index=12) returned 32 [0170.491] GetDeviceCaps (hdc=0x6a010685, index=14) returned 1 [0170.492] DeleteDC (hdc=0x6a010685) returned 1 [0170.497] GetProcessWindowStation () returned 0x9c [0170.497] GetUserObjectInformationA (in: hObj=0x9c, nIndex=1, pvInfo=0x27f7a64, nLength=0xc, lpnLengthNeeded=0x19bd74 | out: pvInfo=0x27f7a64, lpnLengthNeeded=0x19bd74) returned 1 [0170.499] SetConsoleCtrlHandler (HandlerRoutine=0x4b14c06, Add=1) returned 1 [0170.500] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0170.501] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0170.501] GetClassInfoW (in: hInstance=0x400000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.134c08f.0", lpWndClass=0x27f7ac8 | out: lpWndClass=0x27f7ac8) returned 0 [0170.504] CoTaskMemAlloc (cb=0x58) returned 0x6e9ed0 [0170.505] RegisterClassW (lpWndClass=0x19bcc4) returned 0xc1db [0170.505] CoTaskMemFree (pv=0x6e9ed0) [0170.505] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.134c08f.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.134c08f.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x50278 [0170.506] NtdllDefWindowProc_W (hWnd=0x50278, Msg=0x81, wParam=0x0, lParam=0x19b800) returned 0x1 [0170.509] NtdllDefWindowProc_W (hWnd=0x50278, Msg=0x83, wParam=0x0, lParam=0x19b7ec) returned 0x0 [0170.509] NtdllDefWindowProc_W (hWnd=0x50278, Msg=0x1, wParam=0x0, lParam=0x19b800) returned 0x0 [0170.510] NtdllDefWindowProc_W (hWnd=0x50278, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0170.510] NtdllDefWindowProc_W (hWnd=0x50278, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0170.792] CoCreateGuid (in: pguid=0x19ae90 | out: pguid=0x19ae90*(Data1=0x4a2c4e95, Data2=0x596, Data3=0x4973, Data4=([0]=0x8c, [1]=0xa6, [2]=0xe1, [3]=0x49, [4]=0x4e, [5]=0xae, [6]=0xd4, [7]=0xcf))) returned 0x0 [0170.894] GetCurrentProcess () returned 0xffffffff [0170.894] GetCurrentThread () returned 0xfffffffe [0170.894] GetCurrentProcess () returned 0xffffffff [0170.894] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x19be2c, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x19be2c*=0x718) returned 1 [0170.894] GetCurrentThreadId () returned 0x11b8 [0170.895] OleInitialize (pvReserved=0x0) returned 0x1 [0170.895] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0170.904] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76720000 [0170.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="IsWow64Process", cchWideChar=14, lpMultiByteStr=0x19bdd8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IsWow64Process\x08nÿgH{(ú\x01o\x80Â\x19", lpUsedDefaultChar=0x0) returned 14 [0170.904] GetProcAddress (hModule=0x76720000, lpProcName="IsWow64Process") returned 0x76739f10 [0170.904] GetCurrentProcess () returned 0xffffffff [0170.905] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x19be38 | out: Wow64Process=0x19be38*=1) returned 1 [0170.911] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bdd4 | out: phkResult=0x19bdd4*=0x71c) returned 0x0 [0170.911] RegQueryValueExW (in: hKey=0x71c, lpValueName="ProductName", lpReserved=0x0, lpType=0x19bdf4, lpData=0x0, lpcbData=0x19bdf0*=0x0 | out: lpType=0x19bdf4*=0x1, lpData=0x0, lpcbData=0x19bdf0*=0x1e) returned 0x0 [0170.911] RegQueryValueExW (in: hKey=0x71c, lpValueName="ProductName", lpReserved=0x0, lpType=0x19bdf4, lpData=0x2870aac, lpcbData=0x19bdf0*=0x1e | out: lpType=0x19bdf4*=0x1, lpData="Windows 10 Pro", lpcbData=0x19bdf0*=0x1e) returned 0x0 [0170.911] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bdd4 | out: phkResult=0x19bdd4*=0x720) returned 0x0 [0170.911] RegQueryValueExW (in: hKey=0x720, lpValueName="CSDVersion", lpReserved=0x0, lpType=0x19bdf4, lpData=0x0, lpcbData=0x19bdf0*=0x0 | out: lpType=0x19bdf4*=0x0, lpData=0x0, lpcbData=0x19bdf0*=0x0) returned 0x2 [0170.998] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0170.998] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Battle.net", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Battle.net") returned 0x2f [0171.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.006] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Battle.net", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Battle.net", lpFilePart=0x0) returned 0x2e [0171.007] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Battle.net\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\battle.net\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.013] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.013] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Chromium\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data") returned 0x37 [0171.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.013] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data", lpFilePart=0x0) returned 0x36 [0171.013] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.015] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.015] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Google\\Chrome\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x3c [0171.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.016] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data", lpFilePart=0x0) returned 0x3b [0171.016] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.018] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.018] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Google(x86)\\Chrome\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google(x86)\\Chrome\\User Data") returned 0x41 [0171.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.018] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google(x86)\\Chrome\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google(x86)\\Chrome\\User Data", lpFilePart=0x0) returned 0x40 [0171.018] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google(x86)\\Chrome\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google(x86)\\chrome\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.020] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.021] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Opera Software\\", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\") returned 0x36 [0171.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.021] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\", lpFilePart=0x0) returned 0x35 [0171.021] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.023] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.023] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data") returned 0x45 [0171.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.024] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data", lpFilePart=0x0) returned 0x44 [0171.024] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\maplestudio\\chromeplus\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.026] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.026] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Iridium\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data") returned 0x36 [0171.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.026] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data", lpFilePart=0x0) returned 0x35 [0171.026] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\iridium\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.028] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.028] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\7Star\\7Star\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data") returned 0x3a [0171.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.029] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data", lpFilePart=0x0) returned 0x39 [0171.029] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.030] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.031] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\CentBrowser\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data") returned 0x3a [0171.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.031] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data", lpFilePart=0x0) returned 0x39 [0171.031] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.033] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.033] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Chedot\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data") returned 0x35 [0171.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.033] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data", lpFilePart=0x0) returned 0x34 [0171.034] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.036] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.036] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Vivaldi\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data") returned 0x36 [0171.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.037] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data", lpFilePart=0x0) returned 0x35 [0171.037] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.039] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.039] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Kometa\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data") returned 0x35 [0171.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.039] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data", lpFilePart=0x0) returned 0x34 [0171.039] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\kometa\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.041] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.041] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Elements Browser\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data") returned 0x3f [0171.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.042] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data", lpFilePart=0x0) returned 0x3e [0171.042] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\elements browser\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.044] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.044] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Epic Privacy Browser\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data") returned 0x43 [0171.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.044] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data", lpFilePart=0x0) returned 0x42 [0171.044] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.046] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.046] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\uCozMedia\\Uran\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data") returned 0x3d [0171.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.047] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data", lpFilePart=0x0) returned 0x3c [0171.047] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\ucozmedia\\uran\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.049] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.049] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer") returned 0x58 [0171.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.049] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer", lpFilePart=0x0) returned 0x57 [0171.050] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\fenrir inc\\sleipnir5\\setting\\modules\\chromiumviewer\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.091] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.092] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data") returned 0x43 [0171.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.092] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data", lpFilePart=0x0) returned 0x42 [0171.092] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\catalinagroup\\citrio\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.094] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.094] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Coowon\\Coowon\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data") returned 0x3c [0171.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.094] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data", lpFilePart=0x0) returned 0x3b [0171.112] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coowon\\coowon\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.116] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.116] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\liebao\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data") returned 0x35 [0171.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.116] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data", lpFilePart=0x0) returned 0x34 [0171.116] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\liebao\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.118] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.118] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\QIP Surf\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data") returned 0x37 [0171.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.118] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data", lpFilePart=0x0) returned 0x36 [0171.118] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\qip surf\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.120] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.120] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Orbitum\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data") returned 0x36 [0171.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.120] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data", lpFilePart=0x0) returned 0x35 [0171.120] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\orbitum\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.122] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.122] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Comodo\\Dragon\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data") returned 0x3c [0171.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.122] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data", lpFilePart=0x0) returned 0x3b [0171.122] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.124] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.124] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Amigo\\User\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User\\User Data") returned 0x39 [0171.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.124] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User\\User Data", lpFilePart=0x0) returned 0x38 [0171.124] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.126] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.126] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Torch\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data") returned 0x34 [0171.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.126] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data", lpFilePart=0x0) returned 0x33 [0171.126] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.127] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.127] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Yandex\\YandexBrowser\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data") returned 0x43 [0171.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.128] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data", lpFilePart=0x0) returned 0x42 [0171.128] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\yandex\\yandexbrowser\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.130] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.130] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Comodo\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\User Data") returned 0x35 [0171.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.130] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\User Data", lpFilePart=0x0) returned 0x34 [0171.130] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.132] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.132] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\360Browser\\Browser\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data") returned 0x41 [0171.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.132] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data", lpFilePart=0x0) returned 0x40 [0171.132] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\360browser\\browser\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.133] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.134] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Maxthon3\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon3\\User Data") returned 0x37 [0171.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.134] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon3\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon3\\User Data", lpFilePart=0x0) returned 0x36 [0171.134] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon3\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\maxthon3\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.135] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.135] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\K-Melon\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\K-Melon\\User Data") returned 0x36 [0171.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.136] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\K-Melon\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\K-Melon\\User Data", lpFilePart=0x0) returned 0x35 [0171.136] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\K-Melon\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\k-melon\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.137] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.137] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Sputnik\\Sputnik\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data") returned 0x3e [0171.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.138] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data", lpFilePart=0x0) returned 0x3d [0171.138] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\sputnik\\sputnik\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.139] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.139] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Nichrome\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data") returned 0x37 [0171.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.140] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data", lpFilePart=0x0) returned 0x36 [0171.140] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\nichrome\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.141] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.141] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\CocCoc\\Browser\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data") returned 0x3d [0171.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.142] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data", lpFilePart=0x0) returned 0x3c [0171.142] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.143] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.143] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Uran\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Uran\\User Data") returned 0x33 [0171.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.144] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Uran\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Uran\\User Data", lpFilePart=0x0) returned 0x32 [0171.144] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Uran\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\uran\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.145] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.145] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Chromodo\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromodo\\User Data") returned 0x37 [0171.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.146] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromodo\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromodo\\User Data", lpFilePart=0x0) returned 0x36 [0171.146] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromodo\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromodo\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.147] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.147] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Mail.Ru\\Atom\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mail.Ru\\Atom\\User Data") returned 0x3b [0171.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.148] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mail.Ru\\Atom\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mail.Ru\\Atom\\User Data", lpFilePart=0x0) returned 0x3a [0171.148] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mail.Ru\\Atom\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\mail.ru\\atom\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.150] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.150] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data") returned 0x4a [0171.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.150] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data", lpFilePart=0x0) returned 0x49 [0171.150] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\bravesoftware\\brave-browser\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.152] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.152] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Microsoft\\Edge\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data") returned 0x3d [0171.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.152] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data", lpFilePart=0x0) returned 0x3c [0171.152] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.154] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.154] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\NVIDIA Corporation\\NVIDIA GeForce Experience", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NVIDIA Corporation\\NVIDIA GeForce Experience") returned 0x51 [0171.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.155] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NVIDIA Corporation\\NVIDIA GeForce Experience", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NVIDIA Corporation\\NVIDIA GeForce Experience", lpFilePart=0x0) returned 0x50 [0171.155] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NVIDIA Corporation\\NVIDIA GeForce Experience\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\nvidia corporation\\nvidia geforce experience\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.156] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.156] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Steam", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Steam") returned 0x2a [0171.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.157] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Steam", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Steam", lpFilePart=0x0) returned 0x29 [0171.157] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Steam\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\steam\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.158] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.158] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\CryptoTab Browser\\User Data", lpDst=0x19bbdc, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data") returned 0x40 [0171.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc7c) returned 1 [0171.159] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19b73c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data", lpFilePart=0x0) returned 0x3f [0171.159] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\cryptotab browser\\user data\\*"), lpFindFileData=0x19b9a4 | out: lpFindFileData=0x19b9a4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc40) returned 1 [0171.204] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bc68, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.204] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Mozilla\\Firefox", lpDst=0x19bc68, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox") returned 0x36 [0171.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd08) returned 1 [0171.205] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox", nBufferLength=0x105, lpBuffer=0x19b7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox", lpFilePart=0x0) returned 0x35 [0171.205] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mozilla\\firefox\\*"), lpFindFileData=0x19ba30 | out: lpFindFileData=0x19ba30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bccc) returned 1 [0171.207] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bc68, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.207] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Waterfox", lpDst=0x19bc68, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox") returned 0x2f [0171.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd08) returned 1 [0171.208] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox", nBufferLength=0x105, lpBuffer=0x19b7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox", lpFilePart=0x0) returned 0x2e [0171.208] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\waterfox\\*"), lpFindFileData=0x19ba30 | out: lpFindFileData=0x19ba30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bccc) returned 1 [0171.210] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bc68, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.210] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\K-Meleon", lpDst=0x19bc68, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon") returned 0x2f [0171.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd08) returned 1 [0171.210] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon", nBufferLength=0x105, lpBuffer=0x19b7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon", lpFilePart=0x0) returned 0x2e [0171.210] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\k-meleon\\*"), lpFindFileData=0x19ba30 | out: lpFindFileData=0x19ba30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bccc) returned 1 [0171.213] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bc68, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.213] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Thunderbird", lpDst=0x19bc68, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird") returned 0x32 [0171.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd08) returned 1 [0171.213] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird", nBufferLength=0x105, lpBuffer=0x19b7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird", lpFilePart=0x0) returned 0x31 [0171.213] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\thunderbird\\*"), lpFindFileData=0x19ba30 | out: lpFindFileData=0x19ba30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bccc) returned 1 [0171.215] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bc68, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.215] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Comodo\\IceDragon", lpDst=0x19bc68, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon") returned 0x37 [0171.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd08) returned 1 [0171.216] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon", nBufferLength=0x105, lpBuffer=0x19b7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon", lpFilePart=0x0) returned 0x36 [0171.216] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\comodo\\icedragon\\*"), lpFindFileData=0x19ba30 | out: lpFindFileData=0x19ba30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bccc) returned 1 [0171.218] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bc68, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.218] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\8pecxstudios\\Cyberfox", lpDst=0x19bc68, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox") returned 0x3c [0171.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd08) returned 1 [0171.218] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox", nBufferLength=0x105, lpBuffer=0x19b7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox", lpFilePart=0x0) returned 0x3b [0171.218] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\8pecxstudios\\cyberfox\\*"), lpFindFileData=0x19ba30 | out: lpFindFileData=0x19ba30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bccc) returned 1 [0171.220] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bc68, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.220] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\NETGATE Technologies\\BlackHaw", lpDst=0x19bc68, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHaw") returned 0x44 [0171.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd08) returned 1 [0171.221] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHaw", nBufferLength=0x105, lpBuffer=0x19b7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHaw", lpFilePart=0x0) returned 0x43 [0171.221] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHaw\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\netgate technologies\\blackhaw\\*"), lpFindFileData=0x19ba30 | out: lpFindFileData=0x19ba30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bccc) returned 1 [0171.223] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bc68, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.223] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Moonchild Productions\\Pale Moon", lpDst=0x19bc68, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon") returned 0x46 [0171.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd08) returned 1 [0171.223] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon", nBufferLength=0x105, lpBuffer=0x19b7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon", lpFilePart=0x0) returned 0x45 [0171.224] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\moonchild productions\\pale moon\\*"), lpFindFileData=0x19ba30 | out: lpFindFileData=0x19ba30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bccc) returned 1 [0171.275] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x72c) returned 0x0 [0171.275] RegQueryInfoKeyW (in: hKey=0x72c, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x19bdd0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x19bdcc, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x19bdd0*=0x42, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x19bdcc*=0x0, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.276] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x0, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="AddressBook", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.276] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x1, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Connection Manager", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.276] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x2, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="DirectDrawEx", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.276] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x3, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="DXM_Runtime", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.276] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x4, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Fontcore", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.276] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x5, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE40", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.276] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x6, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE4Data", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.276] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x7, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE5BAKEX", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.276] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x8, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IEData", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.276] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x9, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MobileOptionPack", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.276] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0xa, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MPlayer2", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.276] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0xb, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Office16.PROPLUS", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.276] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0xc, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="SchedulingAgent", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.276] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0xd, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="WIC", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.276] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0xe, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{0FA68574-690B-4B00-89AA-B28946231449}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.276] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0xf, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.276] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x10, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.276] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x11, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.277] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x12, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.277] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x13, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.277] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x14, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.277] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x15, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.277] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x16, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.277] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x17, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.277] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x18, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.277] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x19, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.277] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x1a, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{65e650ff-30be-469d-b63a-418d71ea1765}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.277] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x1b, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{6913e92a-b64e-41c9-a5e6-cef39207fe89}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.277] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x1c, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.277] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x1d, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0011-0000-0000-0000000FF1CE}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.277] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x1e, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0015-0409-0000-0000000FF1CE}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.277] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x1f, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0016-0409-0000-0000000FF1CE}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.277] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x20, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0018-0409-0000-0000000FF1CE}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.278] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x21, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0019-0409-0000-0000000FF1CE}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.278] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x22, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-001A-0409-0000-0000000FF1CE}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.278] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x23, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-001B-0409-0000-0000000FF1CE}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.278] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x24, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-001F-0409-0000-0000000FF1CE}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.278] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x25, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-001F-040C-0000-0000000FF1CE}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.278] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x26, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-001F-0C0A-0000-0000000FF1CE}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.278] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x27, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-002C-0409-0000-0000000FF1CE}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.278] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x28, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0044-0409-0000-0000000FF1CE}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.278] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x29, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-006E-0409-0000-0000000FF1CE}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.278] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x2a, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-008C-0000-0000-0000000FF1CE}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.278] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x2b, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-008C-0409-0000-0000000FF1CE}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.279] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x2c, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0090-0409-0000-0000000FF1CE}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.279] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x2d, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-00A1-0409-0000-0000000FF1CE}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.279] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x2e, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-00BA-0409-0000-0000000FF1CE}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.279] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x2f, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-00E1-0409-0000-0000000FF1CE}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.279] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x30, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-00E2-0409-0000-0000000FF1CE}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.279] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x31, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0115-0409-0000-0000000FF1CE}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.279] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x32, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0117-0409-0000-0000000FF1CE}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.279] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x33, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-012B-0409-0000-0000000FF1CE}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.279] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x34, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{9BE518E6-ECC6-35A9-88E4-87755C07200F}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.279] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x35, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{B175520C-86A2-35A7-8619-86DC379688B9}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.279] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x36, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.279] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x37, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.280] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x38, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.280] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x39, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.280] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x3a, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.280] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x3b, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.280] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x3c, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.280] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x3d, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.280] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x3e, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.280] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x3f, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.280] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x40, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.280] RegEnumKeyExW (in: hKey=0x72c, dwIndex=0x41, lpName=0x278e984, lpcchName=0x19bdec, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", lpcchName=0x19bdec, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0171.280] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="AddressBook", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.281] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.281] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.281] RegCloseKey (hKey=0x730) returned 0x0 [0171.281] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="Connection Manager", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.281] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.281] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.281] RegCloseKey (hKey=0x730) returned 0x0 [0171.281] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="DirectDrawEx", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.281] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.281] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.281] RegCloseKey (hKey=0x730) returned 0x0 [0171.281] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="DXM_Runtime", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.282] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.282] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.282] RegCloseKey (hKey=0x730) returned 0x0 [0171.282] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="Fontcore", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.282] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.282] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.282] RegCloseKey (hKey=0x730) returned 0x0 [0171.282] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="IE40", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.282] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.282] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.282] RegCloseKey (hKey=0x730) returned 0x0 [0171.282] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="IE4Data", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.282] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.283] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.283] RegCloseKey (hKey=0x730) returned 0x0 [0171.283] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="IE5BAKEX", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.283] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.283] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.283] RegCloseKey (hKey=0x730) returned 0x0 [0171.283] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="IEData", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.283] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.283] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.283] RegCloseKey (hKey=0x730) returned 0x0 [0171.283] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="MobileOptionPack", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.283] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.283] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.283] RegCloseKey (hKey=0x730) returned 0x0 [0171.283] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="MPlayer2", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.284] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.284] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.284] RegCloseKey (hKey=0x730) returned 0x0 [0171.284] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="Office16.PROPLUS", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.284] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x50) returned 0x0 [0171.284] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x2791330, lpcbData=0x19bdc4*=0x50 | out: lpType=0x19bdc8*=0x1, lpData="Microsoft Office Professional Plus 2016", lpcbData=0x19bdc4*=0x50) returned 0x0 [0171.284] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.284] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279143c, lpcbData=0x19bdc4*=0x1e | out: lpType=0x19bdc8*=0x1, lpData="16.0.4266.1001", lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.325] RegCloseKey (hKey=0x730) returned 0x0 [0171.325] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="SchedulingAgent", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.325] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.325] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.325] RegCloseKey (hKey=0x730) returned 0x0 [0171.325] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="WIC", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.326] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.326] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.326] RegCloseKey (hKey=0x730) returned 0x0 [0171.326] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{0FA68574-690B-4B00-89AA-B28946231449}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.326] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x7e) returned 0x0 [0171.326] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x2796ff8, lpcbData=0x19bdc4*=0x7e | out: lpType=0x19bdc8*=0x1, lpData="Microsoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508", lpcbData=0x19bdc4*=0x7e) returned 0x0 [0171.326] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x18) returned 0x0 [0171.326] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x2797164, lpcbData=0x19bdc4*=0x18 | out: lpType=0x19bdc8*=0x1, lpData="14.25.28508", lpcbData=0x19bdc4*=0x18) returned 0x0 [0171.326] RegCloseKey (hKey=0x730) returned 0x0 [0171.326] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.327] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x76) returned 0x0 [0171.327] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x27974e4, lpcbData=0x19bdc4*=0x76 | out: lpType=0x19bdc8*=0x1, lpData="Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005", lpcbData=0x19bdc4*=0x76) returned 0x0 [0171.327] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x16) returned 0x0 [0171.327] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x2797640, lpcbData=0x19bdc4*=0x16 | out: lpType=0x19bdc8*=0x1, lpData="12.0.21005", lpcbData=0x19bdc4*=0x16) returned 0x0 [0171.327] RegCloseKey (hKey=0x730) returned 0x0 [0171.327] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.327] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.327] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.327] RegCloseKey (hKey=0x730) returned 0x0 [0171.327] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.327] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.327] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.328] RegCloseKey (hKey=0x730) returned 0x0 [0171.328] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.328] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.328] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.328] RegCloseKey (hKey=0x730) returned 0x0 [0171.328] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.328] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.328] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.328] RegCloseKey (hKey=0x730) returned 0x0 [0171.328] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.328] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.328] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.328] RegCloseKey (hKey=0x730) returned 0x0 [0171.329] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.329] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.329] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.329] RegCloseKey (hKey=0x730) returned 0x0 [0171.329] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.329] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.329] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.329] RegCloseKey (hKey=0x730) returned 0x0 [0171.329] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.329] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x78) returned 0x0 [0171.329] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x2798664, lpcbData=0x19bdc4*=0x78 | out: lpType=0x19bdc8*=0x1, lpData="Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508", lpcbData=0x19bdc4*=0x78) returned 0x0 [0171.329] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x18) returned 0x0 [0171.329] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x27987c0, lpcbData=0x19bdc4*=0x18 | out: lpType=0x19bdc8*=0x1, lpData="14.25.28508", lpcbData=0x19bdc4*=0x18) returned 0x0 [0171.329] RegCloseKey (hKey=0x730) returned 0x0 [0171.329] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.330] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x7a) returned 0x0 [0171.330] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x2798b38, lpcbData=0x19bdc4*=0x7a | out: lpType=0x19bdc8*=0x1, lpData="Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030", lpcbData=0x19bdc4*=0x7a) returned 0x0 [0171.330] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x1a) returned 0x0 [0171.330] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x2798c9c, lpcbData=0x19bdc4*=0x1a | out: lpType=0x19bdc8*=0x1, lpData="11.0.61030.0", lpcbData=0x19bdc4*=0x1a) returned 0x0 [0171.330] RegCloseKey (hKey=0x730) returned 0x0 [0171.330] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{3c3aafc8-d898-43ec-998f-965ffdae065a}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.330] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x7a) returned 0x0 [0171.330] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279904c, lpcbData=0x19bdc4*=0x7a | out: lpType=0x19bdc8*=0x1, lpData="Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501", lpcbData=0x19bdc4*=0x7a) returned 0x0 [0171.330] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x1a) returned 0x0 [0171.330] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x27991b0, lpcbData=0x19bdc4*=0x1a | out: lpType=0x19bdc8*=0x1, lpData="12.0.30501.0", lpcbData=0x19bdc4*=0x1a) returned 0x0 [0171.330] RegCloseKey (hKey=0x730) returned 0x0 [0171.330] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{65e650ff-30be-469d-b63a-418d71ea1765}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.330] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x86) returned 0x0 [0171.331] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x2799534, lpcbData=0x19bdc4*=0x86 | out: lpType=0x19bdc8*=0x1, lpData="Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508", lpcbData=0x19bdc4*=0x86) returned 0x0 [0171.331] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x1c) returned 0x0 [0171.331] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x27996b0, lpcbData=0x19bdc4*=0x1c | out: lpType=0x19bdc8*=0x1, lpData="14.25.28508.3", lpcbData=0x19bdc4*=0x1c) returned 0x0 [0171.331] RegCloseKey (hKey=0x730) returned 0x0 [0171.331] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{6913e92a-b64e-41c9-a5e6-cef39207fe89}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.331] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x86) returned 0x0 [0171.331] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x2799a44, lpcbData=0x19bdc4*=0x86 | out: lpType=0x19bdc8*=0x1, lpData="Microsoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508", lpcbData=0x19bdc4*=0x86) returned 0x0 [0171.331] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x1c) returned 0x0 [0171.332] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x2799bc0, lpcbData=0x19bdc4*=0x1c | out: lpType=0x19bdc8*=0x1, lpData="14.25.28508.3", lpcbData=0x19bdc4*=0x1c) returned 0x0 [0171.332] RegCloseKey (hKey=0x730) returned 0x0 [0171.332] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.332] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x54) returned 0x0 [0171.332] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x2799f54, lpcbData=0x19bdc4*=0x54 | out: lpType=0x19bdc8*=0x1, lpData="Microsoft Visual C++ 2005 Redistributable", lpcbData=0x19bdc4*=0x54) returned 0x0 [0171.332] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x14) returned 0x0 [0171.332] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279a068, lpcbData=0x19bdc4*=0x14 | out: lpType=0x19bdc8*=0x1, lpData="8.0.61001", lpcbData=0x19bdc4*=0x14) returned 0x0 [0171.332] RegCloseKey (hKey=0x730) returned 0x0 [0171.332] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{90160000-0011-0000-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.332] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x50) returned 0x0 [0171.333] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279a3fc, lpcbData=0x19bdc4*=0x50 | out: lpType=0x19bdc8*=0x1, lpData="Microsoft Office Professional Plus 2016", lpcbData=0x19bdc4*=0x50) returned 0x0 [0171.333] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.333] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279a508, lpcbData=0x19bdc4*=0x1e | out: lpType=0x19bdc8*=0x1, lpData="16.0.4266.1001", lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.333] RegCloseKey (hKey=0x730) returned 0x0 [0171.333] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{90160000-0015-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.333] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x48) returned 0x0 [0171.333] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279a870, lpcbData=0x19bdc4*=0x48 | out: lpType=0x19bdc8*=0x1, lpData="Microsoft Access MUI (English) 2016", lpcbData=0x19bdc4*=0x48) returned 0x0 [0171.333] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.333] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279a96c, lpcbData=0x19bdc4*=0x1e | out: lpType=0x19bdc8*=0x1, lpData="16.0.4266.1001", lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.333] RegCloseKey (hKey=0x730) returned 0x0 [0171.333] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{90160000-0016-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.333] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x46) returned 0x0 [0171.333] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279accc, lpcbData=0x19bdc4*=0x46 | out: lpType=0x19bdc8*=0x1, lpData="Microsoft Excel MUI (English) 2016", lpcbData=0x19bdc4*=0x46) returned 0x0 [0171.334] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.334] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279adc8, lpcbData=0x19bdc4*=0x1e | out: lpType=0x19bdc8*=0x1, lpData="16.0.4266.1001", lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.334] RegCloseKey (hKey=0x730) returned 0x0 [0171.334] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{90160000-0018-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.334] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x50) returned 0x0 [0171.334] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279b124, lpcbData=0x19bdc4*=0x50 | out: lpType=0x19bdc8*=0x1, lpData="Microsoft PowerPoint MUI (English) 2016", lpcbData=0x19bdc4*=0x50) returned 0x0 [0171.334] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.334] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279b230, lpcbData=0x19bdc4*=0x1e | out: lpType=0x19bdc8*=0x1, lpData="16.0.4266.1001", lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.334] RegCloseKey (hKey=0x730) returned 0x0 [0171.334] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{90160000-0019-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.334] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x4e) returned 0x0 [0171.334] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279b598, lpcbData=0x19bdc4*=0x4e | out: lpType=0x19bdc8*=0x1, lpData="Microsoft Publisher MUI (English) 2016", lpcbData=0x19bdc4*=0x4e) returned 0x0 [0171.334] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.334] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279b6a4, lpcbData=0x19bdc4*=0x1e | out: lpType=0x19bdc8*=0x1, lpData="16.0.4266.1001", lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.334] RegCloseKey (hKey=0x730) returned 0x0 [0171.335] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{90160000-001A-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.335] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x4a) returned 0x0 [0171.335] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279ba08, lpcbData=0x19bdc4*=0x4a | out: lpType=0x19bdc8*=0x1, lpData="Microsoft Outlook MUI (English) 2016", lpcbData=0x19bdc4*=0x4a) returned 0x0 [0171.335] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.335] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279bb0c, lpcbData=0x19bdc4*=0x1e | out: lpType=0x19bdc8*=0x1, lpData="16.0.4266.1001", lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.335] RegCloseKey (hKey=0x730) returned 0x0 [0171.335] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{90160000-001B-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.335] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x44) returned 0x0 [0171.335] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279be6c, lpcbData=0x19bdc4*=0x44 | out: lpType=0x19bdc8*=0x1, lpData="Microsoft Word MUI (English) 2016", lpcbData=0x19bdc4*=0x44) returned 0x0 [0171.335] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.335] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279bf60, lpcbData=0x19bdc4*=0x1e | out: lpType=0x19bdc8*=0x1, lpData="16.0.4266.1001", lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.335] RegCloseKey (hKey=0x730) returned 0x0 [0171.335] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{90160000-001F-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.335] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x5e) returned 0x0 [0171.336] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279c2bc, lpcbData=0x19bdc4*=0x5e | out: lpType=0x19bdc8*=0x1, lpData="Microsoft Office Proofing Tools 2016 - English", lpcbData=0x19bdc4*=0x5e) returned 0x0 [0171.336] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.336] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279c3e8, lpcbData=0x19bdc4*=0x1e | out: lpType=0x19bdc8*=0x1, lpData="16.0.4266.1001", lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.336] RegCloseKey (hKey=0x730) returned 0x0 [0171.336] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{90160000-001F-040C-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.336] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x90) returned 0x0 [0171.336] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279c7e8, lpcbData=0x19bdc4*=0x90 | out: lpType=0x19bdc8*=0x1, lpData="Outils de vérification linguistique 2016 de Microsoft Office - Français", lpcbData=0x19bdc4*=0x90) returned 0x0 [0171.336] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.336] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279c974, lpcbData=0x19bdc4*=0x1e | out: lpType=0x19bdc8*=0x1, lpData="16.0.4266.1001", lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.336] RegCloseKey (hKey=0x730) returned 0x0 [0171.337] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{90160000-001F-0C0A-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.337] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x7a) returned 0x0 [0171.337] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279d228, lpcbData=0x19bdc4*=0x7a | out: lpType=0x19bdc8*=0x1, lpData="Herramientas de corrección de Microsoft Office 2016: español", lpcbData=0x19bdc4*=0x7a) returned 0x0 [0171.337] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.337] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279d38c, lpcbData=0x19bdc4*=0x1e | out: lpType=0x19bdc8*=0x1, lpData="16.0.4266.1001", lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.337] RegCloseKey (hKey=0x730) returned 0x0 [0171.337] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{90160000-002C-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.337] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x52) returned 0x0 [0171.337] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279da50, lpcbData=0x19bdc4*=0x52 | out: lpType=0x19bdc8*=0x1, lpData="Microsoft Office Proofing (English) 2016", lpcbData=0x19bdc4*=0x52) returned 0x0 [0171.337] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.337] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279db64, lpcbData=0x19bdc4*=0x1e | out: lpType=0x19bdc8*=0x1, lpData="16.0.4266.1001", lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.337] RegCloseKey (hKey=0x730) returned 0x0 [0171.337] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{90160000-0044-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.338] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x4c) returned 0x0 [0171.338] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279decc, lpcbData=0x19bdc4*=0x4c | out: lpType=0x19bdc8*=0x1, lpData="Microsoft InfoPath MUI (English) 2016", lpcbData=0x19bdc4*=0x4c) returned 0x0 [0171.338] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.338] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279dfd0, lpcbData=0x19bdc4*=0x1e | out: lpType=0x19bdc8*=0x1, lpData="16.0.4266.1001", lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.338] RegCloseKey (hKey=0x730) returned 0x0 [0171.338] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{90160000-006E-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.338] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x56) returned 0x0 [0171.338] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279e334, lpcbData=0x19bdc4*=0x56 | out: lpType=0x19bdc8*=0x1, lpData="Microsoft Office Shared MUI (English) 2016", lpcbData=0x19bdc4*=0x56) returned 0x0 [0171.338] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.338] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279e450, lpcbData=0x19bdc4*=0x1e | out: lpType=0x19bdc8*=0x1, lpData="16.0.4266.1001", lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.338] RegCloseKey (hKey=0x730) returned 0x0 [0171.339] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{90160000-008C-0000-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.339] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.339] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.339] RegCloseKey (hKey=0x730) returned 0x0 [0171.339] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{90160000-008C-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.339] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.339] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.339] RegCloseKey (hKey=0x730) returned 0x0 [0171.339] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{90160000-0090-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.339] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x42) returned 0x0 [0171.339] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279eb34, lpcbData=0x19bdc4*=0x42 | out: lpType=0x19bdc8*=0x1, lpData="Microsoft DCF MUI (English) 2016", lpcbData=0x19bdc4*=0x42) returned 0x0 [0171.339] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.339] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279ec28, lpcbData=0x19bdc4*=0x1e | out: lpType=0x19bdc8*=0x1, lpData="16.0.4266.1001", lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.340] RegCloseKey (hKey=0x730) returned 0x0 [0171.340] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{90160000-00A1-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.340] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x4a) returned 0x0 [0171.340] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279ef80, lpcbData=0x19bdc4*=0x4a | out: lpType=0x19bdc8*=0x1, lpData="Microsoft OneNote MUI (English) 2016", lpcbData=0x19bdc4*=0x4a) returned 0x0 [0171.340] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.340] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279f084, lpcbData=0x19bdc4*=0x1e | out: lpType=0x19bdc8*=0x1, lpData="16.0.4266.1001", lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.340] RegCloseKey (hKey=0x730) returned 0x0 [0171.340] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{90160000-00BA-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.340] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x48) returned 0x0 [0171.340] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279f3e4, lpcbData=0x19bdc4*=0x48 | out: lpType=0x19bdc8*=0x1, lpData="Microsoft Groove MUI (English) 2016", lpcbData=0x19bdc4*=0x48) returned 0x0 [0171.340] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.340] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279f4e0, lpcbData=0x19bdc4*=0x1e | out: lpType=0x19bdc8*=0x1, lpData="16.0.4266.1001", lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.341] RegCloseKey (hKey=0x730) returned 0x0 [0171.341] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{90160000-00E1-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.341] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x50) returned 0x0 [0171.341] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279f840, lpcbData=0x19bdc4*=0x50 | out: lpType=0x19bdc8*=0x1, lpData="Microsoft Office OSM MUI (English) 2016", lpcbData=0x19bdc4*=0x50) returned 0x0 [0171.341] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.341] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279f94c, lpcbData=0x19bdc4*=0x1e | out: lpType=0x19bdc8*=0x1, lpData="16.0.4266.1001", lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.341] RegCloseKey (hKey=0x730) returned 0x0 [0171.341] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{90160000-00E2-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.341] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x56) returned 0x0 [0171.341] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279fcb4, lpcbData=0x19bdc4*=0x56 | out: lpType=0x19bdc8*=0x1, lpData="Microsoft Office OSM UX MUI (English) 2016", lpcbData=0x19bdc4*=0x56) returned 0x0 [0171.342] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.342] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x279fdd0, lpcbData=0x19bdc4*=0x1e | out: lpType=0x19bdc8*=0x1, lpData="16.0.4266.1001", lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.342] RegCloseKey (hKey=0x730) returned 0x0 [0171.342] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{90160000-0115-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.342] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x74) returned 0x0 [0171.342] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x27a013c, lpcbData=0x19bdc4*=0x74 | out: lpType=0x19bdc8*=0x1, lpData="Microsoft Office Shared Setup Metadata MUI (English) 2016", lpcbData=0x19bdc4*=0x74) returned 0x0 [0171.342] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.342] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x27a0290, lpcbData=0x19bdc4*=0x1e | out: lpType=0x19bdc8*=0x1, lpData="16.0.4266.1001", lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.342] RegCloseKey (hKey=0x730) returned 0x0 [0171.342] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{90160000-0117-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.342] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x66) returned 0x0 [0171.342] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x27a061c, lpcbData=0x19bdc4*=0x66 | out: lpType=0x19bdc8*=0x1, lpData="Microsoft Access Setup Metadata MUI (English) 2016", lpcbData=0x19bdc4*=0x66) returned 0x0 [0171.342] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.342] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x27a0758, lpcbData=0x19bdc4*=0x1e | out: lpType=0x19bdc8*=0x1, lpData="16.0.4266.1001", lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.343] RegCloseKey (hKey=0x730) returned 0x0 [0171.343] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{90160000-012B-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.343] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x60) returned 0x0 [0171.343] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x27a0ad4, lpcbData=0x19bdc4*=0x60 | out: lpType=0x19bdc8*=0x1, lpData="Microsoft Skype for Business MUI (English) 2016", lpcbData=0x19bdc4*=0x60) returned 0x0 [0171.343] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.343] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x27a0c00, lpcbData=0x19bdc4*=0x1e | out: lpType=0x19bdc8*=0x1, lpData="16.0.4266.1001", lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.343] RegCloseKey (hKey=0x730) returned 0x0 [0171.343] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{9BE518E6-ECC6-35A9-88E4-87755C07200F}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.343] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x7e) returned 0x0 [0171.343] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x27a0f78, lpcbData=0x19bdc4*=0x7e | out: lpType=0x19bdc8*=0x1, lpData="Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161", lpcbData=0x19bdc4*=0x7e) returned 0x0 [0171.343] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.343] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x27a10e4, lpcbData=0x19bdc4*=0x1e | out: lpType=0x19bdc8*=0x1, lpData="9.0.30729.6161", lpcbData=0x19bdc4*=0x1e) returned 0x0 [0171.343] RegCloseKey (hKey=0x730) returned 0x0 [0171.343] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{B175520C-86A2-35A7-8619-86DC379688B9}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.344] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x7c) returned 0x0 [0171.344] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x27a1478, lpcbData=0x19bdc4*=0x7c | out: lpType=0x19bdc8*=0x1, lpData="Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030", lpcbData=0x19bdc4*=0x7c) returned 0x0 [0171.344] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x16) returned 0x0 [0171.344] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x27a15dc, lpcbData=0x19bdc4*=0x16 | out: lpType=0x19bdc8*=0x1, lpData="11.0.61030", lpcbData=0x19bdc4*=0x16) returned 0x0 [0171.344] RegCloseKey (hKey=0x730) returned 0x0 [0171.344] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.344] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x76) returned 0x0 [0171.344] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x27a1958, lpcbData=0x19bdc4*=0x76 | out: lpType=0x19bdc8*=0x1, lpData="Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030", lpcbData=0x19bdc4*=0x76) returned 0x0 [0171.344] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x16) returned 0x0 [0171.344] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x27a1ab4, lpcbData=0x19bdc4*=0x16 | out: lpType=0x19bdc8*=0x1, lpData="11.0.61030", lpcbData=0x19bdc4*=0x16) returned 0x0 [0171.344] RegCloseKey (hKey=0x730) returned 0x0 [0171.344] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.344] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x7a) returned 0x0 [0171.344] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x27a1f34, lpcbData=0x19bdc4*=0x7a | out: lpType=0x19bdc8*=0x1, lpData="Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030", lpcbData=0x19bdc4*=0x7a) returned 0x0 [0171.344] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x1a) returned 0x0 [0171.344] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x27a2098, lpcbData=0x19bdc4*=0x1a | out: lpType=0x19bdc8*=0x1, lpData="11.0.61030.0", lpcbData=0x19bdc4*=0x1a) returned 0x0 [0171.345] RegCloseKey (hKey=0x730) returned 0x0 [0171.345] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.345] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x7a) returned 0x0 [0171.345] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x27a241c, lpcbData=0x19bdc4*=0x7a | out: lpType=0x19bdc8*=0x1, lpData="Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501", lpcbData=0x19bdc4*=0x7a) returned 0x0 [0171.345] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x1a) returned 0x0 [0171.345] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x27a2580, lpcbData=0x19bdc4*=0x1a | out: lpType=0x19bdc8*=0x1, lpData="12.0.30501.0", lpcbData=0x19bdc4*=0x1a) returned 0x0 [0171.345] RegCloseKey (hKey=0x730) returned 0x0 [0171.345] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.345] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x78) returned 0x0 [0171.345] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x27a2904, lpcbData=0x19bdc4*=0x78 | out: lpType=0x19bdc8*=0x1, lpData="Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219", lpcbData=0x19bdc4*=0x78) returned 0x0 [0171.345] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x16) returned 0x0 [0171.345] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x27a2a60, lpcbData=0x19bdc4*=0x16 | out: lpType=0x19bdc8*=0x1, lpData="10.0.40219", lpcbData=0x19bdc4*=0x16) returned 0x0 [0171.346] RegCloseKey (hKey=0x730) returned 0x0 [0171.346] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.346] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.346] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.346] RegCloseKey (hKey=0x730) returned 0x0 [0171.346] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.346] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.346] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.346] RegCloseKey (hKey=0x730) returned 0x0 [0171.346] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.346] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.346] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.346] RegCloseKey (hKey=0x730) returned 0x0 [0171.347] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.347] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.347] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.347] RegCloseKey (hKey=0x730) returned 0x0 [0171.347] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.347] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.347] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.347] RegCloseKey (hKey=0x730) returned 0x0 [0171.347] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.347] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.347] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.347] RegCloseKey (hKey=0x730) returned 0x0 [0171.347] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.348] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.348] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x0, lpData=0x0, lpcbData=0x19bdc4*=0x0) returned 0x2 [0171.348] RegCloseKey (hKey=0x730) returned 0x0 [0171.348] RegOpenKeyExW (in: hKey=0x72c, lpSubKey="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bda8 | out: phkResult=0x19bda8*=0x730) returned 0x0 [0171.348] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x7c) returned 0x0 [0171.348] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19bdc8, lpData=0x27a3a88, lpcbData=0x19bdc4*=0x7c | out: lpType=0x19bdc8*=0x1, lpData="Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005", lpcbData=0x19bdc4*=0x7c) returned 0x0 [0171.348] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x0, lpcbData=0x19bdc4*=0x0 | out: lpType=0x19bdc8*=0x1, lpData=0x0, lpcbData=0x19bdc4*=0x16) returned 0x0 [0171.348] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19bdc8, lpData=0x27a3bec, lpcbData=0x19bdc4*=0x16 | out: lpType=0x19bdc8*=0x1, lpData="12.0.21005", lpcbData=0x19bdc4*=0x16) returned 0x0 [0171.348] RegCloseKey (hKey=0x730) returned 0x0 [0171.348] RegCloseKey (hKey=0x72c) returned 0x0 [0171.438] CoTaskMemAlloc (cb=0x20c) returned 0x51eab30 [0171.438] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x51eab30 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0171.441] CoTaskMemFree (pv=0x51eab30) [0171.441] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19b784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0171.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bca4) returned 1 [0171.442] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19b764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0171.442] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\*"), lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x865ad93a, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x865ad93a, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5206b90 [0171.443] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x865ad93a, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x865ad93a, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.444] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cbd0f60, ftCreationTime.dwHighDateTime=0x1d896e4, ftLastAccessTime.dwLowDateTime=0x76825090, ftLastAccessTime.dwHighDateTime=0x1d8a15a, ftLastWriteTime.dwLowDateTime=0x76825090, ftLastWriteTime.dwHighDateTime=0x1d8a15a, nFileSizeHigh=0x0, nFileSizeLow=0xc48d, dwReserved0=0x0, dwReserved1=0x0, cFileName="2NnCyesdHU0.pptx", cAlternateFileName="2NNCYE~1.PPT")) returned 1 [0171.444] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98787d30, ftCreationTime.dwHighDateTime=0x1d8a256, ftLastAccessTime.dwLowDateTime=0x8f1c4820, ftLastAccessTime.dwHighDateTime=0x1d8a666, ftLastWriteTime.dwLowDateTime=0x8f1c4820, ftLastWriteTime.dwHighDateTime=0x1d8a666, nFileSizeHigh=0x0, nFileSizeLow=0x138c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="2NNX.pdf", cAlternateFileName="")) returned 1 [0171.444] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a9a460, ftCreationTime.dwHighDateTime=0x1d8a53f, ftLastAccessTime.dwLowDateTime=0x7ceca260, ftLastAccessTime.dwHighDateTime=0x1d8a6f9, ftLastWriteTime.dwLowDateTime=0x7ceca260, ftLastWriteTime.dwHighDateTime=0x1d8a6f9, nFileSizeHigh=0x0, nFileSizeLow=0x39f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="6J472kcYVve.avi", cAlternateFileName="6J472K~1.AVI")) returned 1 [0171.444] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d4b650, ftCreationTime.dwHighDateTime=0x1d89b1d, ftLastAccessTime.dwLowDateTime=0x332faff0, ftLastAccessTime.dwHighDateTime=0x1d89b28, ftLastWriteTime.dwLowDateTime=0x332faff0, ftLastWriteTime.dwHighDateTime=0x1d89b28, nFileSizeHigh=0x0, nFileSizeLow=0x7490, dwReserved0=0x0, dwReserved1=0x0, cFileName="7LTvQ2J.odt", cAlternateFileName="")) returned 1 [0171.445] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25ee1260, ftCreationTime.dwHighDateTime=0x1d898ed, ftLastAccessTime.dwLowDateTime=0xc6921f50, ftLastAccessTime.dwHighDateTime=0x1d89d4c, ftLastWriteTime.dwLowDateTime=0xc6921f50, ftLastWriteTime.dwHighDateTime=0x1d89d4c, nFileSizeHigh=0x0, nFileSizeLow=0x17ef1, dwReserved0=0x0, dwReserved1=0x0, cFileName="93WdUjkyVK9B4.jpg", cAlternateFileName="93WDUJ~1.JPG")) returned 1 [0171.445] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0171.445] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7dc0940, ftCreationTime.dwHighDateTime=0x1d89a58, ftLastAccessTime.dwLowDateTime=0x69f031c0, ftLastAccessTime.dwHighDateTime=0x1d8a2e1, ftLastWriteTime.dwLowDateTime=0x69f031c0, ftLastWriteTime.dwHighDateTime=0x1d8a2e1, nFileSizeHigh=0x0, nFileSizeLow=0xb6a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bC22.wav", cAlternateFileName="")) returned 1 [0171.445] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd537dd60, ftCreationTime.dwHighDateTime=0x1d89ced, ftLastAccessTime.dwLowDateTime=0x8694d140, ftLastAccessTime.dwHighDateTime=0x1d8a46d, ftLastWriteTime.dwLowDateTime=0x8694d140, ftLastWriteTime.dwHighDateTime=0x1d8a46d, nFileSizeHigh=0x0, nFileSizeLow=0xe73e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DMCYhtZ.doc", cAlternateFileName="")) returned 1 [0171.445] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa02096d0, ftCreationTime.dwHighDateTime=0x1d89739, ftLastAccessTime.dwLowDateTime=0x4b537c30, ftLastAccessTime.dwHighDateTime=0x1d8a29c, ftLastWriteTime.dwLowDateTime=0x4b537c30, ftLastWriteTime.dwHighDateTime=0x1d8a29c, nFileSizeHigh=0x0, nFileSizeLow=0x55d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dyCrW4WlJ.xlsx", cAlternateFileName="DYCRW4~1.XLS")) returned 1 [0171.446] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a1df6c0, ftCreationTime.dwHighDateTime=0x1d89b2c, ftLastAccessTime.dwLowDateTime=0x91440dc0, ftLastAccessTime.dwHighDateTime=0x1d8a37f, ftLastWriteTime.dwLowDateTime=0x91440dc0, ftLastWriteTime.dwHighDateTime=0x1d8a37f, nFileSizeHigh=0x0, nFileSizeLow=0xec0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="e9sJKSI_4DJUW6PTaPTV.wav", cAlternateFileName="E9SJKS~1.WAV")) returned 1 [0171.446] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x267be7a0, ftCreationTime.dwHighDateTime=0x1d89f89, ftLastAccessTime.dwLowDateTime=0xdf3d9b90, ftLastAccessTime.dwHighDateTime=0x1d8a172, ftLastWriteTime.dwLowDateTime=0xdf3d9b90, ftLastWriteTime.dwHighDateTime=0x1d8a172, nFileSizeHigh=0x0, nFileSizeLow=0x11b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="F8vvKk.mp4", cAlternateFileName="")) returned 1 [0171.446] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd635f6a0, ftCreationTime.dwHighDateTime=0x1d8a668, ftLastAccessTime.dwLowDateTime=0xc16e4180, ftLastAccessTime.dwHighDateTime=0x1d8a6a6, ftLastWriteTime.dwLowDateTime=0xc16e4180, ftLastWriteTime.dwHighDateTime=0x1d8a6a6, nFileSizeHigh=0x0, nFileSizeLow=0x2c9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FOJ6LONusWR6e6d.docx", cAlternateFileName="FOJ6LO~1.DOC")) returned 1 [0171.446] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc28e7630, ftCreationTime.dwHighDateTime=0x1d8a1d2, ftLastAccessTime.dwLowDateTime=0xd839a0e0, ftLastAccessTime.dwHighDateTime=0x1d8a4de, ftLastWriteTime.dwLowDateTime=0xd839a0e0, ftLastWriteTime.dwHighDateTime=0x1d8a4de, nFileSizeHigh=0x0, nFileSizeLow=0xf92, dwReserved0=0x0, dwReserved1=0x0, cFileName="HYMu7.m4a", cAlternateFileName="")) returned 1 [0171.446] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x233ee000, ftCreationTime.dwHighDateTime=0x1d89e13, ftLastAccessTime.dwLowDateTime=0x7c378330, ftLastAccessTime.dwHighDateTime=0x1d8a217, ftLastWriteTime.dwLowDateTime=0x7c378330, ftLastWriteTime.dwHighDateTime=0x1d8a217, nFileSizeHigh=0x0, nFileSizeLow=0xc01f, dwReserved0=0x0, dwReserved1=0x0, cFileName="iXsSU.xls", cAlternateFileName="")) returned 1 [0171.447] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3479dec0, ftCreationTime.dwHighDateTime=0x1d8a0b0, ftLastAccessTime.dwLowDateTime=0x671b9040, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0x671b9040, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x17b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J8iOtCmq.docx", cAlternateFileName="J8IOTC~1.DOC")) returned 1 [0171.447] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7daa840, ftCreationTime.dwHighDateTime=0x1d898e1, ftLastAccessTime.dwLowDateTime=0x34e7c330, ftLastAccessTime.dwHighDateTime=0x1d89d78, ftLastWriteTime.dwLowDateTime=0x34e7c330, ftLastWriteTime.dwHighDateTime=0x1d89d78, nFileSizeHigh=0x0, nFileSizeLow=0x6ee2, dwReserved0=0x0, dwReserved1=0x0, cFileName="jBr6pI9R1WbDCs5PMAv8.bmp", cAlternateFileName="JBR6PI~1.BMP")) returned 1 [0171.447] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42f7d80, ftCreationTime.dwHighDateTime=0x1d89c44, ftLastAccessTime.dwLowDateTime=0xa8f37b10, ftLastAccessTime.dwHighDateTime=0x1d8a616, ftLastWriteTime.dwLowDateTime=0xa8f37b10, ftLastWriteTime.dwHighDateTime=0x1d8a616, nFileSizeHigh=0x0, nFileSizeLow=0x1ee7, dwReserved0=0x0, dwReserved1=0x0, cFileName="kZfHDZWeGh.jpg", cAlternateFileName="KZFHDZ~1.JPG")) returned 1 [0171.447] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e6e5e50, ftCreationTime.dwHighDateTime=0x1d89891, ftLastAccessTime.dwLowDateTime=0xe3a43dc0, ftLastAccessTime.dwHighDateTime=0x1d89ec4, ftLastWriteTime.dwLowDateTime=0xe3a43dc0, ftLastWriteTime.dwHighDateTime=0x1d89ec4, nFileSizeHigh=0x0, nFileSizeLow=0x5a5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="LW -YLVSlKy94.jpg", cAlternateFileName="LW-YLV~1.JPG")) returned 1 [0171.448] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa92f1c4e, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa92f1c4e, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0171.448] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x865ff810, ftCreationTime.dwHighDateTime=0x1d8a21c, ftLastAccessTime.dwLowDateTime=0xa4e0d300, ftLastAccessTime.dwHighDateTime=0x1d8a3e7, ftLastWriteTime.dwLowDateTime=0xa4e0d300, ftLastWriteTime.dwHighDateTime=0x1d8a3e7, nFileSizeHigh=0x0, nFileSizeLow=0x10b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="N4y3hIJgPT.rtf", cAlternateFileName="N4Y3HI~1.RTF")) returned 1 [0171.448] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3770430, ftCreationTime.dwHighDateTime=0x1d898b3, ftLastAccessTime.dwLowDateTime=0x32cc5ac0, ftLastAccessTime.dwHighDateTime=0x1d8a13d, ftLastWriteTime.dwLowDateTime=0x32cc5ac0, ftLastWriteTime.dwHighDateTime=0x1d8a13d, nFileSizeHigh=0x0, nFileSizeLow=0x17ed4, dwReserved0=0x0, dwReserved1=0x0, cFileName="NbJ_5YCuGsb3PK0wD.mp4", cAlternateFileName="NBJ_5Y~1.MP4")) returned 1 [0171.448] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae958e0, ftCreationTime.dwHighDateTime=0x1d89f04, ftLastAccessTime.dwLowDateTime=0x4ef62a00, ftLastAccessTime.dwHighDateTime=0x1d8a43f, ftLastWriteTime.dwLowDateTime=0x4ef62a00, ftLastWriteTime.dwHighDateTime=0x1d8a43f, nFileSizeHigh=0x0, nFileSizeLow=0x9317, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONuuuXsbnYl.m4a", cAlternateFileName="ONUUUX~1.M4A")) returned 1 [0171.448] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ab77f0, ftCreationTime.dwHighDateTime=0x1d8a5a4, ftLastAccessTime.dwLowDateTime=0x55da39f0, ftLastAccessTime.dwHighDateTime=0x1d8a710, ftLastWriteTime.dwLowDateTime=0x55da39f0, ftLastWriteTime.dwHighDateTime=0x1d8a710, nFileSizeHigh=0x0, nFileSizeLow=0x126d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oshVsRL8iDS.flv", cAlternateFileName="OSHVSR~1.FLV")) returned 1 [0171.449] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43959450, ftCreationTime.dwHighDateTime=0x1d898f7, ftLastAccessTime.dwLowDateTime=0xb470a710, ftLastAccessTime.dwHighDateTime=0x1d8a6b6, ftLastWriteTime.dwLowDateTime=0xb470a710, ftLastWriteTime.dwHighDateTime=0x1d8a6b6, nFileSizeHigh=0x0, nFileSizeLow=0x10b04, dwReserved0=0x0, dwReserved1=0x0, cFileName="p49FKD-D-CiAqC fO.mp3", cAlternateFileName="P49FKD~1.MP3")) returned 1 [0171.449] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90352ef0, ftCreationTime.dwHighDateTime=0x1d89af1, ftLastAccessTime.dwLowDateTime=0x10d03b40, ftLastAccessTime.dwHighDateTime=0x1d8a0b0, ftLastWriteTime.dwLowDateTime=0x10d03b40, ftLastWriteTime.dwHighDateTime=0x1d8a0b0, nFileSizeHigh=0x0, nFileSizeLow=0xdce, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJxGK1qbaES-W.mp4", cAlternateFileName="PJXGK1~1.MP4")) returned 1 [0171.449] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99ff80c0, ftCreationTime.dwHighDateTime=0x1d8a0f5, ftLastAccessTime.dwLowDateTime=0x42d02ce0, ftLastAccessTime.dwHighDateTime=0x1d8a1c8, ftLastWriteTime.dwLowDateTime=0x42d02ce0, ftLastWriteTime.dwHighDateTime=0x1d8a1c8, nFileSizeHigh=0x0, nFileSizeLow=0x5013, dwReserved0=0x0, dwReserved1=0x0, cFileName="QTE8WodNqFOaCy.mp3", cAlternateFileName="QTE8WO~1.MP3")) returned 1 [0171.449] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27447680, ftCreationTime.dwHighDateTime=0x1d89aa1, ftLastAccessTime.dwLowDateTime=0xdac3d350, ftLastAccessTime.dwHighDateTime=0x1d8a31f, ftLastWriteTime.dwLowDateTime=0xdac3d350, ftLastWriteTime.dwHighDateTime=0x1d8a31f, nFileSizeHigh=0x0, nFileSizeLow=0x1032f, dwReserved0=0x0, dwReserved1=0x0, cFileName="RvnffDiQI7fYCMNvO.gif", cAlternateFileName="RVNFFD~1.GIF")) returned 1 [0171.449] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x579fc820, ftCreationTime.dwHighDateTime=0x1d8a104, ftLastAccessTime.dwLowDateTime=0x734b14d0, ftLastAccessTime.dwHighDateTime=0x1d8a604, ftLastWriteTime.dwLowDateTime=0x734b14d0, ftLastWriteTime.dwHighDateTime=0x1d8a604, nFileSizeHigh=0x0, nFileSizeLow=0x33e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="R_SoP1vr0bFLHpuUeCQ.flv", cAlternateFileName="R_SOP1~1.FLV")) returned 1 [0171.450] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66199510, ftCreationTime.dwHighDateTime=0x1d8a222, ftLastAccessTime.dwLowDateTime=0x4c076b00, ftLastAccessTime.dwHighDateTime=0x1d8a32d, ftLastWriteTime.dwLowDateTime=0x4c076b00, ftLastWriteTime.dwHighDateTime=0x1d8a32d, nFileSizeHigh=0x0, nFileSizeLow=0x16e97, dwReserved0=0x0, dwReserved1=0x0, cFileName="UBYxG4ogaJ34RZva5.avi", cAlternateFileName="UBYXG4~1.AVI")) returned 1 [0171.450] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe71467b0, ftCreationTime.dwHighDateTime=0x1d8a2c9, ftLastAccessTime.dwLowDateTime=0x6ffb1840, ftLastAccessTime.dwHighDateTime=0x1d8a4cc, ftLastWriteTime.dwLowDateTime=0x6ffb1840, ftLastWriteTime.dwHighDateTime=0x1d8a4cc, nFileSizeHigh=0x0, nFileSizeLow=0x189f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="vidqPMV4mV4PRrkKr.m4a", cAlternateFileName="VIDQPM~1.M4A")) returned 1 [0171.450] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9768b690, ftCreationTime.dwHighDateTime=0x1d8a656, ftLastAccessTime.dwLowDateTime=0x8cb98ca0, ftLastAccessTime.dwHighDateTime=0x1d8a6ed, ftLastWriteTime.dwLowDateTime=0x8cb98ca0, ftLastWriteTime.dwHighDateTime=0x1d8a6ed, nFileSizeHigh=0x0, nFileSizeLow=0x802d, dwReserved0=0x0, dwReserved1=0x0, cFileName="wCtWVNUGX2yfHI7Ay96p.mp3", cAlternateFileName="WCTWVN~1.MP3")) returned 1 [0171.450] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cb031d0, ftCreationTime.dwHighDateTime=0x1d89f5b, ftLastAccessTime.dwLowDateTime=0x6ff70490, ftLastAccessTime.dwHighDateTime=0x1d8a453, ftLastWriteTime.dwLowDateTime=0x6ff70490, ftLastWriteTime.dwHighDateTime=0x1d8a453, nFileSizeHigh=0x0, nFileSizeLow=0x844e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WjaClBqfz6xsvQzRMzFt.avi", cAlternateFileName="WJACLB~1.AVI")) returned 1 [0171.451] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x557af1f0, ftCreationTime.dwHighDateTime=0x1d89925, ftLastAccessTime.dwLowDateTime=0xb442760, ftLastAccessTime.dwHighDateTime=0x1d8a4c8, ftLastWriteTime.dwLowDateTime=0xb442760, ftLastWriteTime.dwHighDateTime=0x1d8a4c8, nFileSizeHigh=0x0, nFileSizeLow=0xd13d, dwReserved0=0x0, dwReserved1=0x0, cFileName="XDhWSig8X1bcJSyZLqH.bmp", cAlternateFileName="XDHWSI~1.BMP")) returned 1 [0171.451] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc67a90f0, ftCreationTime.dwHighDateTime=0x1d89d52, ftLastAccessTime.dwLowDateTime=0xc6a6c430, ftLastAccessTime.dwHighDateTime=0x1d89eca, ftLastWriteTime.dwLowDateTime=0xc6a6c430, ftLastWriteTime.dwHighDateTime=0x1d89eca, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x0, cFileName="YRDE2fwY.bmp", cAlternateFileName="")) returned 1 [0171.451] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f89e9c0, ftCreationTime.dwHighDateTime=0x1d89bad, ftLastAccessTime.dwLowDateTime=0x4d456710, ftLastAccessTime.dwHighDateTime=0x1d8a31e, ftLastWriteTime.dwLowDateTime=0x4d456710, ftLastWriteTime.dwHighDateTime=0x1d8a31e, nFileSizeHigh=0x0, nFileSizeLow=0x736d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZcusZ5WCgLenzv.wav", cAlternateFileName="ZCUSZ5~1.WAV")) returned 1 [0171.451] FindNextFileW (in: hFindFile=0x5206b90, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f89e9c0, ftCreationTime.dwHighDateTime=0x1d89bad, ftLastAccessTime.dwLowDateTime=0x4d456710, ftLastAccessTime.dwHighDateTime=0x1d8a31e, ftLastWriteTime.dwLowDateTime=0x4d456710, ftLastWriteTime.dwHighDateTime=0x1d8a31e, nFileSizeHigh=0x0, nFileSizeLow=0x736d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZcusZ5WCgLenzv.wav", cAlternateFileName="ZCUSZ5~1.WAV")) returned 0 [0171.451] FindClose (in: hFindFile=0x5206b90 | out: hFindFile=0x5206b90) returned 1 [0171.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc60) returned 1 [0171.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc6c) returned 1 [0171.452] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe", nBufferLength=0x105, lpBuffer=0x19b784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x2b [0171.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.452] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x2b [0171.452] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\adobe\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5206650 [0171.453] FindNextFileW (in: hFindFile=0x5206650, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.453] FindNextFileW (in: hFindFile=0x5206650, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0171.454] FindNextFileW (in: hFindFile=0x5206650, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 0 [0171.454] FindClose (in: hFindFile=0x5206650 | out: hFindFile=0x5206650) returned 1 [0171.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc50) returned 1 [0171.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc5c) returned 1 [0171.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc10) returned 1 [0171.454] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe", nBufferLength=0x105, lpBuffer=0x19b6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x2b [0171.454] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\adobe\\*"), lpFindFileData=0x19b938 | out: lpFindFileData=0x19b938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5206590 [0171.455] FindNextFileW (in: hFindFile=0x5206590, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.455] FindNextFileW (in: hFindFile=0x5206590, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0171.455] FindNextFileW (in: hFindFile=0x5206590, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0171.455] FindClose (in: hFindFile=0x5206590 | out: hFindFile=0x5206590) returned 1 [0171.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbcc) returned 1 [0171.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbd8) returned 1 [0171.455] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\Flash Player", nBufferLength=0x105, lpBuffer=0x19b6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\Flash Player", lpFilePart=0x0) returned 0x38 [0171.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.456] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\Flash Player", nBufferLength=0x105, lpBuffer=0x19b6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\Flash Player", lpFilePart=0x0) returned 0x38 [0171.456] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\Flash Player\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\adobe\\flash player\\*"), lpFindFileData=0x19b928 | out: lpFindFileData=0x19b928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5206990 [0171.456] FindNextFileW (in: hFindFile=0x5206990, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.457] FindNextFileW (in: hFindFile=0x5206990, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NativeCache", cAlternateFileName="NATIVE~1")) returned 1 [0171.457] FindNextFileW (in: hFindFile=0x5206990, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NativeCache", cAlternateFileName="NATIVE~1")) returned 0 [0171.457] FindClose (in: hFindFile=0x5206990 | out: hFindFile=0x5206990) returned 1 [0171.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.457] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x19b784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x2f [0171.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.458] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x2f [0171.458] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x661c6965, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x661c6965, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5207190 [0171.458] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x661c6965, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x661c6965, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.458] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x811e1db4, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x811e1db4, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x811e1db4, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddIns", cAlternateFileName="")) returned 1 [0171.459] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80e898ff, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x80e898ff, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x80e9aa3d, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bibliography", cAlternateFileName="BIBLIO~1")) returned 1 [0171.459] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44687ae6, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x44687ae6, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0171.459] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x816a7a21, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x816a7a21, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x816a7a21, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Building Blocks", cAlternateFileName="DOCUME~1")) returned 1 [0171.459] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa92f1c4e, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x31c6a486, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x31c6a486, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel", cAlternateFileName="")) returned 1 [0171.459] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0171.460] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3704a98f, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x3704a98f, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x3704a98f, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMC", cAlternateFileName="")) returned 1 [0171.460] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f3fb46a, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6f3fb46a, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6f3fb46a, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0171.460] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80f7a98f, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa45e20df, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa45e20df, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0171.460] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x661c6965, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x661c6965, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x877953e5, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1 [0171.460] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44792966, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x50866c1c, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Protect", cAlternateFileName="")) returned 1 [0171.461] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563371fc, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x5635d3c1, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x5635d3c1, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling", cAlternateFileName="")) returned 1 [0171.461] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x5ec61c93, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5ec61c93, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5ec61c93, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemCertificates", cAlternateFileName="SYSTEM~1")) returned 1 [0171.461] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80b78b76, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x6aa33cc5, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x6aa33cc5, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0171.461] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb898985, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0171.461] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43708645, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43708645, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0171.462] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x811e4423, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x31c6a486, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x31c6a486, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word", cAlternateFileName="")) returned 1 [0171.462] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x811e4423, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x31c6a486, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x31c6a486, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word", cAlternateFileName="")) returned 0 [0171.462] FindClose (in: hFindFile=0x5207190 | out: hFindFile=0x5207190) returned 1 [0171.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc50) returned 1 [0171.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc5c) returned 1 [0171.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc10) returned 1 [0171.462] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x19b6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x2f [0171.462] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\*"), lpFindFileData=0x19b938 | out: lpFindFileData=0x19b938*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x661c6965, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x661c6965, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5207350 [0171.463] FindNextFileW (in: hFindFile=0x5207350, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x661c6965, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x661c6965, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.463] FindNextFileW (in: hFindFile=0x5207350, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x811e1db4, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x811e1db4, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x811e1db4, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddIns", cAlternateFileName="")) returned 1 [0171.463] FindNextFileW (in: hFindFile=0x5207350, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80e898ff, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x80e898ff, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x80e9aa3d, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bibliography", cAlternateFileName="BIBLIO~1")) returned 1 [0171.463] FindNextFileW (in: hFindFile=0x5207350, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44687ae6, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x44687ae6, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0171.464] FindNextFileW (in: hFindFile=0x5207350, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x816a7a21, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x816a7a21, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x816a7a21, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Building Blocks", cAlternateFileName="DOCUME~1")) returned 1 [0171.464] FindNextFileW (in: hFindFile=0x5207350, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa92f1c4e, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x31c6a486, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x31c6a486, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel", cAlternateFileName="")) returned 1 [0171.464] FindNextFileW (in: hFindFile=0x5207350, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0171.464] FindNextFileW (in: hFindFile=0x5207350, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3704a98f, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x3704a98f, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x3704a98f, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMC", cAlternateFileName="")) returned 1 [0171.464] FindNextFileW (in: hFindFile=0x5207350, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f3fb46a, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6f3fb46a, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6f3fb46a, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0171.465] FindNextFileW (in: hFindFile=0x5207350, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80f7a98f, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa45e20df, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa45e20df, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0171.465] FindNextFileW (in: hFindFile=0x5207350, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x661c6965, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x661c6965, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x877953e5, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1 [0171.465] FindNextFileW (in: hFindFile=0x5207350, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44792966, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x50866c1c, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Protect", cAlternateFileName="")) returned 1 [0171.465] FindNextFileW (in: hFindFile=0x5207350, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563371fc, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x5635d3c1, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x5635d3c1, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling", cAlternateFileName="")) returned 1 [0171.465] FindNextFileW (in: hFindFile=0x5207350, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x5ec61c93, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5ec61c93, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5ec61c93, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemCertificates", cAlternateFileName="SYSTEM~1")) returned 1 [0171.465] FindNextFileW (in: hFindFile=0x5207350, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80b78b76, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x6aa33cc5, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x6aa33cc5, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0171.466] FindNextFileW (in: hFindFile=0x5207350, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb898985, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0171.466] FindNextFileW (in: hFindFile=0x5207350, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43708645, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43708645, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0171.466] FindNextFileW (in: hFindFile=0x5207350, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x811e4423, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x31c6a486, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x31c6a486, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word", cAlternateFileName="")) returned 1 [0171.466] FindNextFileW (in: hFindFile=0x5207350, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0171.466] FindClose (in: hFindFile=0x5207350 | out: hFindFile=0x5207350) returned 1 [0171.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbcc) returned 1 [0171.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbd8) returned 1 [0171.466] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\AddIns", nBufferLength=0x105, lpBuffer=0x19b6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\AddIns", lpFilePart=0x0) returned 0x36 [0171.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.467] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\AddIns", nBufferLength=0x105, lpBuffer=0x19b6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\AddIns", lpFilePart=0x0) returned 0x36 [0171.467] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\AddIns\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\addins\\*"), lpFindFileData=0x19b928 | out: lpFindFileData=0x19b928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x811e1db4, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x811e1db4, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x811e1db4, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5206b50 [0171.467] FindNextFileW (in: hFindFile=0x5206b50, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x811e1db4, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x811e1db4, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x811e1db4, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.468] FindNextFileW (in: hFindFile=0x5206b50, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x811e1db4, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x811e1db4, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x811e1db4, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0171.468] FindClose (in: hFindFile=0x5206b50 | out: hFindFile=0x5206b50) returned 1 [0171.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.482] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Bibliography", nBufferLength=0x105, lpBuffer=0x19b6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Bibliography", lpFilePart=0x0) returned 0x3c [0171.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.482] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Bibliography", nBufferLength=0x105, lpBuffer=0x19b6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Bibliography", lpFilePart=0x0) returned 0x3c [0171.483] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Bibliography\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\bibliography\\*"), lpFindFileData=0x19b928 | out: lpFindFileData=0x19b928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80e898ff, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x80e898ff, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x80e9aa3d, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5206750 [0171.484] FindNextFileW (in: hFindFile=0x5206750, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80e898ff, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x80e898ff, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x80e9aa3d, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.484] FindNextFileW (in: hFindFile=0x5206750, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80e9aa3d, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x80e9aa3d, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x80ed2ca5, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Style", cAlternateFileName="")) returned 1 [0171.484] FindNextFileW (in: hFindFile=0x5206750, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80e9aa3d, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x80e9aa3d, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x80ed2ca5, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Style", cAlternateFileName="")) returned 0 [0171.484] FindClose (in: hFindFile=0x5206750 | out: hFindFile=0x5206750) returned 1 [0171.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.484] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x19b6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x3b [0171.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.485] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x19b6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x3b [0171.485] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\credentials\\*"), lpFindFileData=0x19b928 | out: lpFindFileData=0x19b928*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44687ae6, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x44687ae6, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5206e50 [0171.485] FindNextFileW (in: hFindFile=0x5206e50, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44687ae6, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x44687ae6, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.485] FindNextFileW (in: hFindFile=0x5206e50, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44687ae6, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x44687ae6, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0171.485] FindClose (in: hFindFile=0x5206e50 | out: hFindFile=0x5206e50) returned 1 [0171.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.485] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Document Building Blocks", nBufferLength=0x105, lpBuffer=0x19b6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpFilePart=0x0) returned 0x48 [0171.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.486] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Document Building Blocks", nBufferLength=0x105, lpBuffer=0x19b6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpFilePart=0x0) returned 0x48 [0171.486] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\document building blocks\\*"), lpFindFileData=0x19b928 | out: lpFindFileData=0x19b928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x816a7a21, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x816a7a21, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x81712f94, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5206e90 [0171.487] FindNextFileW (in: hFindFile=0x5206e90, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x816a7a21, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x816a7a21, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x81712f94, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.487] FindNextFileW (in: hFindFile=0x5206e90, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81712f94, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x81712f94, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x81712f94, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0171.487] FindNextFileW (in: hFindFile=0x5206e90, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81712f94, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x81712f94, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x81712f94, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0171.487] FindClose (in: hFindFile=0x5206e90 | out: hFindFile=0x5206e90) returned 1 [0171.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.488] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Excel", nBufferLength=0x105, lpBuffer=0x19b6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Excel", lpFilePart=0x0) returned 0x35 [0171.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.488] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Excel", nBufferLength=0x105, lpBuffer=0x19b6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Excel", lpFilePart=0x0) returned 0x35 [0171.488] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Excel\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\excel\\*"), lpFindFileData=0x19b928 | out: lpFindFileData=0x19b928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa92f1c4e, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x31c6a486, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x934f7bb4, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x52068d0 [0171.493] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa92f1c4e, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x31c6a486, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x934f7bb4, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.493] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934f7bb4, ftCreationTime.dwHighDateTime=0x1d7b063, ftLastAccessTime.dwLowDateTime=0x934f7bb4, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x934f7bb4, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSTART", cAlternateFileName="")) returned 1 [0171.494] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934f7bb4, ftCreationTime.dwHighDateTime=0x1d7b063, ftLastAccessTime.dwLowDateTime=0x934f7bb4, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x934f7bb4, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSTART", cAlternateFileName="")) returned 0 [0171.494] FindClose (in: hFindFile=0x52068d0 | out: hFindFile=0x52068d0) returned 1 [0171.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.494] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x19b6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x41 [0171.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.494] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x19b6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x41 [0171.494] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\internet explorer\\*"), lpFindFileData=0x19b928 | out: lpFindFileData=0x19b928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x52063d0 [0171.495] FindNextFileW (in: hFindFile=0x52063d0, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.495] FindNextFileW (in: hFindFile=0x52063d0, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6654de95, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x6654de95, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 1 [0171.495] FindNextFileW (in: hFindFile=0x52063d0, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserData", cAlternateFileName="")) returned 1 [0171.495] FindNextFileW (in: hFindFile=0x52063d0, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserData", cAlternateFileName="")) returned 0 [0171.495] FindClose (in: hFindFile=0x52063d0 | out: hFindFile=0x52063d0) returned 1 [0171.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.496] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\MMC", nBufferLength=0x105, lpBuffer=0x19b6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\MMC", lpFilePart=0x0) returned 0x33 [0171.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.496] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\MMC", nBufferLength=0x105, lpBuffer=0x19b6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\MMC", lpFilePart=0x0) returned 0x33 [0171.496] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\MMC\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\mmc\\*"), lpFindFileData=0x19b928 | out: lpFindFileData=0x19b928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3704a98f, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x3704a98f, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x3704a98f, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5206e10 [0171.498] FindNextFileW (in: hFindFile=0x5206e10, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3704a98f, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x3704a98f, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x3704a98f, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.498] FindNextFileW (in: hFindFile=0x5206e10, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3704a98f, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x3704a98f, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x3704a98f, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0171.498] FindClose (in: hFindFile=0x5206e10 | out: hFindFile=0x5206e10) returned 1 [0171.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.499] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x19b6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Network", lpFilePart=0x0) returned 0x37 [0171.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.499] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x19b6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Network", lpFilePart=0x0) returned 0x37 [0171.499] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Network\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\network\\*"), lpFindFileData=0x19b928 | out: lpFindFileData=0x19b928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f3fb46a, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6f3fb46a, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6f3fb46a, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5206c90 [0171.500] FindNextFileW (in: hFindFile=0x5206c90, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f3fb46a, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6f3fb46a, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6f3fb46a, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.500] FindNextFileW (in: hFindFile=0x5206c90, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f3fb46a, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6f3fb46a, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6f3fb46a, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0171.501] FindNextFileW (in: hFindFile=0x5206c90, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f3fb46a, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6f3fb46a, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6f3fb46a, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 0 [0171.501] FindClose (in: hFindFile=0x5206c90 | out: hFindFile=0x5206c90) returned 1 [0171.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.501] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x19b6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Office", lpFilePart=0x0) returned 0x36 [0171.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.501] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x19b6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Office", lpFilePart=0x0) returned 0x36 [0171.501] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Office\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\office\\*"), lpFindFileData=0x19b928 | out: lpFindFileData=0x19b928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80f7a98f, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa45e20df, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa45e20df, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5206d10 [0171.502] FindNextFileW (in: hFindFile=0x5206d10, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80f7a98f, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa45e20df, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa45e20df, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.502] FindNextFileW (in: hFindFile=0x5206d10, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80f81d62, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x80f81d62, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x80f83167, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x9362, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO1033.acl", cAlternateFileName="")) returned 1 [0171.503] FindNextFileW (in: hFindFile=0x5206d10, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa45e20df, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa4689310, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa4689310, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0171.503] FindNextFileW (in: hFindFile=0x5206d10, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa45e20df, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa4689310, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa4689310, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 0 [0171.504] FindClose (in: hFindFile=0x5206d10 | out: hFindFile=0x5206d10) returned 1 [0171.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.504] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x19b6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x37 [0171.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.504] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x19b6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x37 [0171.504] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Outlook\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\outlook\\*"), lpFindFileData=0x19b928 | out: lpFindFileData=0x19b928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x661c6965, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x661c6965, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x877953e5, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5206a10 [0171.505] FindNextFileW (in: hFindFile=0x5206a10, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x661c6965, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x661c6965, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x877953e5, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.505] FindNextFileW (in: hFindFile=0x5206a10, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6abbe5b6, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x6abbe5b6, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x6acd6e90, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.srs", cAlternateFileName="")) returned 1 [0171.506] FindNextFileW (in: hFindFile=0x5206a10, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x877953e5, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x877953e5, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x8864a351, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x956, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.xml", cAlternateFileName="")) returned 1 [0171.506] FindNextFileW (in: hFindFile=0x5206a10, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0171.506] FindClose (in: hFindFile=0x5206a10 | out: hFindFile=0x5206a10) returned 1 [0171.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.506] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect", nBufferLength=0x105, lpBuffer=0x19b6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect", lpFilePart=0x0) returned 0x37 [0171.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.506] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect", nBufferLength=0x105, lpBuffer=0x19b6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect", lpFilePart=0x0) returned 0x37 [0171.506] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\protect\\*"), lpFindFileData=0x19b928 | out: lpFindFileData=0x19b928*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x50866c1c, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x50866c1c, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x52064d0 [0171.507] FindNextFileW (in: hFindFile=0x52064d0, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x50866c1c, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x50866c1c, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.507] FindNextFileW (in: hFindFile=0x52064d0, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44792966, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xcf68faea, ftLastWriteTime.dwHighDateTime=0x1d85953, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="CREDHIST", cAlternateFileName="")) returned 1 [0171.507] FindNextFileW (in: hFindFile=0x52064d0, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x50866c1c, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x8060823c, ftLastAccessTime.dwHighDateTime=0x1d8a649, ftLastWriteTime.dwLowDateTime=0x8060823c, ftLastWriteTime.dwHighDateTime=0x1d8a649, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0171.507] FindNextFileW (in: hFindFile=0x52064d0, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44792966, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xcf753085, ftLastWriteTime.dwHighDateTime=0x1d85953, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SYNCHIST", cAlternateFileName="")) returned 1 [0171.508] FindNextFileW (in: hFindFile=0x52064d0, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0171.508] FindClose (in: hFindFile=0x52064d0 | out: hFindFile=0x52064d0) returned 1 [0171.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.508] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Spelling", nBufferLength=0x105, lpBuffer=0x19b6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Spelling", lpFilePart=0x0) returned 0x38 [0171.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.508] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Spelling", nBufferLength=0x105, lpBuffer=0x19b6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Spelling", lpFilePart=0x0) returned 0x38 [0171.508] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Spelling\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\spelling\\*"), lpFindFileData=0x19b928 | out: lpFindFileData=0x19b928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563371fc, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x5635d3c1, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x5635d3c1, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5207350 [0171.509] FindNextFileW (in: hFindFile=0x5207350, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563371fc, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x5635d3c1, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x5635d3c1, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.510] FindNextFileW (in: hFindFile=0x5207350, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5635d3c1, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x567d5b26, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x567d5b26, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0171.510] FindNextFileW (in: hFindFile=0x5207350, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5635d3c1, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x567d5b26, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x567d5b26, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0171.510] FindClose (in: hFindFile=0x5207350 | out: hFindFile=0x5207350) returned 1 [0171.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.510] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\SystemCertificates", nBufferLength=0x105, lpBuffer=0x19b6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpFilePart=0x0) returned 0x42 [0171.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.510] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\SystemCertificates", nBufferLength=0x105, lpBuffer=0x19b6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpFilePart=0x0) returned 0x42 [0171.510] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\systemcertificates\\*"), lpFindFileData=0x19b928 | out: lpFindFileData=0x19b928*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x5ec61c93, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5ec61c93, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5ec61c93, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x52070d0 [0171.511] FindNextFileW (in: hFindFile=0x52070d0, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x5ec61c93, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5ec61c93, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5ec61c93, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.511] FindNextFileW (in: hFindFile=0x52070d0, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x5ec61c93, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5ec61c93, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5ec61c93, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My", cAlternateFileName="")) returned 1 [0171.511] FindNextFileW (in: hFindFile=0x52070d0, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x5ec61c93, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5ec61c93, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5ec61c93, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My", cAlternateFileName="")) returned 0 [0171.512] FindClose (in: hFindFile=0x52070d0 | out: hFindFile=0x52070d0) returned 1 [0171.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.512] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates", nBufferLength=0x105, lpBuffer=0x19b6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates", lpFilePart=0x0) returned 0x39 [0171.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.512] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates", nBufferLength=0x105, lpBuffer=0x19b6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates", lpFilePart=0x0) returned 0x39 [0171.512] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\templates\\*"), lpFindFileData=0x19b928 | out: lpFindFileData=0x19b928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80b78b76, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x6aa33cc5, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x6aa33cc5, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5206d50 [0171.513] FindNextFileW (in: hFindFile=0x5206d50, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80b78b76, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x6aa33cc5, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x6aa33cc5, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.514] FindNextFileW (in: hFindFile=0x5206d50, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d61fa7, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96d61fa7, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96d61fa7, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LiveContent", cAlternateFileName="LIVECO~1")) returned 1 [0171.514] FindNextFileW (in: hFindFile=0x5206d50, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4614163, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa4614163, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa46a67ce, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x4641, dwReserved0=0x0, dwReserved1=0x0, cFileName="Normal.dotm", cAlternateFileName="NORMAL~1.DOT")) returned 1 [0171.514] FindNextFileW (in: hFindFile=0x5206d50, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0171.514] FindClose (in: hFindFile=0x5206d50 | out: hFindFile=0x5206d50) returned 1 [0171.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.515] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Vault", nBufferLength=0x105, lpBuffer=0x19b6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Vault", lpFilePart=0x0) returned 0x35 [0171.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.515] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Vault", nBufferLength=0x105, lpBuffer=0x19b6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Vault", lpFilePart=0x0) returned 0x35 [0171.516] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Vault\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\vault\\*"), lpFindFileData=0x19b928 | out: lpFindFileData=0x19b928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb898985, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5206950 [0171.516] FindNextFileW (in: hFindFile=0x5206950, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb898985, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.516] FindNextFileW (in: hFindFile=0x5206950, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb898985, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0171.516] FindClose (in: hFindFile=0x5206950 | out: hFindFile=0x5206950) returned 1 [0171.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.517] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x19b6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0x37 [0171.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.517] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x19b6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0x37 [0171.517] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\*"), lpFindFileData=0x19b928 | out: lpFindFileData=0x19b928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xaeb77be3, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0xaeb77be3, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x52068d0 [0171.517] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xaeb77be3, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0xaeb77be3, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.517] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43708645, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43708645, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43708645, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccountPictures", cAlternateFileName="ACCOUN~1")) returned 1 [0171.518] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x4347fe61, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2b1d2cc3, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1d8e71, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0171.518] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3ced6473, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Shortcuts", cAlternateFileName="NETWOR~1")) returned 1 [0171.518] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3ced6473, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Printer Shortcuts", cAlternateFileName="PRINTE~1")) returned 1 [0171.518] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xfa1f3254, ftLastAccessTime.dwHighDateTime=0x1d8a8f6, ftLastWriteTime.dwLowDateTime=0xfa1f3254, ftLastWriteTime.dwHighDateTime=0x1d8a8f6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0171.518] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x8c427141, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x8c473662, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0171.536] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0171.537] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3ced6473, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0171.537] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaeb77be3, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0xaebea315, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0xaebea315, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1 [0171.537] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaeb77be3, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0xaebea315, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0xaebea315, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0 [0171.538] FindClose (in: hFindFile=0x52068d0 | out: hFindFile=0x52068d0) returned 1 [0171.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.539] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Word", nBufferLength=0x105, lpBuffer=0x19b6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Word", lpFilePart=0x0) returned 0x34 [0171.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.539] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Word", nBufferLength=0x105, lpBuffer=0x19b6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Word", lpFilePart=0x0) returned 0x34 [0171.539] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Word\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\word\\*"), lpFindFileData=0x19b928 | out: lpFindFileData=0x19b928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x811e4423, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x31c6a486, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x669f9558, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5206790 [0171.540] FindNextFileW (in: hFindFile=0x5206790, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x811e4423, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x31c6a486, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x669f9558, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.540] FindNextFileW (in: hFindFile=0x5206790, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x669f9558, ftCreationTime.dwHighDateTime=0x1d8a651, ftLastAccessTime.dwLowDateTime=0x669f9558, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x669f9558, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STARTUP", cAlternateFileName="")) returned 1 [0171.541] FindNextFileW (in: hFindFile=0x5206790, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x669f9558, ftCreationTime.dwHighDateTime=0x1d8a651, ftLastAccessTime.dwLowDateTime=0x669f9558, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x669f9558, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STARTUP", cAlternateFileName="")) returned 0 [0171.541] FindClose (in: hFindFile=0x5206790 | out: hFindFile=0x5206790) returned 1 [0171.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.541] CoTaskMemAlloc (cb=0x20c) returned 0x51e9378 [0171.541] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x51e9378 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0171.541] CoTaskMemFree (pv=0x51e9378) [0171.542] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19b784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0171.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bca4) returned 1 [0171.542] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19b764, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0171.542] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\*"), lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x50b344cd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x50b344cd, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x52068d0 [0171.542] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x50b344cd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x50b344cd, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.542] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveSync", cAlternateFileName="ACTIVE~1")) returned 1 [0171.543] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0171.543] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x2397496d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x241f3052, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Comms", cAlternateFileName="")) returned 1 [0171.543] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0171.543] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xb1dfb94f, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0xb1dfb94f, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0xe24bf322, ftLastWriteTime.dwHighDateTime=0x1d8a73b, nFileSizeHigh=0x0, nFileSizeLow=0x68c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1 [0171.543] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6078303, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0171.544] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b344cd, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x50b344cd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x50b344cd, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~3")) returned 1 [0171.544] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4252734, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x4252734, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x4252734, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftEdge", cAlternateFileName="MICROS~2")) returned 1 [0171.544] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xddb04c43, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xddb04c43, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 1 [0171.544] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73f4dcd0, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73f4dcd0, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73f4dcd0, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PeerDistRepub", cAlternateFileName="PEERDI~1")) returned 1 [0171.544] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc699b5c, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xdc699b5c, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xdc699b5c, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publishers", cAlternateFileName="PUBLIS~1")) returned 1 [0171.545] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf6154ecf, ftLastAccessTime.dwHighDateTime=0x1d8a8f6, ftLastWriteTime.dwLowDateTime=0xf6154ecf, ftLastWriteTime.dwHighDateTime=0x1d8a8f6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0171.545] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0171.546] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40a64b1d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40a64b1d, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40a64b1d, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TileDataLayer", cAlternateFileName="TILEDA~1")) returned 1 [0171.546] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5599aefd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5599aefd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5599aefd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1 [0171.547] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b9d8 | out: lpFindFileData=0x19b9d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0171.547] FindClose (in: hFindFile=0x52068d0 | out: hFindFile=0x52068d0) returned 1 [0171.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc60) returned 1 [0171.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc6c) returned 1 [0171.548] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync", nBufferLength=0x105, lpBuffer=0x19b784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync", lpFilePart=0x0) returned 0x2e [0171.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.549] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync", lpFilePart=0x0) returned 0x2e [0171.549] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\activesync\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5206650 [0171.551] FindNextFileW (in: hFindFile=0x5206650, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.552] FindNextFileW (in: hFindFile=0x5206650, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0171.552] FindClose (in: hFindFile=0x5206650 | out: hFindFile=0x5206650) returned 1 [0171.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc50) returned 1 [0171.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc5c) returned 1 [0171.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc10) returned 1 [0171.553] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync", nBufferLength=0x105, lpBuffer=0x19b6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync", lpFilePart=0x0) returned 0x2e [0171.553] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\activesync\\*"), lpFindFileData=0x19b938 | out: lpFindFileData=0x19b938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x52068d0 [0171.553] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.554] FindNextFileW (in: hFindFile=0x52068d0, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0171.554] FindClose (in: hFindFile=0x52068d0 | out: hFindFile=0x52068d0) returned 1 [0171.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbcc) returned 1 [0171.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbd8) returned 1 [0171.554] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Application Data", nBufferLength=0x105, lpBuffer=0x19b784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Application Data", lpFilePart=0x0) returned 0x34 [0171.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.554] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Application Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Application Data", lpFilePart=0x0) returned 0x34 [0171.554] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Application Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\application data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.571] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms", nBufferLength=0x105, lpBuffer=0x19b784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms", lpFilePart=0x0) returned 0x29 [0171.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.571] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms", lpFilePart=0x0) returned 0x29 [0171.571] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x241f3052, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x241f3052, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5205300 [0171.572] FindNextFileW (in: hFindFile=0x5205300, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x241f3052, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x241f3052, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.599] FindNextFileW (in: hFindFile=0x5205300, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x241f3052, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x41637d0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x41637d0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0171.599] FindNextFileW (in: hFindFile=0x5205300, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c4973c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23c4973c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23c4973c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unistore", cAlternateFileName="")) returned 1 [0171.612] FindNextFileW (in: hFindFile=0x5205300, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x304e1230, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xe231b8a5, ftLastWriteTime.dwHighDateTime=0x1d8a73b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnistoreDB", cAlternateFileName="UNISTO~1")) returned 1 [0171.612] FindNextFileW (in: hFindFile=0x5205300, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x304e1230, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xe231b8a5, ftLastWriteTime.dwHighDateTime=0x1d8a73b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnistoreDB", cAlternateFileName="UNISTO~1")) returned 0 [0171.614] FindClose (in: hFindFile=0x5205300 | out: hFindFile=0x5205300) returned 1 [0171.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc50) returned 1 [0171.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc5c) returned 1 [0171.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc10) returned 1 [0171.615] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms", nBufferLength=0x105, lpBuffer=0x19b6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms", lpFilePart=0x0) returned 0x29 [0171.615] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\*"), lpFindFileData=0x19b938 | out: lpFindFileData=0x19b938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x241f3052, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x241f3052, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5205200 [0171.617] FindNextFileW (in: hFindFile=0x5205200, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x241f3052, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x241f3052, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.617] FindNextFileW (in: hFindFile=0x5205200, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x241f3052, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x41637d0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x41637d0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0171.618] FindNextFileW (in: hFindFile=0x5205200, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c4973c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23c4973c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23c4973c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unistore", cAlternateFileName="")) returned 1 [0171.618] FindNextFileW (in: hFindFile=0x5205200, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x304e1230, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xe231b8a5, ftLastWriteTime.dwHighDateTime=0x1d8a73b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnistoreDB", cAlternateFileName="UNISTO~1")) returned 1 [0171.618] FindNextFileW (in: hFindFile=0x5205200, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0171.619] FindClose (in: hFindFile=0x5205200 | out: hFindFile=0x5205200) returned 1 [0171.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbcc) returned 1 [0171.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbd8) returned 1 [0171.620] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Temp", nBufferLength=0x105, lpBuffer=0x19b6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Temp", lpFilePart=0x0) returned 0x2e [0171.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.620] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Temp", nBufferLength=0x105, lpBuffer=0x19b6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Temp", lpFilePart=0x0) returned 0x2e [0171.621] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Temp\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\temp\\*"), lpFindFileData=0x19b928 | out: lpFindFileData=0x19b928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x241f3052, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x41637d0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x77e259ad, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5205180 [0171.622] FindNextFileW (in: hFindFile=0x5205180, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x241f3052, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x41637d0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x77e259ad, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.623] FindNextFileW (in: hFindFile=0x5205180, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b315521, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x77e259ad, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0x77e26d5d, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarCache.dat", cAlternateFileName="CALEND~1.DAT")) returned 1 [0171.623] FindNextFileW (in: hFindFile=0x5205180, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0171.624] FindClose (in: hFindFile=0x5205180 | out: hFindFile=0x5205180) returned 1 [0171.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.625] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Unistore", nBufferLength=0x105, lpBuffer=0x19b6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Unistore", lpFilePart=0x0) returned 0x32 [0171.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.625] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Unistore", nBufferLength=0x105, lpBuffer=0x19b6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Unistore", lpFilePart=0x0) returned 0x32 [0171.625] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Unistore\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\unistore\\*"), lpFindFileData=0x19b928 | out: lpFindFileData=0x19b928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c4973c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23c4973c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23c4973c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5205000 [0171.627] FindNextFileW (in: hFindFile=0x5205000, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c4973c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23c4973c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23c4973c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.628] FindNextFileW (in: hFindFile=0x5205000, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c4973c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23c4973c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23c4973c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0171.630] FindClose (in: hFindFile=0x5205000 | out: hFindFile=0x5205000) returned 1 [0171.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.632] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB", nBufferLength=0x105, lpBuffer=0x19b6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB", lpFilePart=0x0) returned 0x34 [0171.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.632] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB", nBufferLength=0x105, lpBuffer=0x19b6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB", lpFilePart=0x0) returned 0x34 [0171.633] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\unistoredb\\*"), lpFindFileData=0x19b928 | out: lpFindFileData=0x19b928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x304e1230, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xe231b8a5, ftLastWriteTime.dwHighDateTime=0x1d8a73b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5204640 [0171.637] FindNextFileW (in: hFindFile=0x5204640, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x304e1230, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xe231b8a5, ftLastWriteTime.dwHighDateTime=0x1d8a73b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.638] FindNextFileW (in: hFindFile=0x5204640, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x23a0d188, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23a0d188, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0xe22f57b6, ftLastWriteTime.dwHighDateTime=0x1d8a73b, nFileSizeHigh=0x0, nFileSizeLow=0x600000, dwReserved0=0x0, dwReserved1=0x0, cFileName="store.vol", cAlternateFileName="")) returned 1 [0171.638] FindNextFileW (in: hFindFile=0x5204640, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239e71ab, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x239e71ab, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x9867d3ae, ftLastWriteTime.dwHighDateTime=0x1d8a73b, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="USS.chk", cAlternateFileName="")) returned 1 [0171.638] FindNextFileW (in: hFindFile=0x5204640, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2399ab8b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x2399ab8b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0xe22f57b6, ftLastWriteTime.dwHighDateTime=0x1d8a73b, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0x0, dwReserved1=0x0, cFileName="USS.log", cAlternateFileName="")) returned 1 [0171.639] FindNextFileW (in: hFindFile=0x5204640, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239c0dc2, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x239c0dc2, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x239c0dc2, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0x0, dwReserved1=0x0, cFileName="USSres00001.jrs", cAlternateFileName="USSRES~1.JRS")) returned 1 [0171.639] FindNextFileW (in: hFindFile=0x5204640, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239c0dc2, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x239c0dc2, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x239c0dc2, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0x0, dwReserved1=0x0, cFileName="USSres00002.jrs", cAlternateFileName="USSRES~2.JRS")) returned 1 [0171.639] FindNextFileW (in: hFindFile=0x5204640, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2399ab8b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x2399ab8b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0xdd289e64, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0x0, dwReserved1=0x0, cFileName="USStmp.log", cAlternateFileName="")) returned 1 [0171.639] FindNextFileW (in: hFindFile=0x5204640, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0171.640] FindClose (in: hFindFile=0x5204640 | out: hFindFile=0x5204640) returned 1 [0171.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.643] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\History", nBufferLength=0x105, lpBuffer=0x19b784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\History", lpFilePart=0x0) returned 0x2b [0171.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.648] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\History", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\History", lpFilePart=0x0) returned 0x2b [0171.648] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\History\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\history\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.650] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x19b784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x2d [0171.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.651] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x2d [0171.651] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x16fb902f, ftLastWriteTime.dwHighDateTime=0x1d8a8f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x52067d0 [0171.651] FindNextFileW (in: hFindFile=0x52067d0, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x16fb902f, ftLastWriteTime.dwHighDateTime=0x1d8a8f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.651] FindNextFileW (in: hFindFile=0x52067d0, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6078303, ftCreationTime.dwHighDateTime=0x1d8a64d, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6078303, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR_v2.0", cAlternateFileName="")) returned 1 [0171.651] FindNextFileW (in: hFindFile=0x52067d0, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x5b2eec3b, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR_v4.0", cAlternateFileName="")) returned 1 [0171.652] FindNextFileW (in: hFindFile=0x52067d0, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR_v4.0_32", cAlternateFileName="CLR_V4~1.0_3")) returned 1 [0171.652] FindNextFileW (in: hFindFile=0x52067d0, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x82fb51b0, ftLastAccessTime.dwHighDateTime=0x1d8a649, ftLastWriteTime.dwLowDateTime=0x82fb51b0, ftLastWriteTime.dwHighDateTime=0x1d8a649, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0171.652] FindNextFileW (in: hFindFile=0x52067d0, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x85138562, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x85138562, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds", cAlternateFileName="")) returned 1 [0171.652] FindNextFileW (in: hFindFile=0x52067d0, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x430ec4ba, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x85184b11, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x85184b11, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1 [0171.652] FindNextFileW (in: hFindFile=0x52067d0, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a17d745, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3a184b86, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a184b86, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORMS", cAlternateFileName="")) returned 1 [0171.652] FindNextFileW (in: hFindFile=0x52067d0, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809248a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xc7db342, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xc7db342, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameDVR", cAlternateFileName="")) returned 1 [0171.652] FindNextFileW (in: hFindFile=0x52067d0, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization", cAlternateFileName="INPUTP~1")) returned 1 [0171.652] FindNextFileW (in: hFindFile=0x52067d0, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InstallAgent", cAlternateFileName="INSTAL~1")) returned 1 [0171.652] FindNextFileW (in: hFindFile=0x52067d0, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4137bbef, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf7087f6c, ftLastAccessTime.dwHighDateTime=0x1d8a8f6, ftLastWriteTime.dwLowDateTime=0xf7087f6c, ftLastWriteTime.dwHighDateTime=0x1d8a8f6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0171.652] FindNextFileW (in: hFindFile=0x52067d0, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40f9be3f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40f9be3f, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0171.652] FindNextFileW (in: hFindFile=0x52067d0, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5781bc17, ftCreationTime.dwHighDateTime=0x1d7046d, ftLastAccessTime.dwLowDateTime=0x696efe32, ftLastAccessTime.dwHighDateTime=0x1d7046d, ftLastWriteTime.dwLowDateTime=0x696efe32, ftLastWriteTime.dwHighDateTime=0x1d7046d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0171.652] FindNextFileW (in: hFindFile=0x52067d0, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87b49234, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xb1ac323a, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xb2c68d12, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive", cAlternateFileName="")) returned 1 [0171.652] FindNextFileW (in: hFindFile=0x52067d0, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a11bc67, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x847a2bfc, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x847a2bfc, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1 [0171.652] FindNextFileW (in: hFindFile=0x52067d0, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PlayReady", cAlternateFileName="PLAYRE~1")) returned 1 [0171.653] FindNextFileW (in: hFindFile=0x52067d0, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb9574d8, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0171.653] FindNextFileW (in: hFindFile=0x52067d0, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x7edd1b23, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x7edd1b23, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0171.653] FindNextFileW (in: hFindFile=0x52067d0, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87ca06a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x87ca06a1, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x87ca06a1, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~2")) returned 1 [0171.653] FindNextFileW (in: hFindFile=0x52067d0, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d0c63cd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x377dee7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1 [0171.653] FindNextFileW (in: hFindFile=0x52067d0, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16fb902f, ftCreationTime.dwHighDateTime=0x1d8a8f7, ftLastAccessTime.dwLowDateTime=0x16fb902f, ftLastAccessTime.dwHighDateTime=0x1d8a8f7, ftLastWriteTime.dwLowDateTime=0x16fb902f, ftLastWriteTime.dwHighDateTime=0x1d8a8f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windоws", cAlternateFileName="WINDWS~1")) returned 1 [0171.653] FindNextFileW (in: hFindFile=0x52067d0, lpFindFileData=0x19b9c8 | out: lpFindFileData=0x19b9c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16fb902f, ftCreationTime.dwHighDateTime=0x1d8a8f7, ftLastAccessTime.dwLowDateTime=0x16fb902f, ftLastAccessTime.dwHighDateTime=0x1d8a8f7, ftLastWriteTime.dwLowDateTime=0x16fb902f, ftLastWriteTime.dwHighDateTime=0x1d8a8f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windоws", cAlternateFileName="WINDWS~1")) returned 0 [0171.653] FindClose (in: hFindFile=0x52067d0 | out: hFindFile=0x52067d0) returned 1 [0171.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc50) returned 1 [0171.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc5c) returned 1 [0171.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc10) returned 1 [0171.654] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x19b6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x2d [0171.654] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\*"), lpFindFileData=0x19b938 | out: lpFindFileData=0x19b938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x16fb902f, ftLastAccessTime.dwHighDateTime=0x1d8a8f7, ftLastWriteTime.dwLowDateTime=0x16fb902f, ftLastWriteTime.dwHighDateTime=0x1d8a8f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5207190 [0171.654] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x16fb902f, ftLastAccessTime.dwHighDateTime=0x1d8a8f7, ftLastWriteTime.dwLowDateTime=0x16fb902f, ftLastWriteTime.dwHighDateTime=0x1d8a8f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.654] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6078303, ftCreationTime.dwHighDateTime=0x1d8a64d, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6078303, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR_v2.0", cAlternateFileName="")) returned 1 [0171.654] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x5b2eec3b, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR_v4.0", cAlternateFileName="")) returned 1 [0171.654] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR_v4.0_32", cAlternateFileName="CLR_V4~1.0_3")) returned 1 [0171.654] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x82fb51b0, ftLastAccessTime.dwHighDateTime=0x1d8a649, ftLastWriteTime.dwLowDateTime=0x82fb51b0, ftLastWriteTime.dwHighDateTime=0x1d8a649, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0171.654] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x85138562, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x85138562, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds", cAlternateFileName="")) returned 1 [0171.655] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x430ec4ba, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x85184b11, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x85184b11, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1 [0171.655] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a17d745, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3a184b86, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a184b86, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORMS", cAlternateFileName="")) returned 1 [0171.655] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809248a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xc7db342, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xc7db342, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameDVR", cAlternateFileName="")) returned 1 [0171.655] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization", cAlternateFileName="INPUTP~1")) returned 1 [0171.655] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InstallAgent", cAlternateFileName="INSTAL~1")) returned 1 [0171.655] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4137bbef, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf7087f6c, ftLastAccessTime.dwHighDateTime=0x1d8a8f6, ftLastWriteTime.dwLowDateTime=0xf7087f6c, ftLastWriteTime.dwHighDateTime=0x1d8a8f6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0171.655] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40f9be3f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40f9be3f, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0171.655] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5781bc17, ftCreationTime.dwHighDateTime=0x1d7046d, ftLastAccessTime.dwLowDateTime=0x696efe32, ftLastAccessTime.dwHighDateTime=0x1d7046d, ftLastWriteTime.dwLowDateTime=0x696efe32, ftLastWriteTime.dwHighDateTime=0x1d7046d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0171.655] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87b49234, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xb1ac323a, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xb2c68d12, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive", cAlternateFileName="")) returned 1 [0171.655] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a11bc67, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x847a2bfc, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x847a2bfc, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1 [0171.655] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PlayReady", cAlternateFileName="PLAYRE~1")) returned 1 [0171.655] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb9574d8, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0171.655] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x7edd1b23, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x7edd1b23, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0171.656] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87ca06a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x87ca06a1, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x87ca06a1, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~2")) returned 1 [0171.656] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d0c63cd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x377dee7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1 [0171.656] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16fb902f, ftCreationTime.dwHighDateTime=0x1d8a8f7, ftLastAccessTime.dwLowDateTime=0x16fb902f, ftLastAccessTime.dwHighDateTime=0x1d8a8f7, ftLastWriteTime.dwLowDateTime=0x16fb902f, ftLastWriteTime.dwHighDateTime=0x1d8a8f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windоws", cAlternateFileName="WINDWS~1")) returned 1 [0171.656] FindNextFileW (in: hFindFile=0x5207190, lpFindFileData=0x19b944 | out: lpFindFileData=0x19b944*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0171.656] FindClose (in: hFindFile=0x5207190 | out: hFindFile=0x5207190) returned 1 [0171.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbcc) returned 1 [0171.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbd8) returned 1 [0171.656] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v2.0", nBufferLength=0x105, lpBuffer=0x19b6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v2.0", lpFilePart=0x0) returned 0x36 [0171.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.656] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v2.0", nBufferLength=0x105, lpBuffer=0x19b6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v2.0", lpFilePart=0x0) returned 0x36 [0171.656] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v2.0\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\clr_v2.0\\*"), lpFindFileData=0x19b928 | out: lpFindFileData=0x19b928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6078303, ftCreationTime.dwHighDateTime=0x1d8a64d, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6078303, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5206b50 [0171.657] FindNextFileW (in: hFindFile=0x5206b50, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6078303, ftCreationTime.dwHighDateTime=0x1d8a64d, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6078303, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.657] FindNextFileW (in: hFindFile=0x5206b50, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6078303, ftCreationTime.dwHighDateTime=0x1d8a64d, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6078303, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsageLogs", cAlternateFileName="USAGEL~1")) returned 1 [0171.657] FindNextFileW (in: hFindFile=0x5206b50, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6078303, ftCreationTime.dwHighDateTime=0x1d8a64d, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6078303, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsageLogs", cAlternateFileName="USAGEL~1")) returned 0 [0171.657] FindClose (in: hFindFile=0x5206b50 | out: hFindFile=0x5206b50) returned 1 [0171.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.657] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0", nBufferLength=0x105, lpBuffer=0x19b6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0", lpFilePart=0x0) returned 0x36 [0171.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.658] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0", nBufferLength=0x105, lpBuffer=0x19b6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0", lpFilePart=0x0) returned 0x36 [0171.658] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\clr_v4.0\\*"), lpFindFileData=0x19b928 | out: lpFindFileData=0x19b928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x5b2eec3b, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5206790 [0171.658] FindNextFileW (in: hFindFile=0x5206790, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x5b2eec3b, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.658] FindNextFileW (in: hFindFile=0x5206790, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x5b2eec3b, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsageLogs", cAlternateFileName="USAGEL~1")) returned 1 [0171.658] FindNextFileW (in: hFindFile=0x5206790, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x5b2eec3b, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsageLogs", cAlternateFileName="USAGEL~1")) returned 0 [0171.659] FindClose (in: hFindFile=0x5206790 | out: hFindFile=0x5206790) returned 1 [0171.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.659] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32", nBufferLength=0x105, lpBuffer=0x19b6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32", lpFilePart=0x0) returned 0x39 [0171.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.659] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32", nBufferLength=0x105, lpBuffer=0x19b6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32", lpFilePart=0x0) returned 0x39 [0171.659] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\clr_v4.0_32\\*"), lpFindFileData=0x19b928 | out: lpFindFileData=0x19b928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x52071d0 [0171.660] FindNextFileW (in: hFindFile=0x52071d0, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.660] FindNextFileW (in: hFindFile=0x52071d0, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsageLogs", cAlternateFileName="USAGEL~1")) returned 1 [0171.660] FindNextFileW (in: hFindFile=0x52071d0, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsageLogs", cAlternateFileName="USAGEL~1")) returned 0 [0171.660] FindClose (in: hFindFile=0x52071d0 | out: hFindFile=0x52071d0) returned 1 [0171.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.661] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x19b6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x39 [0171.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.661] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x19b6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x39 [0171.661] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\credentials\\*"), lpFindFileData=0x19b928 | out: lpFindFileData=0x19b928*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x82fb51b0, ftLastAccessTime.dwHighDateTime=0x1d8a649, ftLastWriteTime.dwLowDateTime=0x82fb51b0, ftLastWriteTime.dwHighDateTime=0x1d8a649, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5206590 [0171.661] FindNextFileW (in: hFindFile=0x5206590, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x82fb51b0, ftLastAccessTime.dwHighDateTime=0x1d8a649, ftLastWriteTime.dwLowDateTime=0x82fb51b0, ftLastWriteTime.dwHighDateTime=0x1d8a649, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.661] FindNextFileW (in: hFindFile=0x5206590, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x508b12b7, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x82fb3e5e, ftLastAccessTime.dwHighDateTime=0x1d8a649, ftLastWriteTime.dwLowDateTime=0x82fba0be, ftLastWriteTime.dwHighDateTime=0x1d8a649, nFileSizeHigh=0x0, nFileSizeLow=0x2ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DFBE70A7E5CC19A398EBF1B96859CE5D", cAlternateFileName="DFBE70~1")) returned 1 [0171.661] FindNextFileW (in: hFindFile=0x5206590, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0171.661] FindClose (in: hFindFile=0x5206590 | out: hFindFile=0x5206590) returned 1 [0171.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.662] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds", nBufferLength=0x105, lpBuffer=0x19b6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds", lpFilePart=0x0) returned 0x33 [0171.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.662] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds", nBufferLength=0x105, lpBuffer=0x19b6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds", lpFilePart=0x0) returned 0x33 [0171.662] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds\\*"), lpFindFileData=0x19b928 | out: lpFindFileData=0x19b928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x85138562, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x85138562, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5206cd0 [0171.662] FindNextFileW (in: hFindFile=0x5206cd0, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x85138562, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x85138562, ftLastWriteTime.dwHighDateTime=0x1d8a741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.662] FindNextFileW (in: hFindFile=0x5206cd0, lpFindFileData=0x19b934 | out: lpFindFileData=0x19b934*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85138562, ftCreationTime.dwHighDateTime=0x1d8a741, ftLastAccessTime.dwLowDateTime=0x85138562, ftLastAccessTime.dwHighDateTime=0x1d8a741, ftLastWriteTime.dwLowDateTime=0x170c3ffe, ftLastWriteTime.dwHighDateTime=0x1d8a8f7, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="FeedsStore.feedsdb-ms", cAlternateFileName="FEEDSS~1.FEE")) returned 1 [0171.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc50) returned 1 [0171.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc5c) returned 1 [0171.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc10) returned 1 [0171.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbcc) returned 1 [0171.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbd8) returned 1 [0171.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc50) returned 1 [0171.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc5c) returned 1 [0171.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc10) returned 1 [0171.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbcc) returned 1 [0171.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbd8) returned 1 [0171.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc50) returned 1 [0171.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc5c) returned 1 [0171.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc10) returned 1 [0171.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbcc) returned 1 [0171.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbd8) returned 1 [0171.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.718] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\*"), lpFindFileData=0x19b928 | out: lpFindFileData=0x19b928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a85f54c, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a91e2d1, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5b1c2a8e, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5207290 [0171.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbc8) returned 1 [0171.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc00) returned 1 [0171.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bbbc) returned 1 [0171.762] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer", nBufferLength=0x105, lpBuffer=0x19b784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer", lpFilePart=0x0) returned 0x31 [0171.813] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.813] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Battle.net", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Battle.net") returned 0x2f [0171.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.813] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Battle.net", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Battle.net", lpFilePart=0x0) returned 0x2e [0171.813] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Battle.net\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\battle.net\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.820] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.820] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Chromium\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data") returned 0x37 [0171.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.820] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data", lpFilePart=0x0) returned 0x36 [0171.820] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.822] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.822] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Google\\Chrome\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x3c [0171.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.822] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data", lpFilePart=0x0) returned 0x3b [0171.822] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.824] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.824] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Google(x86)\\Chrome\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google(x86)\\Chrome\\User Data") returned 0x41 [0171.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.824] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google(x86)\\Chrome\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google(x86)\\Chrome\\User Data", lpFilePart=0x0) returned 0x40 [0171.824] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google(x86)\\Chrome\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google(x86)\\chrome\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.826] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.826] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Opera Software\\", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\") returned 0x36 [0171.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.826] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\", lpFilePart=0x0) returned 0x35 [0171.826] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.828] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.828] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data") returned 0x45 [0171.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.828] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data", lpFilePart=0x0) returned 0x44 [0171.829] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\maplestudio\\chromeplus\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.830] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.830] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Iridium\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data") returned 0x36 [0171.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.831] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data", lpFilePart=0x0) returned 0x35 [0171.831] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\iridium\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.833] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.833] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\7Star\\7Star\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data") returned 0x3a [0171.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.833] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data", lpFilePart=0x0) returned 0x39 [0171.833] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.835] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.835] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\CentBrowser\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data") returned 0x3a [0171.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.835] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data", lpFilePart=0x0) returned 0x39 [0171.835] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.837] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.837] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Chedot\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data") returned 0x35 [0171.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.837] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data", lpFilePart=0x0) returned 0x34 [0171.837] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.839] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.839] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Vivaldi\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data") returned 0x36 [0171.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.839] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data", lpFilePart=0x0) returned 0x35 [0171.839] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.841] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.841] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Kometa\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data") returned 0x35 [0171.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.841] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data", lpFilePart=0x0) returned 0x34 [0171.842] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\kometa\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.843] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.843] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Elements Browser\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data") returned 0x3f [0171.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.844] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data", lpFilePart=0x0) returned 0x3e [0171.844] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\elements browser\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.845] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.845] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Epic Privacy Browser\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data") returned 0x43 [0171.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.846] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data", lpFilePart=0x0) returned 0x42 [0171.846] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.848] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.848] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\uCozMedia\\Uran\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data") returned 0x3d [0171.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.848] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data", lpFilePart=0x0) returned 0x3c [0171.848] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\ucozmedia\\uran\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.850] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.850] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer") returned 0x58 [0171.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.850] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer", lpFilePart=0x0) returned 0x57 [0171.850] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\fenrir inc\\sleipnir5\\setting\\modules\\chromiumviewer\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.852] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.852] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data") returned 0x43 [0171.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.852] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data", lpFilePart=0x0) returned 0x42 [0171.852] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\catalinagroup\\citrio\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.854] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.854] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Coowon\\Coowon\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data") returned 0x3c [0171.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.854] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data", lpFilePart=0x0) returned 0x3b [0171.854] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coowon\\coowon\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.856] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.856] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\liebao\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data") returned 0x35 [0171.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.856] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data", lpFilePart=0x0) returned 0x34 [0171.856] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\liebao\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.858] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.858] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\QIP Surf\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data") returned 0x37 [0171.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.858] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data", lpFilePart=0x0) returned 0x36 [0171.858] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\qip surf\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.860] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.860] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Orbitum\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data") returned 0x36 [0171.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.860] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data", lpFilePart=0x0) returned 0x35 [0171.860] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\orbitum\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.862] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.862] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Comodo\\Dragon\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data") returned 0x3c [0171.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.870] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data", lpFilePart=0x0) returned 0x3b [0171.871] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.873] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.873] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Amigo\\User\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User\\User Data") returned 0x39 [0171.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.873] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User\\User Data", lpFilePart=0x0) returned 0x38 [0171.873] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.875] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.875] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Torch\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data") returned 0x34 [0171.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.875] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data", lpFilePart=0x0) returned 0x33 [0171.875] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.877] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.877] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Yandex\\YandexBrowser\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data") returned 0x43 [0171.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.877] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data", lpFilePart=0x0) returned 0x42 [0171.877] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\yandex\\yandexbrowser\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.879] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.880] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Comodo\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\User Data") returned 0x35 [0171.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.880] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\User Data", lpFilePart=0x0) returned 0x34 [0171.880] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.882] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.882] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\360Browser\\Browser\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data") returned 0x41 [0171.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.882] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data", lpFilePart=0x0) returned 0x40 [0171.882] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\360browser\\browser\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.884] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.884] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Maxthon3\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon3\\User Data") returned 0x37 [0171.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.884] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon3\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon3\\User Data", lpFilePart=0x0) returned 0x36 [0171.884] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon3\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\maxthon3\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.886] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.886] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\K-Melon\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\K-Melon\\User Data") returned 0x36 [0171.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.886] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\K-Melon\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\K-Melon\\User Data", lpFilePart=0x0) returned 0x35 [0171.886] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\K-Melon\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\k-melon\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.888] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.888] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Sputnik\\Sputnik\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data") returned 0x3e [0171.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.888] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data", lpFilePart=0x0) returned 0x3d [0171.888] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\sputnik\\sputnik\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.890] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.890] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Nichrome\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data") returned 0x37 [0171.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.890] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data", lpFilePart=0x0) returned 0x36 [0171.890] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\nichrome\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.892] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.892] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\CocCoc\\Browser\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data") returned 0x3d [0171.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.892] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data", lpFilePart=0x0) returned 0x3c [0171.892] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.894] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.894] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Uran\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Uran\\User Data") returned 0x33 [0171.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.894] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Uran\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Uran\\User Data", lpFilePart=0x0) returned 0x32 [0171.894] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Uran\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\uran\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.896] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.896] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Chromodo\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromodo\\User Data") returned 0x37 [0171.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.896] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromodo\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromodo\\User Data", lpFilePart=0x0) returned 0x36 [0171.896] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromodo\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromodo\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.898] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.898] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Mail.Ru\\Atom\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mail.Ru\\Atom\\User Data") returned 0x3b [0171.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.898] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mail.Ru\\Atom\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mail.Ru\\Atom\\User Data", lpFilePart=0x0) returned 0x3a [0171.898] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mail.Ru\\Atom\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\mail.ru\\atom\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.900] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.900] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data") returned 0x4a [0171.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.900] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data", lpFilePart=0x0) returned 0x49 [0171.900] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\bravesoftware\\brave-browser\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.902] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.902] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Microsoft\\Edge\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data") returned 0x3d [0171.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.902] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data", lpFilePart=0x0) returned 0x3c [0171.903] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.904] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.904] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\NVIDIA Corporation\\NVIDIA GeForce Experience", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NVIDIA Corporation\\NVIDIA GeForce Experience") returned 0x51 [0171.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.905] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NVIDIA Corporation\\NVIDIA GeForce Experience", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NVIDIA Corporation\\NVIDIA GeForce Experience", lpFilePart=0x0) returned 0x50 [0171.905] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NVIDIA Corporation\\NVIDIA GeForce Experience\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\nvidia corporation\\nvidia geforce experience\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.906] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.906] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Steam", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Steam") returned 0x2a [0171.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.907] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Steam", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Steam", lpFilePart=0x0) returned 0x29 [0171.907] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Steam\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\steam\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0171.908] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0171.908] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\CryptoTab Browser\\User Data", lpDst=0x19bbf4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data") returned 0x40 [0171.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0171.909] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19b754, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data", lpFilePart=0x0) returned 0x3f [0171.909] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\cryptotab browser\\user data\\*"), lpFindFileData=0x19b9bc | out: lpFindFileData=0x19b9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0171.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc58) returned 1 [0172.345] ExpandEnvironmentStringsW (in: lpSrc="%appdata%", lpDst=0x19b840, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x26 [0172.345] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Armory", lpDst=0x19b840, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Armory") returned 0x2d [0172.502] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Armory", nBufferLength=0x105, lpBuffer=0x19b428, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Armory", lpFilePart=0x0) returned 0x2c [0172.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19b950) returned 1 [0172.637] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Armory", nBufferLength=0x105, lpBuffer=0x19b410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Armory", lpFilePart=0x0) returned 0x2c [0172.637] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Armory\\*.wallet" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\armory\\*.wallet"), lpFindFileData=0x19b678 | out: lpFindFileData=0x19b678*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0172.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19b914) returned 1 [0172.639] ExpandEnvironmentStringsW (in: lpSrc="%appdata%", lpDst=0x19b898, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x26 [0172.639] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\atomic", lpDst=0x19b898, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\atomic") returned 0x2d [0172.639] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\atomic", nBufferLength=0x105, lpBuffer=0x19b480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\atomic", lpFilePart=0x0) returned 0x2c [0172.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19b9ac) returned 1 [0172.641] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\atomic", nBufferLength=0x105, lpBuffer=0x19b46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\atomic", lpFilePart=0x0) returned 0x2c [0172.641] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\atomic\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\atomic\\*"), lpFindFileData=0x19b6d4 | out: lpFindFileData=0x19b6d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0172.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19b970) returned 1 [0172.643] ExpandEnvironmentStringsW (in: lpSrc="%appdata%", lpDst=0x19b898, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x26 [0172.643] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Binance", lpDst=0x19b898, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance") returned 0x2e [0172.643] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance", nBufferLength=0x105, lpBuffer=0x19b480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance", lpFilePart=0x0) returned 0x2d [0172.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19b9ac) returned 1 [0172.644] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance", nBufferLength=0x105, lpBuffer=0x19b46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance", lpFilePart=0x0) returned 0x2d [0172.644] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance\\*app-store*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\binance\\*app-store*"), lpFindFileData=0x19b6d4 | out: lpFindFileData=0x19b6d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0172.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19b970) returned 1 [0172.646] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x19b898, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x24 [0172.646] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%\\Coinomi\\Coinomi\\Cache", lpDst=0x19b898, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coinomi\\Coinomi\\Cache") returned 0x3a [0172.646] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coinomi\\Coinomi\\Cache", nBufferLength=0x105, lpBuffer=0x19b480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coinomi\\Coinomi\\Cache", lpFilePart=0x0) returned 0x39 [0172.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19b9ac) returned 1 [0172.646] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coinomi\\Coinomi\\Cache", nBufferLength=0x105, lpBuffer=0x19b46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coinomi\\Coinomi\\Cache", lpFilePart=0x0) returned 0x39 [0172.647] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coinomi\\Coinomi\\Cache\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coinomi\\coinomi\\cache\\*"), lpFindFileData=0x19b6d4 | out: lpFindFileData=0x19b6d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0172.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19b970) returned 1 [0172.648] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x19b898, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x24 [0172.648] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%\\Coinomi\\Coinomi\\db", lpDst=0x19b898, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coinomi\\Coinomi\\db") returned 0x37 [0172.649] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coinomi\\Coinomi\\db", nBufferLength=0x105, lpBuffer=0x19b480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coinomi\\Coinomi\\db", lpFilePart=0x0) returned 0x36 [0172.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19b9ac) returned 1 [0172.649] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coinomi\\Coinomi\\db", nBufferLength=0x105, lpBuffer=0x19b46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coinomi\\Coinomi\\db", lpFilePart=0x0) returned 0x36 [0172.649] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coinomi\\Coinomi\\db\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coinomi\\coinomi\\db\\*"), lpFindFileData=0x19b6d4 | out: lpFindFileData=0x19b6d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0172.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19b970) returned 1 [0172.651] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x19b898, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x24 [0172.651] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%\\Coinomi\\Coinomi\\wallets", lpDst=0x19b898, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coinomi\\Coinomi\\wallets") returned 0x3c [0172.651] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coinomi\\Coinomi\\wallets", nBufferLength=0x105, lpBuffer=0x19b480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coinomi\\Coinomi\\wallets", lpFilePart=0x0) returned 0x3b [0172.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19b9ac) returned 1 [0172.651] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coinomi\\Coinomi\\wallets", nBufferLength=0x105, lpBuffer=0x19b46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coinomi\\Coinomi\\wallets", lpFilePart=0x0) returned 0x3b [0172.651] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coinomi\\Coinomi\\wallets\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coinomi\\coinomi\\wallets\\*"), lpFindFileData=0x19b6d4 | out: lpFindFileData=0x19b6d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0172.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19b970) returned 1 [0172.654] ExpandEnvironmentStringsW (in: lpSrc="%appdata%", lpDst=0x19b898, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x26 [0172.654] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Electrum\\wallets", lpDst=0x19b898, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Electrum\\wallets") returned 0x37 [0172.654] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Electrum\\wallets", nBufferLength=0x105, lpBuffer=0x19b480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Electrum\\wallets", lpFilePart=0x0) returned 0x36 [0172.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19b9ac) returned 1 [0172.654] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Electrum\\wallets", nBufferLength=0x105, lpBuffer=0x19b46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Electrum\\wallets", lpFilePart=0x0) returned 0x36 [0172.655] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Electrum\\wallets\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\electrum\\wallets\\*"), lpFindFileData=0x19b6d4 | out: lpFindFileData=0x19b6d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0172.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19b970) returned 1 [0172.656] ExpandEnvironmentStringsW (in: lpSrc="%appdata%", lpDst=0x19b898, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x26 [0172.657] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Ethereum\\wallets", lpDst=0x19b898, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Ethereum\\wallets") returned 0x37 [0172.657] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Ethereum\\wallets", nBufferLength=0x105, lpBuffer=0x19b480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Ethereum\\wallets", lpFilePart=0x0) returned 0x36 [0172.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19b9ac) returned 1 [0172.657] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Ethereum\\wallets", nBufferLength=0x105, lpBuffer=0x19b46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Ethereum\\wallets", lpFilePart=0x0) returned 0x36 [0172.657] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Ethereum\\wallets\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\ethereum\\wallets\\*"), lpFindFileData=0x19b6d4 | out: lpFindFileData=0x19b6d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0172.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19b970) returned 1 [0172.659] ExpandEnvironmentStringsW (in: lpSrc="%appdata%", lpDst=0x19b898, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x26 [0172.660] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Exodus\\exodus.wallet", lpDst=0x19b898, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\exodus.wallet") returned 0x3b [0172.660] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\exodus.wallet", nBufferLength=0x105, lpBuffer=0x19b480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\exodus.wallet", lpFilePart=0x0) returned 0x3a [0172.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19b9ac) returned 1 [0172.660] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\exodus.wallet", nBufferLength=0x105, lpBuffer=0x19b46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\exodus.wallet", lpFilePart=0x0) returned 0x3a [0172.660] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\exodus.wallet\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\exodus\\exodus.wallet\\*"), lpFindFileData=0x19b6d4 | out: lpFindFileData=0x19b6d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0172.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19b970) returned 1 [0172.662] ExpandEnvironmentStringsW (in: lpSrc="%appdata%", lpDst=0x19b898, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x26 [0172.662] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Exodus", lpDst=0x19b898, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus") returned 0x2d [0172.662] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus", nBufferLength=0x105, lpBuffer=0x19b480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus", lpFilePart=0x0) returned 0x2c [0172.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19b9ac) returned 1 [0172.662] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus", nBufferLength=0x105, lpBuffer=0x19b46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus", lpFilePart=0x0) returned 0x2c [0172.662] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\*.json" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\exodus\\*.json"), lpFindFileData=0x19b6d4 | out: lpFindFileData=0x19b6d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0172.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19b970) returned 1 [0172.664] ExpandEnvironmentStringsW (in: lpSrc="%appdata%", lpDst=0x19b898, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x26 [0172.664] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Guarda", lpDst=0x19b898, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Guarda") returned 0x2d [0172.664] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Guarda", nBufferLength=0x105, lpBuffer=0x19b480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Guarda", lpFilePart=0x0) returned 0x2c [0172.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19b9ac) returned 1 [0172.664] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Guarda", nBufferLength=0x105, lpBuffer=0x19b46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Guarda", lpFilePart=0x0) returned 0x2c [0172.664] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Guarda\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\guarda\\*"), lpFindFileData=0x19b6d4 | out: lpFindFileData=0x19b6d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0172.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19b970) returned 1 [0172.666] ExpandEnvironmentStringsW (in: lpSrc="%appdata%", lpDst=0x19b898, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x26 [0172.666] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\com.liberty.jaxx", lpDst=0x19b898, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\com.liberty.jaxx") returned 0x37 [0172.666] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\com.liberty.jaxx", nBufferLength=0x105, lpBuffer=0x19b480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\com.liberty.jaxx", lpFilePart=0x0) returned 0x36 [0172.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19b9ac) returned 1 [0172.667] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\com.liberty.jaxx", nBufferLength=0x105, lpBuffer=0x19b46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\com.liberty.jaxx", lpFilePart=0x0) returned 0x36 [0172.667] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\com.liberty.jaxx\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\com.liberty.jaxx\\*"), lpFindFileData=0x19b6d4 | out: lpFindFileData=0x19b6d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0172.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19b970) returned 1 [0172.669] ExpandEnvironmentStringsW (in: lpSrc="%userprofile%", lpDst=0x19b898, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0172.669] ExpandEnvironmentStringsW (in: lpSrc="%userprofile%\\Documents\\Monero\\wallets", lpDst=0x19b898, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\Documents\\Monero\\wallets") returned 0x2f [0172.669] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Monero\\wallets", nBufferLength=0x105, lpBuffer=0x19b480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Monero\\wallets", lpFilePart=0x0) returned 0x2e [0172.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19b9ac) returned 1 [0172.669] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Monero\\wallets", nBufferLength=0x105, lpBuffer=0x19b46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Monero\\wallets", lpFilePart=0x0) returned 0x2e [0172.669] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Monero\\wallets\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\monero\\wallets\\*"), lpFindFileData=0x19b6d4 | out: lpFindFileData=0x19b6d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0172.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19b970) returned 1 [0172.821] ExpandEnvironmentStringsW (in: lpSrc="%userprofile%", lpDst=0x19bc60, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0172.824] ExpandEnvironmentStringsW (in: lpSrc="%userprofile%\\Desktop", lpDst=0x19bc60, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1e [0172.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd08) returned 1 [0172.846] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x105, lpBuffer=0x19b7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x0) returned 0x1d [0172.846] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\*.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\*.txt"), lpFindFileData=0x19ba30 | out: lpFindFileData=0x19ba30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0172.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcc4) returned 1 [0172.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcd0) returned 1 [0172.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd08) returned 1 [0172.848] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x105, lpBuffer=0x19b7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x0) returned 0x1d [0172.848] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\*.doc*" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\*.doc*"), lpFindFileData=0x19ba30 | out: lpFindFileData=0x19ba30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0172.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcc4) returned 1 [0172.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcd0) returned 1 [0172.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd08) returned 1 [0172.849] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x105, lpBuffer=0x19b7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x0) returned 0x1d [0172.849] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\*key*" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\*key*"), lpFindFileData=0x19ba30 | out: lpFindFileData=0x19ba30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0172.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcc4) returned 1 [0172.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcd0) returned 1 [0172.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd08) returned 1 [0172.850] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x105, lpBuffer=0x19b7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x0) returned 0x1d [0172.850] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\*wallet*" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\*wallet*"), lpFindFileData=0x19ba30 | out: lpFindFileData=0x19ba30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0172.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcc4) returned 1 [0172.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcd0) returned 1 [0172.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd08) returned 1 [0172.850] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x105, lpBuffer=0x19b7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x0) returned 0x1d [0172.851] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\*seed*" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\*seed*"), lpFindFileData=0x19ba30 | out: lpFindFileData=0x19ba30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0172.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcc4) returned 1 [0172.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcd0) returned 1 [0172.852] ExpandEnvironmentStringsW (in: lpSrc="%userprofile%", lpDst=0x19bc60, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0172.852] ExpandEnvironmentStringsW (in: lpSrc="%userprofile%\\Documents", lpDst=0x19bc60, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\Documents") returned 0x20 [0172.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd08) returned 1 [0172.852] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19b7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0172.852] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\*.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\*.txt"), lpFindFileData=0x19ba30 | out: lpFindFileData=0x19ba30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0172.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcc4) returned 1 [0172.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcd0) returned 1 [0172.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd08) returned 1 [0172.853] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19b7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0172.853] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\*.doc*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\*.doc*"), lpFindFileData=0x19ba30 | out: lpFindFileData=0x19ba30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde3e71f0, ftCreationTime.dwHighDateTime=0x1d894b7, ftLastAccessTime.dwLowDateTime=0xc1acbc10, ftLastAccessTime.dwHighDateTime=0x1d8a5e0, ftLastWriteTime.dwLowDateTime=0xc1acbc10, ftLastWriteTime.dwHighDateTime=0x1d8a5e0, nFileSizeHigh=0x0, nFileSizeLow=0x1097f, dwReserved0=0x0, dwReserved1=0x0, cFileName="0fWyuZd.docx", cAlternateFileName="0FWYUZ~1.DOC")) returned 0x5209a58 [0172.853] FindNextFileW (in: hFindFile=0x5209a58, lpFindFileData=0x19ba3c | out: lpFindFileData=0x19ba3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x326d0550, ftCreationTime.dwHighDateTime=0x1d86ada, ftLastAccessTime.dwLowDateTime=0xbdaa2d50, ftLastAccessTime.dwHighDateTime=0x1d8a374, ftLastWriteTime.dwLowDateTime=0xbdaa2d50, ftLastWriteTime.dwHighDateTime=0x1d8a374, nFileSizeHigh=0x0, nFileSizeLow=0x3cc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="3HPFAirf0UTD8-Kr.docx", cAlternateFileName="3HPFAI~1.DOC")) returned 1 [0172.854] FindNextFileW (in: hFindFile=0x5209a58, lpFindFileData=0x19ba3c | out: lpFindFileData=0x19ba3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26b15320, ftCreationTime.dwHighDateTime=0x1d89ca2, ftLastAccessTime.dwLowDateTime=0x58119de0, ftLastAccessTime.dwHighDateTime=0x1d89d00, ftLastWriteTime.dwLowDateTime=0x58119de0, ftLastWriteTime.dwHighDateTime=0x1d89d00, nFileSizeHigh=0x0, nFileSizeLow=0xfa02, dwReserved0=0x0, dwReserved1=0x0, cFileName="gJ7TfuVcPBj.doc", cAlternateFileName="GJ7TFU~1.DOC")) returned 1 [0172.854] FindNextFileW (in: hFindFile=0x5209a58, lpFindFileData=0x19ba3c | out: lpFindFileData=0x19ba3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x172ec0d0, ftCreationTime.dwHighDateTime=0x1d845a5, ftLastAccessTime.dwLowDateTime=0xae7ed10, ftLastAccessTime.dwHighDateTime=0x1d87df9, ftLastWriteTime.dwLowDateTime=0xae7ed10, ftLastWriteTime.dwHighDateTime=0x1d87df9, nFileSizeHigh=0x0, nFileSizeLow=0x2627, dwReserved0=0x0, dwReserved1=0x0, cFileName="omZO.docx", cAlternateFileName="OMZO~1.DOC")) returned 1 [0172.854] FindNextFileW (in: hFindFile=0x5209a58, lpFindFileData=0x19ba3c | out: lpFindFileData=0x19ba3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa916e250, ftCreationTime.dwHighDateTime=0x1d89f57, ftLastAccessTime.dwLowDateTime=0xdc1817b0, ftLastAccessTime.dwHighDateTime=0x1d8a0b9, ftLastWriteTime.dwLowDateTime=0xdc1817b0, ftLastWriteTime.dwHighDateTime=0x1d8a0b9, nFileSizeHigh=0x0, nFileSizeLow=0x16038, dwReserved0=0x0, dwReserved1=0x0, cFileName="qzbWVlst8_I0.doc", cAlternateFileName="QZBWVL~1.DOC")) returned 1 [0172.854] FindNextFileW (in: hFindFile=0x5209a58, lpFindFileData=0x19ba3c | out: lpFindFileData=0x19ba3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b4172c0, ftCreationTime.dwHighDateTime=0x1d81b00, ftLastAccessTime.dwLowDateTime=0xb7ce7c90, ftLastAccessTime.dwHighDateTime=0x1d880ad, ftLastWriteTime.dwLowDateTime=0xb7ce7c90, ftLastWriteTime.dwHighDateTime=0x1d880ad, nFileSizeHigh=0x0, nFileSizeLow=0x13732, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xy-laI7ayiBl5oks-Nw8.docx", cAlternateFileName="XY-LAI~1.DOC")) returned 1 [0172.854] FindNextFileW (in: hFindFile=0x5209a58, lpFindFileData=0x19ba3c | out: lpFindFileData=0x19ba3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57ead3c0, ftCreationTime.dwHighDateTime=0x1d8a2d9, ftLastAccessTime.dwLowDateTime=0x954af2b0, ftLastAccessTime.dwHighDateTime=0x1d8a732, ftLastWriteTime.dwLowDateTime=0x954af2b0, ftLastWriteTime.dwHighDateTime=0x1d8a732, nFileSizeHigh=0x0, nFileSizeLow=0x128b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="yW0xbZkSirlf.doc", cAlternateFileName="YW0XBZ~1.DOC")) returned 1 [0172.855] FindNextFileW (in: hFindFile=0x5209a58, lpFindFileData=0x19ba3c | out: lpFindFileData=0x19ba3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18b6e650, ftCreationTime.dwHighDateTime=0x1d8a3fe, ftLastAccessTime.dwLowDateTime=0x426b0930, ftLastAccessTime.dwHighDateTime=0x1d8a6fc, ftLastWriteTime.dwLowDateTime=0x426b0930, ftLastWriteTime.dwHighDateTime=0x1d8a6fc, nFileSizeHigh=0x0, nFileSizeLow=0x12860, dwReserved0=0x0, dwReserved1=0x0, cFileName="yXxiYuAm5i.doc", cAlternateFileName="YXXIYU~1.DOC")) returned 1 [0172.855] FindNextFileW (in: hFindFile=0x5209a58, lpFindFileData=0x19ba3c | out: lpFindFileData=0x19ba3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bddb6c0, ftCreationTime.dwHighDateTime=0x1d8582b, ftLastAccessTime.dwLowDateTime=0xaa5188e0, ftLastAccessTime.dwHighDateTime=0x1d86867, ftLastWriteTime.dwLowDateTime=0xaa5188e0, ftLastWriteTime.dwHighDateTime=0x1d86867, nFileSizeHigh=0x0, nFileSizeLow=0x124e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZA6cnG6lQJoZX9WTK987.docx", cAlternateFileName="ZA6CNG~1.DOC")) returned 1 [0172.855] FindNextFileW (in: hFindFile=0x5209a58, lpFindFileData=0x19ba3c | out: lpFindFileData=0x19ba3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41054690, ftCreationTime.dwHighDateTime=0x1d89fc8, ftLastAccessTime.dwLowDateTime=0xb6dfec00, ftLastAccessTime.dwHighDateTime=0x1d8a48a, ftLastWriteTime.dwLowDateTime=0xb6dfec00, ftLastWriteTime.dwHighDateTime=0x1d8a48a, nFileSizeHigh=0x0, nFileSizeLow=0x3fe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="_IhV.doc", cAlternateFileName="")) returned 1 [0172.855] FindNextFileW (in: hFindFile=0x5209a58, lpFindFileData=0x19ba3c | out: lpFindFileData=0x19ba3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0172.855] FindClose (in: hFindFile=0x5209a58 | out: hFindFile=0x5209a58) returned 1 [0172.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcc4) returned 1 [0172.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcd0) returned 1 [0172.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd08) returned 1 [0172.856] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19b7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0172.856] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\*key*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\*key*"), lpFindFileData=0x19ba30 | out: lpFindFileData=0x19ba30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0172.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcc4) returned 1 [0172.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcd0) returned 1 [0172.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd08) returned 1 [0172.856] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19b7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0172.856] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\*wallet*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\*wallet*"), lpFindFileData=0x19ba30 | out: lpFindFileData=0x19ba30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0172.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcc4) returned 1 [0172.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcd0) returned 1 [0172.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd08) returned 1 [0172.857] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19b7c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0172.857] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\*seed*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\*seed*"), lpFindFileData=0x19ba30 | out: lpFindFileData=0x19ba30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0172.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcc4) returned 1 [0172.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcd0) returned 1 [0172.857] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0fWyuZd.docx", nBufferLength=0x105, lpBuffer=0x19b85c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\0fWyuZd.docx", lpFilePart=0x0) returned 0x2c [0172.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd50) returned 1 [0172.857] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0fWyuZd.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\0fwyuzd.docx"), fInfoLevelId=0x0, lpFileInformation=0x2931860 | out: lpFileInformation=0x2931860*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde3e71f0, ftCreationTime.dwHighDateTime=0x1d894b7, ftLastAccessTime.dwLowDateTime=0xc1acbc10, ftLastAccessTime.dwHighDateTime=0x1d8a5e0, ftLastWriteTime.dwLowDateTime=0xc1acbc10, ftLastWriteTime.dwHighDateTime=0x1d8a5e0, nFileSizeHigh=0x0, nFileSizeLow=0x1097f)) returned 1 [0172.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bd4c) returned 1 [0172.858] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19b84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0172.864] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0fWyuZd.docx", nBufferLength=0x105, lpBuffer=0x19b848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\0fWyuZd.docx", lpFilePart=0x0) returned 0x2c [0172.877] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0fWyuZd.docx", nBufferLength=0x105, lpBuffer=0x19b818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\0fWyuZd.docx", lpFilePart=0x0) returned 0x2c [0172.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bcc0) returned 1 [0172.877] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0fWyuZd.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\0fwyuzd.docx"), fInfoLevelId=0x0, lpFileInformation=0x19bd3c | out: lpFileInformation=0x19bd3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde3e71f0, ftCreationTime.dwHighDateTime=0x1d894b7, ftLastAccessTime.dwLowDateTime=0xc1acbc10, ftLastAccessTime.dwHighDateTime=0x1d8a5e0, ftLastWriteTime.dwLowDateTime=0xc1acbc10, ftLastWriteTime.dwHighDateTime=0x1d8a5e0, nFileSizeHigh=0x0, nFileSizeLow=0x1097f)) returned 1 [0172.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcbc) returned 1 [0172.877] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0fWyuZd.docx", nBufferLength=0x105, lpBuffer=0x19b75c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\0fWyuZd.docx", lpFilePart=0x0) returned 0x2c [0172.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0172.877] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0fWyuZd.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\0fwyuzd.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x730 [0172.878] GetFileType (hFile=0x730) returned 0x1 [0172.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc90) returned 1 [0172.878] GetFileType (hFile=0x730) returned 0x1 [0172.883] ReadFile (in: hFile=0x730, lpBuffer=0x2932df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2932df8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.885] ReadFile (in: hFile=0x730, lpBuffer=0x2932df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2932df8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.885] ReadFile (in: hFile=0x730, lpBuffer=0x2932df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2932df8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.886] ReadFile (in: hFile=0x730, lpBuffer=0x2932df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2932df8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.886] ReadFile (in: hFile=0x730, lpBuffer=0x2932df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2932df8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.887] ReadFile (in: hFile=0x730, lpBuffer=0x2932df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2932df8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.888] ReadFile (in: hFile=0x730, lpBuffer=0x2932df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2932df8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.888] ReadFile (in: hFile=0x730, lpBuffer=0x2932df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2932df8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.889] ReadFile (in: hFile=0x730, lpBuffer=0x2932df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2932df8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.889] ReadFile (in: hFile=0x730, lpBuffer=0x2932df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2932df8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.890] ReadFile (in: hFile=0x730, lpBuffer=0x2932df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2932df8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.890] ReadFile (in: hFile=0x730, lpBuffer=0x2932df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2932df8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.890] ReadFile (in: hFile=0x730, lpBuffer=0x2932df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2932df8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.891] ReadFile (in: hFile=0x730, lpBuffer=0x2932df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2932df8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.892] ReadFile (in: hFile=0x730, lpBuffer=0x2932df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2932df8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.892] ReadFile (in: hFile=0x730, lpBuffer=0x2932df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2932df8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.893] ReadFile (in: hFile=0x730, lpBuffer=0x2932df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2932df8*, lpNumberOfBytesRead=0x19bcfc*=0x97f, lpOverlapped=0x0) returned 1 [0172.893] ReadFile (in: hFile=0x730, lpBuffer=0x293230b, nNumberOfBytesToRead=0x281, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x293230b*, lpNumberOfBytesRead=0x19bcfc*=0x0, lpOverlapped=0x0) returned 1 [0172.893] ReadFile (in: hFile=0x730, lpBuffer=0x2932df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2932df8*, lpNumberOfBytesRead=0x19bcfc*=0x0, lpOverlapped=0x0) returned 1 [0172.898] CloseHandle (hObject=0x730) returned 1 [0172.903] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\3HPFAirf0UTD8-Kr.docx", nBufferLength=0x105, lpBuffer=0x19b85c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\3HPFAirf0UTD8-Kr.docx", lpFilePart=0x0) returned 0x35 [0172.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd50) returned 1 [0172.904] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\3HPFAirf0UTD8-Kr.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\3hpfairf0utd8-kr.docx"), fInfoLevelId=0x0, lpFileInformation=0x2968598 | out: lpFileInformation=0x2968598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x326d0550, ftCreationTime.dwHighDateTime=0x1d86ada, ftLastAccessTime.dwLowDateTime=0xbdaa2d50, ftLastAccessTime.dwHighDateTime=0x1d8a374, ftLastWriteTime.dwLowDateTime=0xbdaa2d50, ftLastWriteTime.dwHighDateTime=0x1d8a374, nFileSizeHigh=0x0, nFileSizeLow=0x3cc4)) returned 1 [0172.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bd4c) returned 1 [0172.904] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19b84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0172.904] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\3HPFAirf0UTD8-Kr.docx", nBufferLength=0x105, lpBuffer=0x19b848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\3HPFAirf0UTD8-Kr.docx", lpFilePart=0x0) returned 0x35 [0172.904] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\3HPFAirf0UTD8-Kr.docx", nBufferLength=0x105, lpBuffer=0x19b818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\3HPFAirf0UTD8-Kr.docx", lpFilePart=0x0) returned 0x35 [0172.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bcc0) returned 1 [0172.904] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\3HPFAirf0UTD8-Kr.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\3hpfairf0utd8-kr.docx"), fInfoLevelId=0x0, lpFileInformation=0x19bd3c | out: lpFileInformation=0x19bd3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x326d0550, ftCreationTime.dwHighDateTime=0x1d86ada, ftLastAccessTime.dwLowDateTime=0xbdaa2d50, ftLastAccessTime.dwHighDateTime=0x1d8a374, ftLastWriteTime.dwLowDateTime=0xbdaa2d50, ftLastWriteTime.dwHighDateTime=0x1d8a374, nFileSizeHigh=0x0, nFileSizeLow=0x3cc4)) returned 1 [0172.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcbc) returned 1 [0172.904] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\3HPFAirf0UTD8-Kr.docx", nBufferLength=0x105, lpBuffer=0x19b75c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\3HPFAirf0UTD8-Kr.docx", lpFilePart=0x0) returned 0x35 [0172.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0172.905] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\3HPFAirf0UTD8-Kr.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\3hpfairf0utd8-kr.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x730 [0172.905] GetFileType (hFile=0x730) returned 0x1 [0172.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc90) returned 1 [0172.905] GetFileType (hFile=0x730) returned 0x1 [0172.905] ReadFile (in: hFile=0x730, lpBuffer=0x296998c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x296998c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.906] ReadFile (in: hFile=0x730, lpBuffer=0x296998c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x296998c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.907] ReadFile (in: hFile=0x730, lpBuffer=0x296998c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x296998c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.908] ReadFile (in: hFile=0x730, lpBuffer=0x296998c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x296998c*, lpNumberOfBytesRead=0x19bcfc*=0xcc4, lpOverlapped=0x0) returned 1 [0172.908] ReadFile (in: hFile=0x730, lpBuffer=0x2968df0, nNumberOfBytesToRead=0x33c, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2968df0*, lpNumberOfBytesRead=0x19bcfc*=0x0, lpOverlapped=0x0) returned 1 [0172.909] ReadFile (in: hFile=0x730, lpBuffer=0x296998c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x296998c*, lpNumberOfBytesRead=0x19bcfc*=0x0, lpOverlapped=0x0) returned 1 [0172.918] CloseHandle (hObject=0x730) returned 1 [0172.918] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\gJ7TfuVcPBj.doc", nBufferLength=0x105, lpBuffer=0x19b85c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\gJ7TfuVcPBj.doc", lpFilePart=0x0) returned 0x2f [0172.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd50) returned 1 [0172.918] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\gJ7TfuVcPBj.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\gj7tfuvcpbj.doc"), fInfoLevelId=0x0, lpFileInformation=0x27cae78 | out: lpFileInformation=0x27cae78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26b15320, ftCreationTime.dwHighDateTime=0x1d89ca2, ftLastAccessTime.dwLowDateTime=0x58119de0, ftLastAccessTime.dwHighDateTime=0x1d89d00, ftLastWriteTime.dwLowDateTime=0x58119de0, ftLastWriteTime.dwHighDateTime=0x1d89d00, nFileSizeHigh=0x0, nFileSizeLow=0xfa02)) returned 1 [0172.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bd4c) returned 1 [0172.918] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19b84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0172.918] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\gJ7TfuVcPBj.doc", nBufferLength=0x105, lpBuffer=0x19b848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\gJ7TfuVcPBj.doc", lpFilePart=0x0) returned 0x2f [0172.918] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\gJ7TfuVcPBj.doc", nBufferLength=0x105, lpBuffer=0x19b818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\gJ7TfuVcPBj.doc", lpFilePart=0x0) returned 0x2f [0172.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bcc0) returned 1 [0172.918] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\gJ7TfuVcPBj.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\gj7tfuvcpbj.doc"), fInfoLevelId=0x0, lpFileInformation=0x19bd3c | out: lpFileInformation=0x19bd3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26b15320, ftCreationTime.dwHighDateTime=0x1d89ca2, ftLastAccessTime.dwLowDateTime=0x58119de0, ftLastAccessTime.dwHighDateTime=0x1d89d00, ftLastWriteTime.dwLowDateTime=0x58119de0, ftLastWriteTime.dwHighDateTime=0x1d89d00, nFileSizeHigh=0x0, nFileSizeLow=0xfa02)) returned 1 [0172.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcbc) returned 1 [0172.919] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\gJ7TfuVcPBj.doc", nBufferLength=0x105, lpBuffer=0x19b75c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\gJ7TfuVcPBj.doc", lpFilePart=0x0) returned 0x2f [0172.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0172.919] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\gJ7TfuVcPBj.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\gj7tfuvcpbj.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x730 [0172.919] GetFileType (hFile=0x730) returned 0x1 [0172.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc90) returned 1 [0172.919] GetFileType (hFile=0x730) returned 0x1 [0172.919] ReadFile (in: hFile=0x730, lpBuffer=0x27cc20c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x27cc20c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.919] ReadFile (in: hFile=0x730, lpBuffer=0x27cc20c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x27cc20c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.920] ReadFile (in: hFile=0x730, lpBuffer=0x27cc20c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x27cc20c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.920] ReadFile (in: hFile=0x730, lpBuffer=0x27cc20c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x27cc20c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.920] ReadFile (in: hFile=0x730, lpBuffer=0x27cc20c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x27cc20c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.920] ReadFile (in: hFile=0x730, lpBuffer=0x27cc20c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x27cc20c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.921] ReadFile (in: hFile=0x730, lpBuffer=0x27cc20c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x27cc20c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.921] ReadFile (in: hFile=0x730, lpBuffer=0x27cc20c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x27cc20c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.921] ReadFile (in: hFile=0x730, lpBuffer=0x27cc20c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x27cc20c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.921] ReadFile (in: hFile=0x730, lpBuffer=0x27cc20c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x27cc20c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.922] ReadFile (in: hFile=0x730, lpBuffer=0x27cc20c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x27cc20c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.922] ReadFile (in: hFile=0x730, lpBuffer=0x27cc20c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x27cc20c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.922] ReadFile (in: hFile=0x730, lpBuffer=0x27cc20c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x27cc20c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.922] ReadFile (in: hFile=0x730, lpBuffer=0x27cc20c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x27cc20c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.923] ReadFile (in: hFile=0x730, lpBuffer=0x27cc20c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x27cc20c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.923] ReadFile (in: hFile=0x730, lpBuffer=0x27cc20c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x27cc20c*, lpNumberOfBytesRead=0x19bcfc*=0xa02, lpOverlapped=0x0) returned 1 [0172.923] ReadFile (in: hFile=0x730, lpBuffer=0x27cb7ae, nNumberOfBytesToRead=0x1fe, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x27cb7ae*, lpNumberOfBytesRead=0x19bcfc*=0x0, lpOverlapped=0x0) returned 1 [0172.923] ReadFile (in: hFile=0x730, lpBuffer=0x27cc20c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x27cc20c*, lpNumberOfBytesRead=0x19bcfc*=0x0, lpOverlapped=0x0) returned 1 [0172.926] CloseHandle (hObject=0x730) returned 1 [0172.926] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\omZO.docx", nBufferLength=0x105, lpBuffer=0x19b85c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\omZO.docx", lpFilePart=0x0) returned 0x29 [0172.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd50) returned 1 [0172.926] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\omZO.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\omzo.docx"), fInfoLevelId=0x0, lpFileInformation=0x27fc350 | out: lpFileInformation=0x27fc350*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x172ec0d0, ftCreationTime.dwHighDateTime=0x1d845a5, ftLastAccessTime.dwLowDateTime=0xae7ed10, ftLastAccessTime.dwHighDateTime=0x1d87df9, ftLastWriteTime.dwLowDateTime=0xae7ed10, ftLastWriteTime.dwHighDateTime=0x1d87df9, nFileSizeHigh=0x0, nFileSizeLow=0x2627)) returned 1 [0172.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bd4c) returned 1 [0172.926] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19b84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0172.926] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\omZO.docx", nBufferLength=0x105, lpBuffer=0x19b848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\omZO.docx", lpFilePart=0x0) returned 0x29 [0172.926] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\omZO.docx", nBufferLength=0x105, lpBuffer=0x19b818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\omZO.docx", lpFilePart=0x0) returned 0x29 [0172.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bcc0) returned 1 [0172.926] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\omZO.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\omzo.docx"), fInfoLevelId=0x0, lpFileInformation=0x19bd3c | out: lpFileInformation=0x19bd3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x172ec0d0, ftCreationTime.dwHighDateTime=0x1d845a5, ftLastAccessTime.dwLowDateTime=0xae7ed10, ftLastAccessTime.dwHighDateTime=0x1d87df9, ftLastWriteTime.dwLowDateTime=0xae7ed10, ftLastWriteTime.dwHighDateTime=0x1d87df9, nFileSizeHigh=0x0, nFileSizeLow=0x2627)) returned 1 [0172.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcbc) returned 1 [0172.926] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\omZO.docx", nBufferLength=0x105, lpBuffer=0x19b75c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\omZO.docx", lpFilePart=0x0) returned 0x29 [0172.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0172.927] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\omZO.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\omzo.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x730 [0172.927] GetFileType (hFile=0x730) returned 0x1 [0172.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc90) returned 1 [0172.927] GetFileType (hFile=0x730) returned 0x1 [0172.927] ReadFile (in: hFile=0x730, lpBuffer=0x27fd684, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x27fd684*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.928] ReadFile (in: hFile=0x730, lpBuffer=0x27fd684, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x27fd684*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.928] ReadFile (in: hFile=0x730, lpBuffer=0x27fd684, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x27fd684*, lpNumberOfBytesRead=0x19bcfc*=0x627, lpOverlapped=0x0) returned 1 [0172.928] ReadFile (in: hFile=0x730, lpBuffer=0x27fcc4b, nNumberOfBytesToRead=0x1d9, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x27fcc4b*, lpNumberOfBytesRead=0x19bcfc*=0x0, lpOverlapped=0x0) returned 1 [0172.928] ReadFile (in: hFile=0x730, lpBuffer=0x27fd684, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x27fd684*, lpNumberOfBytesRead=0x19bcfc*=0x0, lpOverlapped=0x0) returned 1 [0172.928] CloseHandle (hObject=0x730) returned 1 [0172.929] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\qzbWVlst8_I0.doc", nBufferLength=0x105, lpBuffer=0x19b85c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\qzbWVlst8_I0.doc", lpFilePart=0x0) returned 0x30 [0172.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd50) returned 1 [0172.929] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\qzbWVlst8_I0.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qzbwvlst8_i0.doc"), fInfoLevelId=0x0, lpFileInformation=0x280d858 | out: lpFileInformation=0x280d858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa916e250, ftCreationTime.dwHighDateTime=0x1d89f57, ftLastAccessTime.dwLowDateTime=0xdc1817b0, ftLastAccessTime.dwHighDateTime=0x1d8a0b9, ftLastWriteTime.dwLowDateTime=0xdc1817b0, ftLastWriteTime.dwHighDateTime=0x1d8a0b9, nFileSizeHigh=0x0, nFileSizeLow=0x16038)) returned 1 [0172.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bd4c) returned 1 [0172.929] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19b84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0172.929] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\qzbWVlst8_I0.doc", nBufferLength=0x105, lpBuffer=0x19b848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\qzbWVlst8_I0.doc", lpFilePart=0x0) returned 0x30 [0172.929] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\qzbWVlst8_I0.doc", nBufferLength=0x105, lpBuffer=0x19b818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\qzbWVlst8_I0.doc", lpFilePart=0x0) returned 0x30 [0172.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bcc0) returned 1 [0172.929] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\qzbWVlst8_I0.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qzbwvlst8_i0.doc"), fInfoLevelId=0x0, lpFileInformation=0x19bd3c | out: lpFileInformation=0x19bd3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa916e250, ftCreationTime.dwHighDateTime=0x1d89f57, ftLastAccessTime.dwLowDateTime=0xdc1817b0, ftLastAccessTime.dwHighDateTime=0x1d8a0b9, ftLastWriteTime.dwLowDateTime=0xdc1817b0, ftLastWriteTime.dwHighDateTime=0x1d8a0b9, nFileSizeHigh=0x0, nFileSizeLow=0x16038)) returned 1 [0172.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcbc) returned 1 [0172.929] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\qzbWVlst8_I0.doc", nBufferLength=0x105, lpBuffer=0x19b75c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\qzbWVlst8_I0.doc", lpFilePart=0x0) returned 0x30 [0172.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0172.929] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\qzbWVlst8_I0.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qzbwvlst8_i0.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x730 [0172.929] GetFileType (hFile=0x730) returned 0x1 [0172.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc90) returned 1 [0172.929] GetFileType (hFile=0x730) returned 0x1 [0172.930] ReadFile (in: hFile=0x730, lpBuffer=0x280ec0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x280ec0c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.930] ReadFile (in: hFile=0x730, lpBuffer=0x280ec0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x280ec0c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.930] ReadFile (in: hFile=0x730, lpBuffer=0x280ec0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x280ec0c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.930] ReadFile (in: hFile=0x730, lpBuffer=0x280ec0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x280ec0c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.931] ReadFile (in: hFile=0x730, lpBuffer=0x280ec0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x280ec0c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.931] ReadFile (in: hFile=0x730, lpBuffer=0x280ec0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x280ec0c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.931] ReadFile (in: hFile=0x730, lpBuffer=0x280ec0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x280ec0c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.931] ReadFile (in: hFile=0x730, lpBuffer=0x280ec0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x280ec0c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.932] ReadFile (in: hFile=0x730, lpBuffer=0x280ec0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x280ec0c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.932] ReadFile (in: hFile=0x730, lpBuffer=0x280ec0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x280ec0c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.932] ReadFile (in: hFile=0x730, lpBuffer=0x280ec0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x280ec0c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.932] ReadFile (in: hFile=0x730, lpBuffer=0x280ec0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x280ec0c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.933] ReadFile (in: hFile=0x730, lpBuffer=0x280ec0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x280ec0c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.933] ReadFile (in: hFile=0x730, lpBuffer=0x280ec0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x280ec0c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.933] ReadFile (in: hFile=0x730, lpBuffer=0x280ec0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x280ec0c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.933] ReadFile (in: hFile=0x730, lpBuffer=0x280ec0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x280ec0c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.933] ReadFile (in: hFile=0x730, lpBuffer=0x280ec0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x280ec0c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.934] ReadFile (in: hFile=0x730, lpBuffer=0x280ec0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x280ec0c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.934] ReadFile (in: hFile=0x730, lpBuffer=0x280ec0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x280ec0c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.934] ReadFile (in: hFile=0x730, lpBuffer=0x280ec0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x280ec0c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.934] ReadFile (in: hFile=0x730, lpBuffer=0x280ec0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x280ec0c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.934] ReadFile (in: hFile=0x730, lpBuffer=0x280ec0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x280ec0c*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.934] ReadFile (in: hFile=0x730, lpBuffer=0x280ec0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x280ec0c*, lpNumberOfBytesRead=0x19bcfc*=0x38, lpOverlapped=0x0) returned 1 [0172.934] ReadFile (in: hFile=0x730, lpBuffer=0x280ec0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x280ec0c*, lpNumberOfBytesRead=0x19bcfc*=0x0, lpOverlapped=0x0) returned 1 [0172.939] CloseHandle (hObject=0x730) returned 1 [0172.939] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Xy-laI7ayiBl5oks-Nw8.docx", nBufferLength=0x105, lpBuffer=0x19b85c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Xy-laI7ayiBl5oks-Nw8.docx", lpFilePart=0x0) returned 0x39 [0172.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd50) returned 1 [0172.939] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Xy-laI7ayiBl5oks-Nw8.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\xy-lai7ayibl5oks-nw8.docx"), fInfoLevelId=0x0, lpFileInformation=0x283ee0c | out: lpFileInformation=0x283ee0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b4172c0, ftCreationTime.dwHighDateTime=0x1d81b00, ftLastAccessTime.dwLowDateTime=0xb7ce7c90, ftLastAccessTime.dwHighDateTime=0x1d880ad, ftLastWriteTime.dwLowDateTime=0xb7ce7c90, ftLastWriteTime.dwHighDateTime=0x1d880ad, nFileSizeHigh=0x0, nFileSizeLow=0x13732)) returned 1 [0172.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bd4c) returned 1 [0172.939] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19b84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0172.939] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Xy-laI7ayiBl5oks-Nw8.docx", nBufferLength=0x105, lpBuffer=0x19b848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Xy-laI7ayiBl5oks-Nw8.docx", lpFilePart=0x0) returned 0x39 [0172.939] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Xy-laI7ayiBl5oks-Nw8.docx", nBufferLength=0x105, lpBuffer=0x19b818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Xy-laI7ayiBl5oks-Nw8.docx", lpFilePart=0x0) returned 0x39 [0172.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bcc0) returned 1 [0172.939] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Xy-laI7ayiBl5oks-Nw8.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\xy-lai7ayibl5oks-nw8.docx"), fInfoLevelId=0x0, lpFileInformation=0x19bd3c | out: lpFileInformation=0x19bd3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b4172c0, ftCreationTime.dwHighDateTime=0x1d81b00, ftLastAccessTime.dwLowDateTime=0xb7ce7c90, ftLastAccessTime.dwHighDateTime=0x1d880ad, ftLastWriteTime.dwLowDateTime=0xb7ce7c90, ftLastWriteTime.dwHighDateTime=0x1d880ad, nFileSizeHigh=0x0, nFileSizeLow=0x13732)) returned 1 [0172.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcbc) returned 1 [0172.939] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Xy-laI7ayiBl5oks-Nw8.docx", nBufferLength=0x105, lpBuffer=0x19b75c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Xy-laI7ayiBl5oks-Nw8.docx", lpFilePart=0x0) returned 0x39 [0172.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0172.940] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Xy-laI7ayiBl5oks-Nw8.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\xy-lai7ayibl5oks-nw8.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x730 [0172.940] GetFileType (hFile=0x730) returned 0x1 [0172.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc90) returned 1 [0172.940] GetFileType (hFile=0x730) returned 0x1 [0172.940] ReadFile (in: hFile=0x730, lpBuffer=0x2840240, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2840240*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.941] ReadFile (in: hFile=0x730, lpBuffer=0x2840240, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2840240*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.941] ReadFile (in: hFile=0x730, lpBuffer=0x2840240, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2840240*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.941] ReadFile (in: hFile=0x730, lpBuffer=0x2840240, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2840240*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.942] ReadFile (in: hFile=0x730, lpBuffer=0x2840240, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2840240*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.942] ReadFile (in: hFile=0x730, lpBuffer=0x2840240, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2840240*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.942] ReadFile (in: hFile=0x730, lpBuffer=0x2840240, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2840240*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.942] ReadFile (in: hFile=0x730, lpBuffer=0x2840240, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2840240*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.942] ReadFile (in: hFile=0x730, lpBuffer=0x2840240, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2840240*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.942] ReadFile (in: hFile=0x730, lpBuffer=0x2840240, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2840240*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.942] ReadFile (in: hFile=0x730, lpBuffer=0x2840240, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2840240*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.943] ReadFile (in: hFile=0x730, lpBuffer=0x2840240, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2840240*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.943] ReadFile (in: hFile=0x730, lpBuffer=0x2840240, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2840240*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.943] ReadFile (in: hFile=0x730, lpBuffer=0x2840240, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2840240*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.943] ReadFile (in: hFile=0x730, lpBuffer=0x2840240, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2840240*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.943] ReadFile (in: hFile=0x730, lpBuffer=0x2840240, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2840240*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.943] ReadFile (in: hFile=0x730, lpBuffer=0x2840240, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2840240*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.943] ReadFile (in: hFile=0x730, lpBuffer=0x2840240, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2840240*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.944] ReadFile (in: hFile=0x730, lpBuffer=0x2840240, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2840240*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.944] ReadFile (in: hFile=0x730, lpBuffer=0x2840240, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2840240*, lpNumberOfBytesRead=0x19bcfc*=0x732, lpOverlapped=0x0) returned 1 [0172.944] ReadFile (in: hFile=0x730, lpBuffer=0x283f912, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x283f912*, lpNumberOfBytesRead=0x19bcfc*=0x0, lpOverlapped=0x0) returned 1 [0172.944] ReadFile (in: hFile=0x730, lpBuffer=0x2840240, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x2840240*, lpNumberOfBytesRead=0x19bcfc*=0x0, lpOverlapped=0x0) returned 1 [0172.947] CloseHandle (hObject=0x730) returned 1 [0172.947] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\yW0xbZkSirlf.doc", nBufferLength=0x105, lpBuffer=0x19b85c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\yW0xbZkSirlf.doc", lpFilePart=0x0) returned 0x30 [0172.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd50) returned 1 [0172.947] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\yW0xbZkSirlf.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\yw0xbzksirlf.doc"), fInfoLevelId=0x0, lpFileInformation=0x287be04 | out: lpFileInformation=0x287be04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57ead3c0, ftCreationTime.dwHighDateTime=0x1d8a2d9, ftLastAccessTime.dwLowDateTime=0x954af2b0, ftLastAccessTime.dwHighDateTime=0x1d8a732, ftLastWriteTime.dwLowDateTime=0x954af2b0, ftLastWriteTime.dwHighDateTime=0x1d8a732, nFileSizeHigh=0x0, nFileSizeLow=0x128b8)) returned 1 [0172.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bd4c) returned 1 [0172.947] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19b84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0172.947] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\yW0xbZkSirlf.doc", nBufferLength=0x105, lpBuffer=0x19b848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\yW0xbZkSirlf.doc", lpFilePart=0x0) returned 0x30 [0172.947] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\yW0xbZkSirlf.doc", nBufferLength=0x105, lpBuffer=0x19b818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\yW0xbZkSirlf.doc", lpFilePart=0x0) returned 0x30 [0172.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bcc0) returned 1 [0172.948] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\yW0xbZkSirlf.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\yw0xbzksirlf.doc"), fInfoLevelId=0x0, lpFileInformation=0x19bd3c | out: lpFileInformation=0x19bd3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57ead3c0, ftCreationTime.dwHighDateTime=0x1d8a2d9, ftLastAccessTime.dwLowDateTime=0x954af2b0, ftLastAccessTime.dwHighDateTime=0x1d8a732, ftLastWriteTime.dwLowDateTime=0x954af2b0, ftLastWriteTime.dwHighDateTime=0x1d8a732, nFileSizeHigh=0x0, nFileSizeLow=0x128b8)) returned 1 [0172.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcbc) returned 1 [0172.948] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\yW0xbZkSirlf.doc", nBufferLength=0x105, lpBuffer=0x19b75c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\yW0xbZkSirlf.doc", lpFilePart=0x0) returned 0x30 [0172.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0172.948] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\yW0xbZkSirlf.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\yw0xbzksirlf.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x730 [0172.948] GetFileType (hFile=0x730) returned 0x1 [0172.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc90) returned 1 [0172.948] GetFileType (hFile=0x730) returned 0x1 [0172.948] ReadFile (in: hFile=0x730, lpBuffer=0x287d1b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x287d1b8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.948] ReadFile (in: hFile=0x730, lpBuffer=0x287d1b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x287d1b8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.948] ReadFile (in: hFile=0x730, lpBuffer=0x287d1b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x287d1b8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.949] ReadFile (in: hFile=0x730, lpBuffer=0x287d1b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x287d1b8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.949] ReadFile (in: hFile=0x730, lpBuffer=0x287d1b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x287d1b8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.949] ReadFile (in: hFile=0x730, lpBuffer=0x287d1b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x287d1b8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.949] ReadFile (in: hFile=0x730, lpBuffer=0x287d1b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x287d1b8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.949] ReadFile (in: hFile=0x730, lpBuffer=0x287d1b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x287d1b8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.949] ReadFile (in: hFile=0x730, lpBuffer=0x287d1b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x287d1b8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.949] ReadFile (in: hFile=0x730, lpBuffer=0x287d1b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x287d1b8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.949] ReadFile (in: hFile=0x730, lpBuffer=0x287d1b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x287d1b8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.950] ReadFile (in: hFile=0x730, lpBuffer=0x287d1b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x287d1b8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.950] ReadFile (in: hFile=0x730, lpBuffer=0x287d1b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x287d1b8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.950] ReadFile (in: hFile=0x730, lpBuffer=0x287d1b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x287d1b8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.950] ReadFile (in: hFile=0x730, lpBuffer=0x287d1b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x287d1b8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.950] ReadFile (in: hFile=0x730, lpBuffer=0x287d1b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x287d1b8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.950] ReadFile (in: hFile=0x730, lpBuffer=0x287d1b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x287d1b8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.950] ReadFile (in: hFile=0x730, lpBuffer=0x287d1b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x287d1b8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.950] ReadFile (in: hFile=0x730, lpBuffer=0x287d1b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x287d1b8*, lpNumberOfBytesRead=0x19bcfc*=0x8b8, lpOverlapped=0x0) returned 1 [0172.951] ReadFile (in: hFile=0x730, lpBuffer=0x287c610, nNumberOfBytesToRead=0x348, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x287c610*, lpNumberOfBytesRead=0x19bcfc*=0x0, lpOverlapped=0x0) returned 1 [0172.951] ReadFile (in: hFile=0x730, lpBuffer=0x287d1b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x287d1b8*, lpNumberOfBytesRead=0x19bcfc*=0x0, lpOverlapped=0x0) returned 1 [0172.953] CloseHandle (hObject=0x730) returned 1 [0172.953] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\yXxiYuAm5i.doc", nBufferLength=0x105, lpBuffer=0x19b85c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\yXxiYuAm5i.doc", lpFilePart=0x0) returned 0x2e [0172.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd50) returned 1 [0172.953] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\yXxiYuAm5i.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\yxxiyuam5i.doc"), fInfoLevelId=0x0, lpFileInformation=0x28b7f00 | out: lpFileInformation=0x28b7f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18b6e650, ftCreationTime.dwHighDateTime=0x1d8a3fe, ftLastAccessTime.dwLowDateTime=0x426b0930, ftLastAccessTime.dwHighDateTime=0x1d8a6fc, ftLastWriteTime.dwLowDateTime=0x426b0930, ftLastWriteTime.dwHighDateTime=0x1d8a6fc, nFileSizeHigh=0x0, nFileSizeLow=0x12860)) returned 1 [0172.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bd4c) returned 1 [0172.954] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19b84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0172.954] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\yXxiYuAm5i.doc", nBufferLength=0x105, lpBuffer=0x19b848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\yXxiYuAm5i.doc", lpFilePart=0x0) returned 0x2e [0172.954] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\yXxiYuAm5i.doc", nBufferLength=0x105, lpBuffer=0x19b818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\yXxiYuAm5i.doc", lpFilePart=0x0) returned 0x2e [0172.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bcc0) returned 1 [0172.954] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\yXxiYuAm5i.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\yxxiyuam5i.doc"), fInfoLevelId=0x0, lpFileInformation=0x19bd3c | out: lpFileInformation=0x19bd3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18b6e650, ftCreationTime.dwHighDateTime=0x1d8a3fe, ftLastAccessTime.dwLowDateTime=0x426b0930, ftLastAccessTime.dwHighDateTime=0x1d8a6fc, ftLastWriteTime.dwLowDateTime=0x426b0930, ftLastWriteTime.dwHighDateTime=0x1d8a6fc, nFileSizeHigh=0x0, nFileSizeLow=0x12860)) returned 1 [0172.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcbc) returned 1 [0172.954] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\yXxiYuAm5i.doc", nBufferLength=0x105, lpBuffer=0x19b75c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\yXxiYuAm5i.doc", lpFilePart=0x0) returned 0x2e [0172.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0172.954] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\yXxiYuAm5i.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\yxxiyuam5i.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x730 [0172.954] GetFileType (hFile=0x730) returned 0x1 [0172.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc90) returned 1 [0172.954] GetFileType (hFile=0x730) returned 0x1 [0172.955] ReadFile (in: hFile=0x730, lpBuffer=0x28b9294, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x28b9294*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.955] ReadFile (in: hFile=0x730, lpBuffer=0x28b9294, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x28b9294*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.955] ReadFile (in: hFile=0x730, lpBuffer=0x28b9294, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x28b9294*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.955] ReadFile (in: hFile=0x730, lpBuffer=0x28b9294, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x28b9294*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.955] ReadFile (in: hFile=0x730, lpBuffer=0x28b9294, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x28b9294*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.955] ReadFile (in: hFile=0x730, lpBuffer=0x28b9294, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x28b9294*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.955] ReadFile (in: hFile=0x730, lpBuffer=0x28b9294, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x28b9294*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.955] ReadFile (in: hFile=0x730, lpBuffer=0x28b9294, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x28b9294*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.956] ReadFile (in: hFile=0x730, lpBuffer=0x28b9294, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x28b9294*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.956] ReadFile (in: hFile=0x730, lpBuffer=0x28b9294, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x28b9294*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.956] ReadFile (in: hFile=0x730, lpBuffer=0x28b9294, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x28b9294*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.956] ReadFile (in: hFile=0x730, lpBuffer=0x28b9294, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x28b9294*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.967] ReadFile (in: hFile=0x730, lpBuffer=0x28b9294, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x28b9294*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.967] ReadFile (in: hFile=0x730, lpBuffer=0x28b9294, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x28b9294*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.967] ReadFile (in: hFile=0x730, lpBuffer=0x28b9294, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x28b9294*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.967] ReadFile (in: hFile=0x730, lpBuffer=0x28b9294, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x28b9294*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.967] ReadFile (in: hFile=0x730, lpBuffer=0x28b9294, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x28b9294*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.968] ReadFile (in: hFile=0x730, lpBuffer=0x28b9294, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x28b9294*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.968] ReadFile (in: hFile=0x730, lpBuffer=0x28b9294, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x28b9294*, lpNumberOfBytesRead=0x19bcfc*=0x860, lpOverlapped=0x0) returned 1 [0172.968] ReadFile (in: hFile=0x730, lpBuffer=0x28b8694, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x28b8694*, lpNumberOfBytesRead=0x19bcfc*=0x0, lpOverlapped=0x0) returned 1 [0172.968] ReadFile (in: hFile=0x730, lpBuffer=0x28b9294, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x28b9294*, lpNumberOfBytesRead=0x19bcfc*=0x0, lpOverlapped=0x0) returned 1 [0172.971] CloseHandle (hObject=0x730) returned 1 [0172.971] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZA6cnG6lQJoZX9WTK987.docx", nBufferLength=0x105, lpBuffer=0x19b85c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZA6cnG6lQJoZX9WTK987.docx", lpFilePart=0x0) returned 0x39 [0172.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd50) returned 1 [0172.971] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZA6cnG6lQJoZX9WTK987.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\za6cng6lqjozx9wtk987.docx"), fInfoLevelId=0x0, lpFileInformation=0x28f3f84 | out: lpFileInformation=0x28f3f84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bddb6c0, ftCreationTime.dwHighDateTime=0x1d8582b, ftLastAccessTime.dwLowDateTime=0xaa5188e0, ftLastAccessTime.dwHighDateTime=0x1d86867, ftLastWriteTime.dwLowDateTime=0xaa5188e0, ftLastWriteTime.dwHighDateTime=0x1d86867, nFileSizeHigh=0x0, nFileSizeLow=0x124e)) returned 1 [0172.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bd4c) returned 1 [0172.971] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19b84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0172.971] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZA6cnG6lQJoZX9WTK987.docx", nBufferLength=0x105, lpBuffer=0x19b848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZA6cnG6lQJoZX9WTK987.docx", lpFilePart=0x0) returned 0x39 [0172.971] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZA6cnG6lQJoZX9WTK987.docx", nBufferLength=0x105, lpBuffer=0x19b818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZA6cnG6lQJoZX9WTK987.docx", lpFilePart=0x0) returned 0x39 [0172.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bcc0) returned 1 [0172.972] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZA6cnG6lQJoZX9WTK987.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\za6cng6lqjozx9wtk987.docx"), fInfoLevelId=0x0, lpFileInformation=0x19bd3c | out: lpFileInformation=0x19bd3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bddb6c0, ftCreationTime.dwHighDateTime=0x1d8582b, ftLastAccessTime.dwLowDateTime=0xaa5188e0, ftLastAccessTime.dwHighDateTime=0x1d86867, ftLastWriteTime.dwLowDateTime=0xaa5188e0, ftLastWriteTime.dwHighDateTime=0x1d86867, nFileSizeHigh=0x0, nFileSizeLow=0x124e)) returned 1 [0172.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcbc) returned 1 [0172.972] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZA6cnG6lQJoZX9WTK987.docx", nBufferLength=0x105, lpBuffer=0x19b75c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZA6cnG6lQJoZX9WTK987.docx", lpFilePart=0x0) returned 0x39 [0172.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0172.972] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZA6cnG6lQJoZX9WTK987.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\za6cng6lqjozx9wtk987.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x730 [0172.972] GetFileType (hFile=0x730) returned 0x1 [0172.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc90) returned 1 [0172.972] GetFileType (hFile=0x730) returned 0x1 [0172.972] ReadFile (in: hFile=0x730, lpBuffer=0x28f53b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x28f53b8*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.973] ReadFile (in: hFile=0x730, lpBuffer=0x28f53b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x28f53b8*, lpNumberOfBytesRead=0x19bcfc*=0x24e, lpOverlapped=0x0) returned 1 [0172.973] ReadFile (in: hFile=0x730, lpBuffer=0x28f53b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x28f53b8*, lpNumberOfBytesRead=0x19bcfc*=0x0, lpOverlapped=0x0) returned 1 [0172.973] CloseHandle (hObject=0x730) returned 1 [0172.974] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\_IhV.doc", nBufferLength=0x105, lpBuffer=0x19b85c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\_IhV.doc", lpFilePart=0x0) returned 0x28 [0172.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd50) returned 1 [0172.974] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\_IhV.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\_ihv.doc"), fInfoLevelId=0x0, lpFileInformation=0x28fdba8 | out: lpFileInformation=0x28fdba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41054690, ftCreationTime.dwHighDateTime=0x1d89fc8, ftLastAccessTime.dwLowDateTime=0xb6dfec00, ftLastAccessTime.dwHighDateTime=0x1d8a48a, ftLastWriteTime.dwLowDateTime=0xb6dfec00, ftLastWriteTime.dwHighDateTime=0x1d8a48a, nFileSizeHigh=0x0, nFileSizeLow=0x3fe1)) returned 1 [0172.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bd4c) returned 1 [0172.974] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19b84c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0172.974] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\_IhV.doc", nBufferLength=0x105, lpBuffer=0x19b848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\_IhV.doc", lpFilePart=0x0) returned 0x28 [0172.974] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\_IhV.doc", nBufferLength=0x105, lpBuffer=0x19b818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\_IhV.doc", lpFilePart=0x0) returned 0x28 [0172.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bcc0) returned 1 [0172.975] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\_IhV.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\_ihv.doc"), fInfoLevelId=0x0, lpFileInformation=0x19bd3c | out: lpFileInformation=0x19bd3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41054690, ftCreationTime.dwHighDateTime=0x1d89fc8, ftLastAccessTime.dwLowDateTime=0xb6dfec00, ftLastAccessTime.dwHighDateTime=0x1d8a48a, ftLastWriteTime.dwLowDateTime=0xb6dfec00, ftLastWriteTime.dwHighDateTime=0x1d8a48a, nFileSizeHigh=0x0, nFileSizeLow=0x3fe1)) returned 1 [0172.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bcbc) returned 1 [0172.975] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\_IhV.doc", nBufferLength=0x105, lpBuffer=0x19b75c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\_IhV.doc", lpFilePart=0x0) returned 0x28 [0172.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bc94) returned 1 [0172.975] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\_IhV.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\_ihv.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x730 [0172.975] GetFileType (hFile=0x730) returned 0x1 [0172.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bc90) returned 1 [0172.975] GetFileType (hFile=0x730) returned 0x1 [0172.975] ReadFile (in: hFile=0x730, lpBuffer=0x28feedc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x28feedc*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.975] ReadFile (in: hFile=0x730, lpBuffer=0x28feedc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x28feedc*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.976] ReadFile (in: hFile=0x730, lpBuffer=0x28feedc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x28feedc*, lpNumberOfBytesRead=0x19bcfc*=0x1000, lpOverlapped=0x0) returned 1 [0172.976] ReadFile (in: hFile=0x730, lpBuffer=0x28feedc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x28feedc*, lpNumberOfBytesRead=0x19bcfc*=0xfe1, lpOverlapped=0x0) returned 1 [0172.976] ReadFile (in: hFile=0x730, lpBuffer=0x28fe65d, nNumberOfBytesToRead=0x1f, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x28fe65d*, lpNumberOfBytesRead=0x19bcfc*=0x0, lpOverlapped=0x0) returned 1 [0172.976] ReadFile (in: hFile=0x730, lpBuffer=0x28feedc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19bcfc, lpOverlapped=0x0 | out: lpBuffer=0x28feedc*, lpNumberOfBytesRead=0x19bcfc*=0x0, lpOverlapped=0x0) returned 1 [0172.976] CloseHandle (hObject=0x730) returned 1 [0173.009] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x730 [0173.009] SetEvent (hEvent=0x638) returned 1 [0173.009] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x730, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0173.010] CoGetContextToken (in: pToken=0x19ab4c | out: pToken=0x19ab4c) returned 0x0 [0173.010] CoGetContextToken (in: pToken=0x19ab2c | out: pToken=0x19ab2c) returned 0x0 [0173.010] CoGetContextToken (in: pToken=0x19aab0 | out: pToken=0x19aab0) returned 0x0 [0173.010] WbemLocator:IUnknown:Release (This=0x717650) returned 0x1 [0173.011] WbemLocator:IUnknown:Release (This=0x725630) returned 0x0 [0173.011] CoGetContextToken (in: pToken=0x19aab0 | out: pToken=0x19aab0) returned 0x0 [0173.011] IUnknown:Release (This=0x51cfff0) returned 0x2 [0173.011] IUnknown:Release (This=0x51cfff0) returned 0x1 [0173.027] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0173.027] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0173.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7be0, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x51d7be0) returned 0x0 [0173.027] WbemDefPath:IUnknown:AddRef (This=0x51d7be0) returned 0x3 [0173.027] WbemDefPath:IUnknown:Release (This=0x51d7be0) returned 0x2 [0173.027] WbemDefPath:IWbemPath:SetText (This=0x51d7be0, uMode=0x4, pszPath="ROOT\\SecurityCenter") returned 0x0 [0173.028] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7be0, puCount=0x19bd94 | out: puCount=0x19bd94*=0x2) returned 0x0 [0173.028] WbemDefPath:IWbemPath:GetText (in: This=0x51d7be0, lFlags=4, puBuffLength=0x19bd90*=0x0, pszText=0x0 | out: puBuffLength=0x19bd90*=0x18, pszText=0x0) returned 0x0 [0173.028] WbemDefPath:IWbemPath:GetText (in: This=0x51d7be0, lFlags=4, puBuffLength=0x19bd90*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x19bd90*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0173.028] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7be0, puCount=0x19bd80 | out: puCount=0x19bd80*=0x2) returned 0x0 [0173.028] WbemDefPath:IWbemPath:GetText (in: This=0x51d7be0, lFlags=4, puBuffLength=0x19bd7c*=0x0, pszText=0x0 | out: puBuffLength=0x19bd7c*=0x18, pszText=0x0) returned 0x0 [0173.028] WbemDefPath:IWbemPath:GetText (in: This=0x51d7be0, lFlags=4, puBuffLength=0x19bd7c*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x19bd7c*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0173.044] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc30*=0x698, lpdwindex=0x19bae4 | out: lpdwindex=0x19bae4) returned 0x0 [0173.204] CoGetContextToken (in: pToken=0x19b9f0 | out: pToken=0x19b9f0) returned 0x0 [0173.204] CoGetContextToken (in: pToken=0x19b998 | out: pToken=0x19b998) returned 0x0 [0173.204] IUnknown:QueryInterface (in: This=0x66f9c0, riid=0x6f12da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b974 | out: ppvObject=0x19b974*=0x66f9d0) returned 0x0 [0173.204] CObjectContext::ContextCallback () returned 0x0 [0173.206] IUnknown:Release (This=0x66f9d0) returned 0x1 [0173.206] CoUnmarshalInterface (in: pStm=0x51e13f0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19b9e4 | out: ppv=0x19b9e4*=0x717450) returned 0x0 [0173.206] CoMarshalInterface (pStm=0x51e13f0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x717450, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0173.206] WbemLocator:IUnknown:QueryInterface (in: This=0x717450, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b884 | out: ppvObject=0x19b884*=0x717450) returned 0x0 [0173.207] WbemLocator:IUnknown:QueryInterface (in: This=0x717450, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b840 | out: ppvObject=0x19b840*=0x0) returned 0x80004002 [0173.208] WbemLocator:IUnknown:QueryInterface (in: This=0x717450, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x0) returned 0x80004002 [0173.208] WbemLocator:IUnknown:QueryInterface (in: This=0x717450, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b434 | out: ppvObject=0x19b434*=0x0) returned 0x80004002 [0173.208] WbemLocator:IUnknown:AddRef (This=0x717450) returned 0x3 [0173.209] WbemLocator:IUnknown:QueryInterface (in: This=0x717450, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b194 | out: ppvObject=0x19b194*=0x0) returned 0x80004002 [0173.209] WbemLocator:IUnknown:QueryInterface (in: This=0x717450, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19b144 | out: ppvObject=0x19b144*=0x0) returned 0x80004002 [0173.209] WbemLocator:IUnknown:QueryInterface (in: This=0x717450, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b150 | out: ppvObject=0x19b150*=0x7173ac) returned 0x0 [0173.209] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x7173ac, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b158 | out: pCid=0x19b158*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0173.209] WbemLocator:IUnknown:Release (This=0x7173ac) returned 0x3 [0173.209] CoGetContextToken (in: pToken=0x19b1b0 | out: pToken=0x19b1b0) returned 0x0 [0173.209] CoGetObjectContext (in: riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x72c324 | out: ppv=0x72c324*=0x66f908) returned 0x0 [0173.209] CoGetContextToken (in: pToken=0x19b5b8 | out: pToken=0x19b5b8) returned 0x0 [0173.209] WbemLocator:IUnknown:QueryInterface (in: This=0x717450, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b644 | out: ppvObject=0x19b644*=0x717434) returned 0x0 [0173.209] WbemLocator:IRpcOptions:Query (in: This=0x717434, pPrx=0x717450, dwProperty=2, pdwValue=0x19b650 | out: pdwValue=0x19b650) returned 0x0 [0173.209] WbemLocator:IUnknown:Release (This=0x717434) returned 0x3 [0173.209] WbemLocator:IUnknown:Release (This=0x717450) returned 0x2 [0173.209] WbemLocator:IUnknown:Release (This=0x717450) returned 0x1 [0173.209] CoGetContextToken (in: pToken=0x19b930 | out: pToken=0x19b930) returned 0x0 [0173.209] WbemLocator:IUnknown:AddRef (This=0x717450) returned 0x2 [0173.209] WbemLocator:IUnknown:QueryInterface (in: This=0x717450, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbe8 | out: ppvObject=0x19bbe8*=0x71742c) returned 0x0 [0173.209] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x71742c, pProxy=0x717450, pAuthnSvc=0x19bc38, pAuthzSvc=0x19bc34, pServerPrincName=0x19bc2c, pAuthnLevel=0x19bc30, pImpLevel=0x19bc20, pAuthInfo=0x19bc24, pCapabilites=0x19bc28 | out: pAuthnSvc=0x19bc38*=0xa, pAuthzSvc=0x19bc34*=0x0, pServerPrincName=0x19bc2c, pAuthnLevel=0x19bc30*=0x6, pImpLevel=0x19bc20*=0x2, pAuthInfo=0x19bc24, pCapabilites=0x19bc28*=0x1) returned 0x0 [0173.210] WbemLocator:IUnknown:Release (This=0x71742c) returned 0x2 [0173.210] WbemLocator:IUnknown:QueryInterface (in: This=0x717450, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbdc | out: ppvObject=0x19bbdc*=0x717450) returned 0x0 [0173.210] WbemLocator:IUnknown:QueryInterface (in: This=0x717450, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbc8 | out: ppvObject=0x19bbc8*=0x71742c) returned 0x0 [0173.210] WbemLocator:IClientSecurity:SetBlanket (This=0x71742c, pProxy=0x717450, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0173.210] WbemLocator:IUnknown:Release (This=0x71742c) returned 0x3 [0173.210] WbemLocator:IUnknown:Release (This=0x717450) returned 0x2 [0173.210] CoTaskMemFree (pv=0x51f8b58) [0173.210] WbemLocator:IUnknown:Release (This=0x717450) returned 0x1 [0173.210] SysStringLen (param_1=0x0) returned 0x0 [0173.210] CoGetContextToken (in: pToken=0x19bba8 | out: pToken=0x19bba8) returned 0x0 [0173.210] CoGetContextToken (in: pToken=0x19bb08 | out: pToken=0x19bb08) returned 0x0 [0173.210] WbemLocator:IUnknown:QueryInterface (in: This=0x717450, riid=0x19bbd8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19bbd4 | out: ppvObject=0x19bbd4*=0x51f1878) returned 0x0 [0173.211] WbemLocator:IUnknown:AddRef (This=0x51f1878) returned 0x3 [0173.211] WbemLocator:IUnknown:Release (This=0x51f1878) returned 0x2 [0173.211] CoGetContextToken (in: pToken=0x19bb68 | out: pToken=0x19bb68) returned 0x0 [0173.211] WbemLocator:IUnknown:AddRef (This=0x51f1878) returned 0x3 [0173.211] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1878, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbe8 | out: ppvObject=0x19bbe8*=0x71742c) returned 0x0 [0173.211] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x71742c, pProxy=0x51f1878, pAuthnSvc=0x19bc38, pAuthzSvc=0x19bc34, pServerPrincName=0x19bc2c, pAuthnLevel=0x19bc30, pImpLevel=0x19bc20, pAuthInfo=0x19bc24, pCapabilites=0x19bc28 | out: pAuthnSvc=0x19bc38*=0xa, pAuthzSvc=0x19bc34*=0x0, pServerPrincName=0x19bc2c, pAuthnLevel=0x19bc30*=0x6, pImpLevel=0x19bc20*=0x2, pAuthInfo=0x19bc24, pCapabilites=0x19bc28*=0x1) returned 0x0 [0173.211] WbemLocator:IUnknown:Release (This=0x71742c) returned 0x3 [0173.211] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1878, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbdc | out: ppvObject=0x19bbdc*=0x717450) returned 0x0 [0173.211] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1878, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbc8 | out: ppvObject=0x19bbc8*=0x71742c) returned 0x0 [0173.211] WbemLocator:IClientSecurity:SetBlanket (This=0x71742c, pProxy=0x51f1878, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0173.211] WbemLocator:IUnknown:Release (This=0x71742c) returned 0x4 [0173.211] WbemLocator:IUnknown:Release (This=0x717450) returned 0x3 [0173.211] CoTaskMemFree (pv=0x51f8e28) [0173.212] WbemLocator:IUnknown:Release (This=0x51f1878) returned 0x2 [0173.212] SysStringLen (param_1=0x0) returned 0x0 [0173.212] CoGetContextToken (in: pToken=0x19bae8 | out: pToken=0x19bae8) returned 0x0 [0173.212] WbemLocator:IUnknown:AddRef (This=0x51f1878) returned 0x3 [0173.212] IWbemServices:ExecQuery (in: This=0x51f1878, strQueryLanguage="WQL", strQuery="SELECT * FROM AntivirusProduct", lFlags=16, pCtx=0x0, ppEnum=0x19bcf8 | out: ppEnum=0x19bcf8*=0x6d2010) returned 0x0 [0173.253] IUnknown:QueryInterface (in: This=0x6d2010, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb54 | out: ppvObject=0x19bb54*=0x6d2014) returned 0x0 [0173.253] IClientSecurity:QueryBlanket (in: This=0x6d2014, pProxy=0x6d2010, pAuthnSvc=0x19bba4, pAuthzSvc=0x19bba0, pServerPrincName=0x19bb98, pAuthnLevel=0x19bb9c, pImpLevel=0x19bb8c, pAuthInfo=0x19bb90, pCapabilites=0x19bb94 | out: pAuthnSvc=0x19bba4*=0xa, pAuthzSvc=0x19bba0*=0x0, pServerPrincName=0x19bb98, pAuthnLevel=0x19bb9c*=0x6, pImpLevel=0x19bb8c*=0x2, pAuthInfo=0x19bb90, pCapabilites=0x19bb94*=0x1) returned 0x0 [0173.253] IUnknown:Release (This=0x6d2014) returned 0x1 [0173.253] IUnknown:QueryInterface (in: This=0x6d2010, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb48 | out: ppvObject=0x19bb48*=0x717b50) returned 0x0 [0173.253] IUnknown:QueryInterface (in: This=0x6d2010, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb34 | out: ppvObject=0x19bb34*=0x6d2014) returned 0x0 [0173.253] IClientSecurity:SetBlanket (This=0x6d2014, pProxy=0x6d2010, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0173.265] IUnknown:Release (This=0x6d2014) returned 0x2 [0173.265] WbemLocator:IUnknown:Release (This=0x717b50) returned 0x1 [0173.265] CoTaskMemFree (pv=0x51f8e28) [0173.265] IUnknown:QueryInterface (in: This=0x6d2010, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b740 | out: ppvObject=0x19b740*=0x717b50) returned 0x0 [0173.265] WbemLocator:IUnknown:QueryInterface (in: This=0x717b50, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b6fc | out: ppvObject=0x19b6fc*=0x0) returned 0x80004002 [0173.293] WbemLocator:IUnknown:QueryInterface (in: This=0x717b50, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b51c | out: ppvObject=0x19b51c*=0x0) returned 0x80004002 [0173.314] IUnknown:QueryInterface (in: This=0x6d2010, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b2f4 | out: ppvObject=0x19b2f4*=0x0) returned 0x80004002 [0173.316] WbemLocator:IUnknown:AddRef (This=0x717b50) returned 0x3 [0173.316] WbemLocator:IUnknown:QueryInterface (in: This=0x717b50, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b054 | out: ppvObject=0x19b054*=0x0) returned 0x80004002 [0173.316] WbemLocator:IUnknown:QueryInterface (in: This=0x717b50, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19b004 | out: ppvObject=0x19b004*=0x0) returned 0x80004002 [0173.316] WbemLocator:IUnknown:QueryInterface (in: This=0x717b50, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b010 | out: ppvObject=0x19b010*=0x717aac) returned 0x0 [0173.316] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x717aac, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b018 | out: pCid=0x19b018*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0173.316] WbemLocator:IUnknown:Release (This=0x717aac) returned 0x3 [0173.317] CoGetContextToken (in: pToken=0x19b070 | out: pToken=0x19b070) returned 0x0 [0173.317] CoGetContextToken (in: pToken=0x19b478 | out: pToken=0x19b478) returned 0x0 [0173.317] WbemLocator:IUnknown:QueryInterface (in: This=0x717b50, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b504 | out: ppvObject=0x19b504*=0x717b34) returned 0x0 [0173.317] WbemLocator:IRpcOptions:Query (in: This=0x717b34, pPrx=0x717b50, dwProperty=2, pdwValue=0x19b510 | out: pdwValue=0x19b510) returned 0x80004002 [0173.317] WbemLocator:IUnknown:Release (This=0x717b34) returned 0x3 [0173.317] WbemLocator:IUnknown:Release (This=0x717b50) returned 0x2 [0173.317] CoGetContextToken (in: pToken=0x19ba50 | out: pToken=0x19ba50) returned 0x0 [0173.317] CoGetContextToken (in: pToken=0x19b9b0 | out: pToken=0x19b9b0) returned 0x0 [0173.317] WbemLocator:IUnknown:QueryInterface (in: This=0x717b50, riid=0x19ba80*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19ba7c | out: ppvObject=0x19ba7c*=0x6d2010) returned 0x0 [0173.317] IUnknown:AddRef (This=0x6d2010) returned 0x4 [0173.317] IUnknown:Release (This=0x6d2010) returned 0x3 [0173.317] IUnknown:Release (This=0x6d2010) returned 0x2 [0173.317] WbemLocator:IUnknown:Release (This=0x51f1878) returned 0x2 [0173.317] SysStringLen (param_1=0x0) returned 0x0 [0173.317] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7be0, puCount=0x19bd44 | out: puCount=0x19bd44*=0x2) returned 0x0 [0173.317] WbemDefPath:IWbemPath:GetText (in: This=0x51d7be0, lFlags=4, puBuffLength=0x19bd40*=0x0, pszText=0x0 | out: puBuffLength=0x19bd40*=0x18, pszText=0x0) returned 0x0 [0173.317] WbemDefPath:IWbemPath:GetText (in: This=0x51d7be0, lFlags=4, puBuffLength=0x19bd40*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x19bd40*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0173.317] CoGetContextToken (in: pToken=0x19bb90 | out: pToken=0x19bb90) returned 0x0 [0173.318] IUnknown:AddRef (This=0x6d2010) returned 0x3 [0173.318] IEnumWbemClassObject:Clone (in: This=0x6d2010, ppEnum=0x19bd50 | out: ppEnum=0x19bd50*=0x6d2330) returned 0x0 [0173.329] IUnknown:QueryInterface (in: This=0x6d2330, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bc0c | out: ppvObject=0x19bc0c*=0x6d2334) returned 0x0 [0173.330] IClientSecurity:QueryBlanket (in: This=0x6d2334, pProxy=0x6d2330, pAuthnSvc=0x19bc5c, pAuthzSvc=0x19bc58, pServerPrincName=0x19bc50, pAuthnLevel=0x19bc54, pImpLevel=0x19bc44, pAuthInfo=0x19bc48, pCapabilites=0x19bc4c | out: pAuthnSvc=0x19bc5c*=0xa, pAuthzSvc=0x19bc58*=0x0, pServerPrincName=0x19bc50, pAuthnLevel=0x19bc54*=0x6, pImpLevel=0x19bc44*=0x2, pAuthInfo=0x19bc48, pCapabilites=0x19bc4c*=0x1) returned 0x0 [0173.330] IUnknown:Release (This=0x6d2334) returned 0x1 [0173.330] IUnknown:QueryInterface (in: This=0x6d2330, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bc00 | out: ppvObject=0x19bc00*=0x717d50) returned 0x0 [0173.330] IUnknown:QueryInterface (in: This=0x6d2330, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbec | out: ppvObject=0x19bbec*=0x6d2334) returned 0x0 [0173.330] IClientSecurity:SetBlanket (This=0x6d2334, pProxy=0x6d2330, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0173.333] IUnknown:Release (This=0x6d2334) returned 0x2 [0173.333] WbemLocator:IUnknown:Release (This=0x717d50) returned 0x1 [0173.334] CoTaskMemFree (pv=0x51f8c48) [0173.334] IUnknown:QueryInterface (in: This=0x6d2330, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b7e8 | out: ppvObject=0x19b7e8*=0x717d50) returned 0x0 [0173.334] WbemLocator:IUnknown:QueryInterface (in: This=0x717d50, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b7a4 | out: ppvObject=0x19b7a4*=0x0) returned 0x80004002 [0173.335] WbemLocator:IUnknown:QueryInterface (in: This=0x717d50, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b5c4 | out: ppvObject=0x19b5c4*=0x0) returned 0x80004002 [0173.335] IUnknown:QueryInterface (in: This=0x6d2330, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b39c | out: ppvObject=0x19b39c*=0x0) returned 0x80004002 [0173.336] WbemLocator:IUnknown:AddRef (This=0x717d50) returned 0x3 [0173.336] WbemLocator:IUnknown:QueryInterface (in: This=0x717d50, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0173.336] WbemLocator:IUnknown:QueryInterface (in: This=0x717d50, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19b0ac | out: ppvObject=0x19b0ac*=0x0) returned 0x80004002 [0173.336] WbemLocator:IUnknown:QueryInterface (in: This=0x717d50, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0b8 | out: ppvObject=0x19b0b8*=0x717cac) returned 0x0 [0173.336] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x717cac, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b0c0 | out: pCid=0x19b0c0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0173.336] WbemLocator:IUnknown:Release (This=0x717cac) returned 0x3 [0173.337] CoGetContextToken (in: pToken=0x19b118 | out: pToken=0x19b118) returned 0x0 [0173.337] CoGetContextToken (in: pToken=0x19b520 | out: pToken=0x19b520) returned 0x0 [0173.337] WbemLocator:IUnknown:QueryInterface (in: This=0x717d50, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b5ac | out: ppvObject=0x19b5ac*=0x717d34) returned 0x0 [0173.337] WbemLocator:IRpcOptions:Query (in: This=0x717d34, pPrx=0x717d50, dwProperty=2, pdwValue=0x19b5b8 | out: pdwValue=0x19b5b8) returned 0x80004002 [0173.337] WbemLocator:IUnknown:Release (This=0x717d34) returned 0x3 [0173.337] WbemLocator:IUnknown:Release (This=0x717d50) returned 0x2 [0173.337] CoGetContextToken (in: pToken=0x19baf8 | out: pToken=0x19baf8) returned 0x0 [0173.337] CoGetContextToken (in: pToken=0x19ba58 | out: pToken=0x19ba58) returned 0x0 [0173.337] WbemLocator:IUnknown:QueryInterface (in: This=0x717d50, riid=0x19bb28*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19bb24 | out: ppvObject=0x19bb24*=0x6d2330) returned 0x0 [0173.337] IUnknown:AddRef (This=0x6d2330) returned 0x4 [0173.337] IUnknown:Release (This=0x6d2330) returned 0x3 [0173.337] IUnknown:Release (This=0x6d2330) returned 0x2 [0173.337] IUnknown:Release (This=0x6d2010) returned 0x2 [0173.337] SysStringLen (param_1=0x0) returned 0x0 [0173.337] IEnumWbemClassObject:Reset (This=0x6d2330) returned 0x0 [0173.338] CoTaskMemAlloc (cb=0x4) returned 0x51de738 [0173.338] IEnumWbemClassObject:Next (in: This=0x6d2330, lTimeout=-1, uCount=0x1, apObjects=0x51de738, puReturned=0x2919388 | out: apObjects=0x51de738*=0x0, puReturned=0x2919388*=0x0) returned 0x1 [0173.615] CoTaskMemFree (pv=0x51de738) [0173.616] CoGetContextToken (in: pToken=0x19bc70 | out: pToken=0x19bc70) returned 0x0 [0173.616] WbemLocator:IUnknown:Release (This=0x717d50) returned 0x1 [0173.616] IUnknown:Release (This=0x6d2330) returned 0x0 [0173.617] CoGetContextToken (in: pToken=0x19bc70 | out: pToken=0x19bc70) returned 0x0 [0173.617] WbemLocator:IUnknown:Release (This=0x717b50) returned 0x1 [0173.617] IUnknown:Release (This=0x6d2010) returned 0x0 [0173.619] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2c8 [0173.619] SetEvent (hEvent=0x638) returned 1 [0173.619] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x2c8, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0173.621] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0173.621] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0173.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8270, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x51d8270) returned 0x0 [0173.621] WbemDefPath:IUnknown:AddRef (This=0x51d8270) returned 0x3 [0173.622] WbemDefPath:IUnknown:Release (This=0x51d8270) returned 0x2 [0173.622] WbemDefPath:IWbemPath:SetText (This=0x51d8270, uMode=0x4, pszPath="ROOT\\SecurityCenter") returned 0x0 [0173.622] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d8270, puCount=0x19bd94 | out: puCount=0x19bd94*=0x2) returned 0x0 [0173.622] WbemDefPath:IWbemPath:GetText (in: This=0x51d8270, lFlags=4, puBuffLength=0x19bd90*=0x0, pszText=0x0 | out: puBuffLength=0x19bd90*=0x18, pszText=0x0) returned 0x0 [0173.622] WbemDefPath:IWbemPath:GetText (in: This=0x51d8270, lFlags=4, puBuffLength=0x19bd90*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x19bd90*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0173.622] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d8270, puCount=0x19bd80 | out: puCount=0x19bd80*=0x2) returned 0x0 [0173.622] WbemDefPath:IWbemPath:GetText (in: This=0x51d8270, lFlags=4, puBuffLength=0x19bd7c*=0x0, pszText=0x0 | out: puBuffLength=0x19bd7c*=0x18, pszText=0x0) returned 0x0 [0173.622] WbemDefPath:IWbemPath:GetText (in: This=0x51d8270, lFlags=4, puBuffLength=0x19bd7c*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x19bd7c*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0173.630] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc30*=0x2e4, lpdwindex=0x19bae4 | out: lpdwindex=0x19bae4) returned 0x0 [0173.660] CoGetContextToken (in: pToken=0x19b9f0 | out: pToken=0x19b9f0) returned 0x0 [0173.660] CoGetContextToken (in: pToken=0x19b998 | out: pToken=0x19b998) returned 0x0 [0173.661] IUnknown:QueryInterface (in: This=0x66f9c0, riid=0x6f12da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b974 | out: ppvObject=0x19b974*=0x66f9d0) returned 0x0 [0173.661] CObjectContext::ContextCallback () returned 0x0 [0173.662] IUnknown:Release (This=0x66f9d0) returned 0x1 [0173.662] CoUnmarshalInterface (in: pStm=0x51e1250, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19b9e4 | out: ppv=0x19b9e4*=0x717b50) returned 0x0 [0173.662] CoMarshalInterface (pStm=0x51e1250, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x717b50, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0173.663] WbemLocator:IUnknown:QueryInterface (in: This=0x717b50, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b884 | out: ppvObject=0x19b884*=0x717b50) returned 0x0 [0173.663] WbemLocator:IUnknown:QueryInterface (in: This=0x717b50, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b840 | out: ppvObject=0x19b840*=0x0) returned 0x80004002 [0173.663] WbemLocator:IUnknown:QueryInterface (in: This=0x717b50, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x0) returned 0x80004002 [0173.664] WbemLocator:IUnknown:QueryInterface (in: This=0x717b50, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b434 | out: ppvObject=0x19b434*=0x0) returned 0x80004002 [0173.665] WbemLocator:IUnknown:AddRef (This=0x717b50) returned 0x3 [0173.665] WbemLocator:IUnknown:QueryInterface (in: This=0x717b50, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b194 | out: ppvObject=0x19b194*=0x0) returned 0x80004002 [0173.665] WbemLocator:IUnknown:QueryInterface (in: This=0x717b50, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19b144 | out: ppvObject=0x19b144*=0x0) returned 0x80004002 [0173.665] WbemLocator:IUnknown:QueryInterface (in: This=0x717b50, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b150 | out: ppvObject=0x19b150*=0x717aac) returned 0x0 [0173.665] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x717aac, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b158 | out: pCid=0x19b158*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0173.665] WbemLocator:IUnknown:Release (This=0x717aac) returned 0x3 [0173.665] CoGetContextToken (in: pToken=0x19b1b0 | out: pToken=0x19b1b0) returned 0x0 [0173.665] CoGetContextToken (in: pToken=0x19b5b8 | out: pToken=0x19b5b8) returned 0x0 [0173.665] WbemLocator:IUnknown:QueryInterface (in: This=0x717b50, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b644 | out: ppvObject=0x19b644*=0x717b34) returned 0x0 [0173.665] WbemLocator:IRpcOptions:Query (in: This=0x717b34, pPrx=0x717b50, dwProperty=2, pdwValue=0x19b650 | out: pdwValue=0x19b650) returned 0x0 [0173.665] WbemLocator:IUnknown:Release (This=0x717b34) returned 0x3 [0173.665] WbemLocator:IUnknown:Release (This=0x717b50) returned 0x2 [0173.665] WbemLocator:IUnknown:Release (This=0x717b50) returned 0x1 [0173.665] CoGetContextToken (in: pToken=0x19b930 | out: pToken=0x19b930) returned 0x0 [0173.665] WbemLocator:IUnknown:AddRef (This=0x717b50) returned 0x2 [0173.666] WbemLocator:IUnknown:QueryInterface (in: This=0x717b50, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbe8 | out: ppvObject=0x19bbe8*=0x717b2c) returned 0x0 [0173.666] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x717b2c, pProxy=0x717b50, pAuthnSvc=0x19bc38, pAuthzSvc=0x19bc34, pServerPrincName=0x19bc2c, pAuthnLevel=0x19bc30, pImpLevel=0x19bc20, pAuthInfo=0x19bc24, pCapabilites=0x19bc28 | out: pAuthnSvc=0x19bc38*=0xa, pAuthzSvc=0x19bc34*=0x0, pServerPrincName=0x19bc2c, pAuthnLevel=0x19bc30*=0x6, pImpLevel=0x19bc20*=0x2, pAuthInfo=0x19bc24, pCapabilites=0x19bc28*=0x1) returned 0x0 [0173.666] WbemLocator:IUnknown:Release (This=0x717b2c) returned 0x2 [0173.666] WbemLocator:IUnknown:QueryInterface (in: This=0x717b50, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbdc | out: ppvObject=0x19bbdc*=0x717b50) returned 0x0 [0173.666] WbemLocator:IUnknown:QueryInterface (in: This=0x717b50, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbc8 | out: ppvObject=0x19bbc8*=0x717b2c) returned 0x0 [0173.666] WbemLocator:IClientSecurity:SetBlanket (This=0x717b2c, pProxy=0x717b50, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0173.666] WbemLocator:IUnknown:Release (This=0x717b2c) returned 0x3 [0173.666] WbemLocator:IUnknown:Release (This=0x717b50) returned 0x2 [0173.666] CoTaskMemFree (pv=0x51f8e28) [0173.667] WbemLocator:IUnknown:Release (This=0x717b50) returned 0x1 [0173.667] SysStringLen (param_1=0x0) returned 0x0 [0173.667] CoGetContextToken (in: pToken=0x19bba8 | out: pToken=0x19bba8) returned 0x0 [0173.667] CoGetContextToken (in: pToken=0x19bb08 | out: pToken=0x19bb08) returned 0x0 [0173.667] WbemLocator:IUnknown:QueryInterface (in: This=0x717b50, riid=0x19bbd8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19bbd4 | out: ppvObject=0x19bbd4*=0x51f1148) returned 0x0 [0173.667] WbemLocator:IUnknown:AddRef (This=0x51f1148) returned 0x3 [0173.667] WbemLocator:IUnknown:Release (This=0x51f1148) returned 0x2 [0173.667] CoGetContextToken (in: pToken=0x19bb68 | out: pToken=0x19bb68) returned 0x0 [0173.668] WbemLocator:IUnknown:AddRef (This=0x51f1148) returned 0x3 [0173.668] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1148, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbe8 | out: ppvObject=0x19bbe8*=0x717b2c) returned 0x0 [0173.668] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x717b2c, pProxy=0x51f1148, pAuthnSvc=0x19bc38, pAuthzSvc=0x19bc34, pServerPrincName=0x19bc2c, pAuthnLevel=0x19bc30, pImpLevel=0x19bc20, pAuthInfo=0x19bc24, pCapabilites=0x19bc28 | out: pAuthnSvc=0x19bc38*=0xa, pAuthzSvc=0x19bc34*=0x0, pServerPrincName=0x19bc2c, pAuthnLevel=0x19bc30*=0x6, pImpLevel=0x19bc20*=0x2, pAuthInfo=0x19bc24, pCapabilites=0x19bc28*=0x1) returned 0x0 [0173.668] WbemLocator:IUnknown:Release (This=0x717b2c) returned 0x3 [0173.668] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1148, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbdc | out: ppvObject=0x19bbdc*=0x717b50) returned 0x0 [0173.668] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1148, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbc8 | out: ppvObject=0x19bbc8*=0x717b2c) returned 0x0 [0173.668] WbemLocator:IClientSecurity:SetBlanket (This=0x717b2c, pProxy=0x51f1148, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0173.669] WbemLocator:IUnknown:Release (This=0x717b2c) returned 0x4 [0173.669] WbemLocator:IUnknown:Release (This=0x717b50) returned 0x3 [0173.669] CoTaskMemFree (pv=0x51f8e58) [0173.669] WbemLocator:IUnknown:Release (This=0x51f1148) returned 0x2 [0173.669] SysStringLen (param_1=0x0) returned 0x0 [0173.669] CoGetContextToken (in: pToken=0x19bae8 | out: pToken=0x19bae8) returned 0x0 [0173.669] WbemLocator:IUnknown:AddRef (This=0x51f1148) returned 0x3 [0173.669] IWbemServices:ExecQuery (in: This=0x51f1148, strQueryLanguage="WQL", strQuery="SELECT * FROM AntiSpyWareProduct", lFlags=16, pCtx=0x0, ppEnum=0x19bcf8 | out: ppEnum=0x19bcf8*=0x6d1e80) returned 0x0 [0173.675] IUnknown:QueryInterface (in: This=0x6d1e80, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb50 | out: ppvObject=0x19bb50*=0x6d1e84) returned 0x0 [0173.675] IClientSecurity:QueryBlanket (in: This=0x6d1e84, pProxy=0x6d1e80, pAuthnSvc=0x19bba0, pAuthzSvc=0x19bb9c, pServerPrincName=0x19bb94, pAuthnLevel=0x19bb98, pImpLevel=0x19bb88, pAuthInfo=0x19bb8c, pCapabilites=0x19bb90 | out: pAuthnSvc=0x19bba0*=0xa, pAuthzSvc=0x19bb9c*=0x0, pServerPrincName=0x19bb94, pAuthnLevel=0x19bb98*=0x6, pImpLevel=0x19bb88*=0x2, pAuthInfo=0x19bb8c, pCapabilites=0x19bb90*=0x1) returned 0x0 [0173.675] IUnknown:Release (This=0x6d1e84) returned 0x1 [0173.675] IUnknown:QueryInterface (in: This=0x6d1e80, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb44 | out: ppvObject=0x19bb44*=0x717d50) returned 0x0 [0173.675] IUnknown:QueryInterface (in: This=0x6d1e80, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb30 | out: ppvObject=0x19bb30*=0x6d1e84) returned 0x0 [0173.676] IClientSecurity:SetBlanket (This=0x6d1e84, pProxy=0x6d1e80, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0173.677] IUnknown:Release (This=0x6d1e84) returned 0x2 [0173.677] WbemLocator:IUnknown:Release (This=0x717d50) returned 0x1 [0173.677] CoTaskMemFree (pv=0x51f8eb8) [0173.678] IUnknown:QueryInterface (in: This=0x6d1e80, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b73c | out: ppvObject=0x19b73c*=0x717d50) returned 0x0 [0173.678] WbemLocator:IUnknown:QueryInterface (in: This=0x717d50, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b6f8 | out: ppvObject=0x19b6f8*=0x0) returned 0x80004002 [0173.678] WbemLocator:IUnknown:QueryInterface (in: This=0x717d50, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b514 | out: ppvObject=0x19b514*=0x0) returned 0x80004002 [0173.679] IUnknown:QueryInterface (in: This=0x6d1e80, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b2ec | out: ppvObject=0x19b2ec*=0x0) returned 0x80004002 [0173.680] WbemLocator:IUnknown:AddRef (This=0x717d50) returned 0x3 [0173.680] WbemLocator:IUnknown:QueryInterface (in: This=0x717d50, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b04c | out: ppvObject=0x19b04c*=0x0) returned 0x80004002 [0173.680] WbemLocator:IUnknown:QueryInterface (in: This=0x717d50, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19affc | out: ppvObject=0x19affc*=0x0) returned 0x80004002 [0173.680] WbemLocator:IUnknown:QueryInterface (in: This=0x717d50, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b008 | out: ppvObject=0x19b008*=0x717cac) returned 0x0 [0173.680] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x717cac, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b010 | out: pCid=0x19b010*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0173.680] WbemLocator:IUnknown:Release (This=0x717cac) returned 0x3 [0173.680] CoGetContextToken (in: pToken=0x19b068 | out: pToken=0x19b068) returned 0x0 [0173.680] CoGetContextToken (in: pToken=0x19b470 | out: pToken=0x19b470) returned 0x0 [0173.680] WbemLocator:IUnknown:QueryInterface (in: This=0x717d50, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b4fc | out: ppvObject=0x19b4fc*=0x717d34) returned 0x0 [0173.680] WbemLocator:IRpcOptions:Query (in: This=0x717d34, pPrx=0x717d50, dwProperty=2, pdwValue=0x19b508 | out: pdwValue=0x19b508) returned 0x80004002 [0173.680] WbemLocator:IUnknown:Release (This=0x717d34) returned 0x3 [0173.680] WbemLocator:IUnknown:Release (This=0x717d50) returned 0x2 [0173.680] CoGetContextToken (in: pToken=0x19ba50 | out: pToken=0x19ba50) returned 0x0 [0173.680] CoGetContextToken (in: pToken=0x19b9b0 | out: pToken=0x19b9b0) returned 0x0 [0173.681] WbemLocator:IUnknown:QueryInterface (in: This=0x717d50, riid=0x19ba80*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19ba7c | out: ppvObject=0x19ba7c*=0x6d1e80) returned 0x0 [0173.681] IUnknown:AddRef (This=0x6d1e80) returned 0x4 [0173.681] IUnknown:Release (This=0x6d1e80) returned 0x3 [0173.681] IUnknown:Release (This=0x6d1e80) returned 0x2 [0173.681] WbemLocator:IUnknown:Release (This=0x51f1148) returned 0x2 [0173.681] SysStringLen (param_1=0x0) returned 0x0 [0173.681] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d8270, puCount=0x19bd44 | out: puCount=0x19bd44*=0x2) returned 0x0 [0173.681] WbemDefPath:IWbemPath:GetText (in: This=0x51d8270, lFlags=4, puBuffLength=0x19bd40*=0x0, pszText=0x0 | out: puBuffLength=0x19bd40*=0x18, pszText=0x0) returned 0x0 [0173.681] WbemDefPath:IWbemPath:GetText (in: This=0x51d8270, lFlags=4, puBuffLength=0x19bd40*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x19bd40*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0173.681] CoGetContextToken (in: pToken=0x19bb90 | out: pToken=0x19bb90) returned 0x0 [0173.681] IUnknown:AddRef (This=0x6d1e80) returned 0x3 [0173.681] IEnumWbemClassObject:Clone (in: This=0x6d1e80, ppEnum=0x19bd50 | out: ppEnum=0x19bd50*=0x6d1db8) returned 0x0 [0173.682] IUnknown:QueryInterface (in: This=0x6d1db8, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bc0c | out: ppvObject=0x19bc0c*=0x6d1dbc) returned 0x0 [0173.682] IClientSecurity:QueryBlanket (in: This=0x6d1dbc, pProxy=0x6d1db8, pAuthnSvc=0x19bc5c, pAuthzSvc=0x19bc58, pServerPrincName=0x19bc50, pAuthnLevel=0x19bc54, pImpLevel=0x19bc44, pAuthInfo=0x19bc48, pCapabilites=0x19bc4c | out: pAuthnSvc=0x19bc5c*=0xa, pAuthzSvc=0x19bc58*=0x0, pServerPrincName=0x19bc50, pAuthnLevel=0x19bc54*=0x6, pImpLevel=0x19bc44*=0x2, pAuthInfo=0x19bc48, pCapabilites=0x19bc4c*=0x1) returned 0x0 [0173.682] IUnknown:Release (This=0x6d1dbc) returned 0x1 [0173.682] IUnknown:QueryInterface (in: This=0x6d1db8, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bc00 | out: ppvObject=0x19bc00*=0x716150) returned 0x0 [0173.682] IUnknown:QueryInterface (in: This=0x6d1db8, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbec | out: ppvObject=0x19bbec*=0x6d1dbc) returned 0x0 [0173.683] IClientSecurity:SetBlanket (This=0x6d1dbc, pProxy=0x6d1db8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0173.685] IUnknown:Release (This=0x6d1dbc) returned 0x2 [0173.685] WbemLocator:IUnknown:Release (This=0x716150) returned 0x1 [0173.685] CoTaskMemFree (pv=0x51f8978) [0173.686] IUnknown:QueryInterface (in: This=0x6d1db8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b7e8 | out: ppvObject=0x19b7e8*=0x716150) returned 0x0 [0173.686] WbemLocator:IUnknown:QueryInterface (in: This=0x716150, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b7a4 | out: ppvObject=0x19b7a4*=0x0) returned 0x80004002 [0173.686] WbemLocator:IUnknown:QueryInterface (in: This=0x716150, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b5c4 | out: ppvObject=0x19b5c4*=0x0) returned 0x80004002 [0173.687] IUnknown:QueryInterface (in: This=0x6d1db8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b39c | out: ppvObject=0x19b39c*=0x0) returned 0x80004002 [0173.687] WbemLocator:IUnknown:AddRef (This=0x716150) returned 0x3 [0173.687] WbemLocator:IUnknown:QueryInterface (in: This=0x716150, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0173.687] WbemLocator:IUnknown:QueryInterface (in: This=0x716150, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19b0ac | out: ppvObject=0x19b0ac*=0x0) returned 0x80004002 [0173.687] WbemLocator:IUnknown:QueryInterface (in: This=0x716150, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0b8 | out: ppvObject=0x19b0b8*=0x7160ac) returned 0x0 [0173.687] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x7160ac, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b0c0 | out: pCid=0x19b0c0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0173.687] WbemLocator:IUnknown:Release (This=0x7160ac) returned 0x3 [0173.687] CoGetContextToken (in: pToken=0x19b118 | out: pToken=0x19b118) returned 0x0 [0173.688] CoGetContextToken (in: pToken=0x19b520 | out: pToken=0x19b520) returned 0x0 [0173.688] WbemLocator:IUnknown:QueryInterface (in: This=0x716150, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b5ac | out: ppvObject=0x19b5ac*=0x716134) returned 0x0 [0173.688] WbemLocator:IRpcOptions:Query (in: This=0x716134, pPrx=0x716150, dwProperty=2, pdwValue=0x19b5b8 | out: pdwValue=0x19b5b8) returned 0x80004002 [0173.688] WbemLocator:IUnknown:Release (This=0x716134) returned 0x3 [0173.688] WbemLocator:IUnknown:Release (This=0x716150) returned 0x2 [0173.688] CoGetContextToken (in: pToken=0x19baf8 | out: pToken=0x19baf8) returned 0x0 [0173.688] CoGetContextToken (in: pToken=0x19ba58 | out: pToken=0x19ba58) returned 0x0 [0173.688] WbemLocator:IUnknown:QueryInterface (in: This=0x716150, riid=0x19bb28*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19bb24 | out: ppvObject=0x19bb24*=0x6d1db8) returned 0x0 [0173.688] IUnknown:AddRef (This=0x6d1db8) returned 0x4 [0173.688] IUnknown:Release (This=0x6d1db8) returned 0x3 [0173.688] IUnknown:Release (This=0x6d1db8) returned 0x2 [0173.688] IUnknown:Release (This=0x6d1e80) returned 0x2 [0173.688] SysStringLen (param_1=0x0) returned 0x0 [0173.688] IEnumWbemClassObject:Reset (This=0x6d1db8) returned 0x0 [0173.689] CoTaskMemAlloc (cb=0x4) returned 0x51de678 [0173.689] IEnumWbemClassObject:Next (in: This=0x6d1db8, lTimeout=-1, uCount=0x1, apObjects=0x51de678, puReturned=0x291a5a8 | out: apObjects=0x51de678*=0x0, puReturned=0x291a5a8*=0x0) returned 0x1 [0173.689] CoTaskMemFree (pv=0x51de678) [0173.689] CoGetContextToken (in: pToken=0x19bc70 | out: pToken=0x19bc70) returned 0x0 [0173.690] WbemLocator:IUnknown:Release (This=0x716150) returned 0x1 [0173.690] IUnknown:Release (This=0x6d1db8) returned 0x0 [0173.690] CoGetContextToken (in: pToken=0x19bc70 | out: pToken=0x19bc70) returned 0x0 [0173.690] WbemLocator:IUnknown:Release (This=0x717d50) returned 0x1 [0173.690] IUnknown:Release (This=0x6d1e80) returned 0x0 [0173.692] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2e8 [0173.692] SetEvent (hEvent=0x638) returned 1 [0173.692] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x2e8, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0173.695] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0173.695] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0173.695] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7a90, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x51d7a90) returned 0x0 [0173.695] WbemDefPath:IUnknown:AddRef (This=0x51d7a90) returned 0x3 [0173.695] WbemDefPath:IUnknown:Release (This=0x51d7a90) returned 0x2 [0173.695] WbemDefPath:IWbemPath:SetText (This=0x51d7a90, uMode=0x4, pszPath="ROOT\\SecurityCenter") returned 0x0 [0173.695] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7a90, puCount=0x19bd94 | out: puCount=0x19bd94*=0x2) returned 0x0 [0173.696] WbemDefPath:IWbemPath:GetText (in: This=0x51d7a90, lFlags=4, puBuffLength=0x19bd90*=0x0, pszText=0x0 | out: puBuffLength=0x19bd90*=0x18, pszText=0x0) returned 0x0 [0173.696] WbemDefPath:IWbemPath:GetText (in: This=0x51d7a90, lFlags=4, puBuffLength=0x19bd90*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x19bd90*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0173.696] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7a90, puCount=0x19bd80 | out: puCount=0x19bd80*=0x2) returned 0x0 [0173.696] WbemDefPath:IWbemPath:GetText (in: This=0x51d7a90, lFlags=4, puBuffLength=0x19bd7c*=0x0, pszText=0x0 | out: puBuffLength=0x19bd7c*=0x18, pszText=0x0) returned 0x0 [0173.696] WbemDefPath:IWbemPath:GetText (in: This=0x51d7a90, lFlags=4, puBuffLength=0x19bd7c*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x19bd7c*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0173.703] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc30*=0x648, lpdwindex=0x19bae4 | out: lpdwindex=0x19bae4) returned 0x0 [0173.729] CoGetContextToken (in: pToken=0x19b9f0 | out: pToken=0x19b9f0) returned 0x0 [0173.729] CoGetContextToken (in: pToken=0x19b998 | out: pToken=0x19b998) returned 0x0 [0173.729] IUnknown:QueryInterface (in: This=0x66f9c0, riid=0x6f12da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b974 | out: ppvObject=0x19b974*=0x66f9d0) returned 0x0 [0173.729] CObjectContext::ContextCallback () returned 0x0 [0173.731] IUnknown:Release (This=0x66f9d0) returned 0x1 [0173.731] CoUnmarshalInterface (in: pStm=0x51e1470, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19b9e4 | out: ppv=0x19b9e4*=0x717d50) returned 0x0 [0173.731] CoMarshalInterface (pStm=0x51e1470, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x717d50, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0173.732] WbemLocator:IUnknown:QueryInterface (in: This=0x717d50, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b884 | out: ppvObject=0x19b884*=0x717d50) returned 0x0 [0173.732] WbemLocator:IUnknown:QueryInterface (in: This=0x717d50, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b840 | out: ppvObject=0x19b840*=0x0) returned 0x80004002 [0173.732] WbemLocator:IUnknown:QueryInterface (in: This=0x717d50, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x0) returned 0x80004002 [0173.732] WbemLocator:IUnknown:QueryInterface (in: This=0x717d50, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b434 | out: ppvObject=0x19b434*=0x0) returned 0x80004002 [0173.733] WbemLocator:IUnknown:AddRef (This=0x717d50) returned 0x3 [0173.733] WbemLocator:IUnknown:QueryInterface (in: This=0x717d50, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b194 | out: ppvObject=0x19b194*=0x0) returned 0x80004002 [0173.733] WbemLocator:IUnknown:QueryInterface (in: This=0x717d50, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19b144 | out: ppvObject=0x19b144*=0x0) returned 0x80004002 [0173.733] WbemLocator:IUnknown:QueryInterface (in: This=0x717d50, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b150 | out: ppvObject=0x19b150*=0x717cac) returned 0x0 [0173.733] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x717cac, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b158 | out: pCid=0x19b158*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0173.733] WbemLocator:IUnknown:Release (This=0x717cac) returned 0x3 [0173.733] CoGetContextToken (in: pToken=0x19b1b0 | out: pToken=0x19b1b0) returned 0x0 [0173.733] CoGetContextToken (in: pToken=0x19b5b8 | out: pToken=0x19b5b8) returned 0x0 [0173.733] WbemLocator:IUnknown:QueryInterface (in: This=0x717d50, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b644 | out: ppvObject=0x19b644*=0x717d34) returned 0x0 [0173.733] WbemLocator:IRpcOptions:Query (in: This=0x717d34, pPrx=0x717d50, dwProperty=2, pdwValue=0x19b650 | out: pdwValue=0x19b650) returned 0x0 [0173.733] WbemLocator:IUnknown:Release (This=0x717d34) returned 0x3 [0173.733] WbemLocator:IUnknown:Release (This=0x717d50) returned 0x2 [0173.733] WbemLocator:IUnknown:Release (This=0x717d50) returned 0x1 [0173.733] CoGetContextToken (in: pToken=0x19b930 | out: pToken=0x19b930) returned 0x0 [0173.734] WbemLocator:IUnknown:AddRef (This=0x717d50) returned 0x2 [0173.734] WbemLocator:IUnknown:QueryInterface (in: This=0x717d50, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbe8 | out: ppvObject=0x19bbe8*=0x717d2c) returned 0x0 [0173.734] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x717d2c, pProxy=0x717d50, pAuthnSvc=0x19bc38, pAuthzSvc=0x19bc34, pServerPrincName=0x19bc2c, pAuthnLevel=0x19bc30, pImpLevel=0x19bc20, pAuthInfo=0x19bc24, pCapabilites=0x19bc28 | out: pAuthnSvc=0x19bc38*=0xa, pAuthzSvc=0x19bc34*=0x0, pServerPrincName=0x19bc2c, pAuthnLevel=0x19bc30*=0x6, pImpLevel=0x19bc20*=0x2, pAuthInfo=0x19bc24, pCapabilites=0x19bc28*=0x1) returned 0x0 [0173.734] WbemLocator:IUnknown:Release (This=0x717d2c) returned 0x2 [0173.734] WbemLocator:IUnknown:QueryInterface (in: This=0x717d50, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbdc | out: ppvObject=0x19bbdc*=0x717d50) returned 0x0 [0173.734] WbemLocator:IUnknown:QueryInterface (in: This=0x717d50, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbc8 | out: ppvObject=0x19bbc8*=0x717d2c) returned 0x0 [0173.734] WbemLocator:IClientSecurity:SetBlanket (This=0x717d2c, pProxy=0x717d50, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0173.734] WbemLocator:IUnknown:Release (This=0x717d2c) returned 0x3 [0173.734] WbemLocator:IUnknown:Release (This=0x717d50) returned 0x2 [0173.734] CoTaskMemFree (pv=0x51f8a08) [0173.734] WbemLocator:IUnknown:Release (This=0x717d50) returned 0x1 [0173.734] SysStringLen (param_1=0x0) returned 0x0 [0173.734] CoGetContextToken (in: pToken=0x19bba8 | out: pToken=0x19bba8) returned 0x0 [0173.734] CoGetContextToken (in: pToken=0x19bb08 | out: pToken=0x19bb08) returned 0x0 [0173.734] WbemLocator:IUnknown:QueryInterface (in: This=0x717d50, riid=0x19bbd8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19bbd4 | out: ppvObject=0x19bbd4*=0x51f1328) returned 0x0 [0173.735] WbemLocator:IUnknown:AddRef (This=0x51f1328) returned 0x3 [0173.735] WbemLocator:IUnknown:Release (This=0x51f1328) returned 0x2 [0173.735] CoGetContextToken (in: pToken=0x19bb68 | out: pToken=0x19bb68) returned 0x0 [0173.735] WbemLocator:IUnknown:AddRef (This=0x51f1328) returned 0x3 [0173.735] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1328, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbe8 | out: ppvObject=0x19bbe8*=0x717d2c) returned 0x0 [0173.735] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x717d2c, pProxy=0x51f1328, pAuthnSvc=0x19bc38, pAuthzSvc=0x19bc34, pServerPrincName=0x19bc2c, pAuthnLevel=0x19bc30, pImpLevel=0x19bc20, pAuthInfo=0x19bc24, pCapabilites=0x19bc28 | out: pAuthnSvc=0x19bc38*=0xa, pAuthzSvc=0x19bc34*=0x0, pServerPrincName=0x19bc2c, pAuthnLevel=0x19bc30*=0x6, pImpLevel=0x19bc20*=0x2, pAuthInfo=0x19bc24, pCapabilites=0x19bc28*=0x1) returned 0x0 [0173.735] WbemLocator:IUnknown:Release (This=0x717d2c) returned 0x3 [0173.735] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1328, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbdc | out: ppvObject=0x19bbdc*=0x717d50) returned 0x0 [0173.735] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1328, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbc8 | out: ppvObject=0x19bbc8*=0x717d2c) returned 0x0 [0173.736] WbemLocator:IClientSecurity:SetBlanket (This=0x717d2c, pProxy=0x51f1328, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0173.736] WbemLocator:IUnknown:Release (This=0x717d2c) returned 0x4 [0173.736] WbemLocator:IUnknown:Release (This=0x717d50) returned 0x3 [0173.736] CoTaskMemFree (pv=0x51f89d8) [0173.736] WbemLocator:IUnknown:Release (This=0x51f1328) returned 0x2 [0173.736] SysStringLen (param_1=0x0) returned 0x0 [0173.736] CoGetContextToken (in: pToken=0x19bae8 | out: pToken=0x19bae8) returned 0x0 [0173.736] WbemLocator:IUnknown:AddRef (This=0x51f1328) returned 0x3 [0173.736] IWbemServices:ExecQuery (in: This=0x51f1328, strQueryLanguage="WQL", strQuery="SELECT * FROM FirewallProduct", lFlags=16, pCtx=0x0, ppEnum=0x19bcf8 | out: ppEnum=0x19bcf8*=0x6d2010) returned 0x0 [0173.741] IUnknown:QueryInterface (in: This=0x6d2010, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb54 | out: ppvObject=0x19bb54*=0x6d2014) returned 0x0 [0173.741] IClientSecurity:QueryBlanket (in: This=0x6d2014, pProxy=0x6d2010, pAuthnSvc=0x19bba4, pAuthzSvc=0x19bba0, pServerPrincName=0x19bb98, pAuthnLevel=0x19bb9c, pImpLevel=0x19bb8c, pAuthInfo=0x19bb90, pCapabilites=0x19bb94 | out: pAuthnSvc=0x19bba4*=0xa, pAuthzSvc=0x19bba0*=0x0, pServerPrincName=0x19bb98, pAuthnLevel=0x19bb9c*=0x6, pImpLevel=0x19bb8c*=0x2, pAuthInfo=0x19bb90, pCapabilites=0x19bb94*=0x1) returned 0x0 [0173.741] IUnknown:Release (This=0x6d2014) returned 0x1 [0173.741] IUnknown:QueryInterface (in: This=0x6d2010, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb48 | out: ppvObject=0x19bb48*=0x716150) returned 0x0 [0173.742] IUnknown:QueryInterface (in: This=0x6d2010, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb34 | out: ppvObject=0x19bb34*=0x6d2014) returned 0x0 [0173.742] IClientSecurity:SetBlanket (This=0x6d2014, pProxy=0x6d2010, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0173.743] IUnknown:Release (This=0x6d2014) returned 0x2 [0173.743] WbemLocator:IUnknown:Release (This=0x716150) returned 0x1 [0173.743] CoTaskMemFree (pv=0x51f89d8) [0173.743] IUnknown:QueryInterface (in: This=0x6d2010, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b740 | out: ppvObject=0x19b740*=0x716150) returned 0x0 [0173.743] WbemLocator:IUnknown:QueryInterface (in: This=0x716150, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b6fc | out: ppvObject=0x19b6fc*=0x0) returned 0x80004002 [0173.744] WbemLocator:IUnknown:QueryInterface (in: This=0x716150, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b51c | out: ppvObject=0x19b51c*=0x0) returned 0x80004002 [0173.744] IUnknown:QueryInterface (in: This=0x6d2010, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b2f4 | out: ppvObject=0x19b2f4*=0x0) returned 0x80004002 [0173.745] WbemLocator:IUnknown:AddRef (This=0x716150) returned 0x3 [0173.745] WbemLocator:IUnknown:QueryInterface (in: This=0x716150, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b054 | out: ppvObject=0x19b054*=0x0) returned 0x80004002 [0173.745] WbemLocator:IUnknown:QueryInterface (in: This=0x716150, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19b004 | out: ppvObject=0x19b004*=0x0) returned 0x80004002 [0173.745] WbemLocator:IUnknown:QueryInterface (in: This=0x716150, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b010 | out: ppvObject=0x19b010*=0x7160ac) returned 0x0 [0173.745] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x7160ac, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b018 | out: pCid=0x19b018*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0173.745] WbemLocator:IUnknown:Release (This=0x7160ac) returned 0x3 [0173.745] CoGetContextToken (in: pToken=0x19b070 | out: pToken=0x19b070) returned 0x0 [0173.745] CoGetContextToken (in: pToken=0x19b478 | out: pToken=0x19b478) returned 0x0 [0173.745] WbemLocator:IUnknown:QueryInterface (in: This=0x716150, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b504 | out: ppvObject=0x19b504*=0x716134) returned 0x0 [0173.745] WbemLocator:IRpcOptions:Query (in: This=0x716134, pPrx=0x716150, dwProperty=2, pdwValue=0x19b510 | out: pdwValue=0x19b510) returned 0x80004002 [0173.745] WbemLocator:IUnknown:Release (This=0x716134) returned 0x3 [0173.745] WbemLocator:IUnknown:Release (This=0x716150) returned 0x2 [0173.745] CoGetContextToken (in: pToken=0x19ba50 | out: pToken=0x19ba50) returned 0x0 [0173.745] CoGetContextToken (in: pToken=0x19b9b0 | out: pToken=0x19b9b0) returned 0x0 [0173.745] WbemLocator:IUnknown:QueryInterface (in: This=0x716150, riid=0x19ba80*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19ba7c | out: ppvObject=0x19ba7c*=0x6d2010) returned 0x0 [0173.745] IUnknown:AddRef (This=0x6d2010) returned 0x4 [0173.745] IUnknown:Release (This=0x6d2010) returned 0x3 [0173.745] IUnknown:Release (This=0x6d2010) returned 0x2 [0173.745] WbemLocator:IUnknown:Release (This=0x51f1328) returned 0x2 [0173.745] SysStringLen (param_1=0x0) returned 0x0 [0173.745] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7a90, puCount=0x19bd44 | out: puCount=0x19bd44*=0x2) returned 0x0 [0173.746] WbemDefPath:IWbemPath:GetText (in: This=0x51d7a90, lFlags=4, puBuffLength=0x19bd40*=0x0, pszText=0x0 | out: puBuffLength=0x19bd40*=0x18, pszText=0x0) returned 0x0 [0173.746] WbemDefPath:IWbemPath:GetText (in: This=0x51d7a90, lFlags=4, puBuffLength=0x19bd40*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x19bd40*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0173.746] CoGetContextToken (in: pToken=0x19bb90 | out: pToken=0x19bb90) returned 0x0 [0173.746] IUnknown:AddRef (This=0x6d2010) returned 0x3 [0173.746] IEnumWbemClassObject:Clone (in: This=0x6d2010, ppEnum=0x19bd50 | out: ppEnum=0x19bd50*=0x6d1c28) returned 0x0 [0173.747] IUnknown:QueryInterface (in: This=0x6d1c28, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bc0c | out: ppvObject=0x19bc0c*=0x6d1c2c) returned 0x0 [0173.747] IClientSecurity:QueryBlanket (in: This=0x6d1c2c, pProxy=0x6d1c28, pAuthnSvc=0x19bc5c, pAuthzSvc=0x19bc58, pServerPrincName=0x19bc50, pAuthnLevel=0x19bc54, pImpLevel=0x19bc44, pAuthInfo=0x19bc48, pCapabilites=0x19bc4c | out: pAuthnSvc=0x19bc5c*=0xa, pAuthzSvc=0x19bc58*=0x0, pServerPrincName=0x19bc50, pAuthnLevel=0x19bc54*=0x6, pImpLevel=0x19bc44*=0x2, pAuthInfo=0x19bc48, pCapabilites=0x19bc4c*=0x1) returned 0x0 [0173.747] IUnknown:Release (This=0x6d1c2c) returned 0x1 [0173.747] IUnknown:QueryInterface (in: This=0x6d1c28, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bc00 | out: ppvObject=0x19bc00*=0x520cae0) returned 0x0 [0173.747] IUnknown:QueryInterface (in: This=0x6d1c28, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbec | out: ppvObject=0x19bbec*=0x6d1c2c) returned 0x0 [0173.747] IClientSecurity:SetBlanket (This=0x6d1c2c, pProxy=0x6d1c28, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0173.749] IUnknown:Release (This=0x6d1c2c) returned 0x2 [0173.749] WbemLocator:IUnknown:Release (This=0x520cae0) returned 0x1 [0173.749] CoTaskMemFree (pv=0x51f8a08) [0173.749] IUnknown:QueryInterface (in: This=0x6d1c28, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b7e8 | out: ppvObject=0x19b7e8*=0x520cae0) returned 0x0 [0173.749] WbemLocator:IUnknown:QueryInterface (in: This=0x520cae0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b7a4 | out: ppvObject=0x19b7a4*=0x0) returned 0x80004002 [0173.749] WbemLocator:IUnknown:QueryInterface (in: This=0x520cae0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b5c4 | out: ppvObject=0x19b5c4*=0x0) returned 0x80004002 [0173.750] IUnknown:QueryInterface (in: This=0x6d1c28, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b39c | out: ppvObject=0x19b39c*=0x0) returned 0x80004002 [0173.750] WbemLocator:IUnknown:AddRef (This=0x520cae0) returned 0x3 [0173.750] WbemLocator:IUnknown:QueryInterface (in: This=0x520cae0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0173.750] WbemLocator:IUnknown:QueryInterface (in: This=0x520cae0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19b0ac | out: ppvObject=0x19b0ac*=0x0) returned 0x80004002 [0173.750] WbemLocator:IUnknown:QueryInterface (in: This=0x520cae0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0b8 | out: ppvObject=0x19b0b8*=0x520ca3c) returned 0x0 [0173.750] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520ca3c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b0c0 | out: pCid=0x19b0c0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0173.750] WbemLocator:IUnknown:Release (This=0x520ca3c) returned 0x3 [0173.750] CoGetContextToken (in: pToken=0x19b118 | out: pToken=0x19b118) returned 0x0 [0173.751] CoGetContextToken (in: pToken=0x19b520 | out: pToken=0x19b520) returned 0x0 [0173.751] WbemLocator:IUnknown:QueryInterface (in: This=0x520cae0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b5ac | out: ppvObject=0x19b5ac*=0x520cac4) returned 0x0 [0173.751] WbemLocator:IRpcOptions:Query (in: This=0x520cac4, pPrx=0x520cae0, dwProperty=2, pdwValue=0x19b5b8 | out: pdwValue=0x19b5b8) returned 0x80004002 [0173.751] WbemLocator:IUnknown:Release (This=0x520cac4) returned 0x3 [0173.751] WbemLocator:IUnknown:Release (This=0x520cae0) returned 0x2 [0173.751] CoGetContextToken (in: pToken=0x19baf8 | out: pToken=0x19baf8) returned 0x0 [0173.751] CoGetContextToken (in: pToken=0x19ba58 | out: pToken=0x19ba58) returned 0x0 [0173.751] WbemLocator:IUnknown:QueryInterface (in: This=0x520cae0, riid=0x19bb28*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19bb24 | out: ppvObject=0x19bb24*=0x6d1c28) returned 0x0 [0173.751] IUnknown:AddRef (This=0x6d1c28) returned 0x4 [0173.751] IUnknown:Release (This=0x6d1c28) returned 0x3 [0173.751] IUnknown:Release (This=0x6d1c28) returned 0x2 [0173.751] IUnknown:Release (This=0x6d2010) returned 0x2 [0173.751] SysStringLen (param_1=0x0) returned 0x0 [0173.751] IEnumWbemClassObject:Reset (This=0x6d1c28) returned 0x0 [0173.752] CoTaskMemAlloc (cb=0x4) returned 0x51de7c8 [0173.752] IEnumWbemClassObject:Next (in: This=0x6d1c28, lTimeout=-1, uCount=0x1, apObjects=0x51de7c8, puReturned=0x291b7c0 | out: apObjects=0x51de7c8*=0x0, puReturned=0x291b7c0*=0x0) returned 0x1 [0173.752] CoTaskMemFree (pv=0x51de7c8) [0173.752] CoGetContextToken (in: pToken=0x19bc70 | out: pToken=0x19bc70) returned 0x0 [0173.752] WbemLocator:IUnknown:Release (This=0x520cae0) returned 0x1 [0173.752] IUnknown:Release (This=0x6d1c28) returned 0x0 [0173.753] CoGetContextToken (in: pToken=0x19bc70 | out: pToken=0x19bc70) returned 0x0 [0173.753] WbemLocator:IUnknown:Release (This=0x716150) returned 0x1 [0173.753] IUnknown:Release (This=0x6d2010) returned 0x0 [0173.755] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x330 [0173.756] SetEvent (hEvent=0x638) returned 1 [0173.756] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x330, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0173.758] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0173.758] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0173.758] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7b00, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x51d7b00) returned 0x0 [0173.758] WbemDefPath:IUnknown:AddRef (This=0x51d7b00) returned 0x3 [0173.758] WbemDefPath:IUnknown:Release (This=0x51d7b00) returned 0x2 [0173.758] WbemDefPath:IWbemPath:SetText (This=0x51d7b00, uMode=0x4, pszPath="ROOT\\SecurityCenter2") returned 0x0 [0173.758] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b00, puCount=0x19bd94 | out: puCount=0x19bd94*=0x2) returned 0x0 [0173.758] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b00, lFlags=4, puBuffLength=0x19bd90*=0x0, pszText=0x0 | out: puBuffLength=0x19bd90*=0x19, pszText=0x0) returned 0x0 [0173.758] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b00, lFlags=4, puBuffLength=0x19bd90*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x19bd90*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0173.758] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b00, puCount=0x19bd80 | out: puCount=0x19bd80*=0x2) returned 0x0 [0173.758] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b00, lFlags=4, puBuffLength=0x19bd7c*=0x0, pszText=0x0 | out: puBuffLength=0x19bd7c*=0x19, pszText=0x0) returned 0x0 [0173.758] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b00, lFlags=4, puBuffLength=0x19bd7c*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x19bd7c*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0173.768] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc30*=0x368, lpdwindex=0x19bae4 | out: lpdwindex=0x19bae4) returned 0x0 [0173.802] CoGetContextToken (in: pToken=0x19b9f0 | out: pToken=0x19b9f0) returned 0x0 [0173.802] CoGetContextToken (in: pToken=0x19b998 | out: pToken=0x19b998) returned 0x0 [0173.802] IUnknown:QueryInterface (in: This=0x66f9c0, riid=0x6f12da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b974 | out: ppvObject=0x19b974*=0x66f9d0) returned 0x0 [0173.802] CObjectContext::ContextCallback () returned 0x0 [0173.804] IUnknown:Release (This=0x66f9d0) returned 0x1 [0173.804] CoUnmarshalInterface (in: pStm=0x51b8070, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19b9e4 | out: ppv=0x19b9e4*=0x520c5e0) returned 0x0 [0173.804] CoMarshalInterface (pStm=0x51b8070, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x520c5e0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0173.805] WbemLocator:IUnknown:QueryInterface (in: This=0x520c5e0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b884 | out: ppvObject=0x19b884*=0x520c5e0) returned 0x0 [0173.805] WbemLocator:IUnknown:QueryInterface (in: This=0x520c5e0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b840 | out: ppvObject=0x19b840*=0x0) returned 0x80004002 [0173.805] WbemLocator:IUnknown:QueryInterface (in: This=0x520c5e0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x0) returned 0x80004002 [0173.806] WbemLocator:IUnknown:QueryInterface (in: This=0x520c5e0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b434 | out: ppvObject=0x19b434*=0x0) returned 0x80004002 [0173.806] WbemLocator:IUnknown:AddRef (This=0x520c5e0) returned 0x3 [0173.807] WbemLocator:IUnknown:QueryInterface (in: This=0x520c5e0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b194 | out: ppvObject=0x19b194*=0x0) returned 0x80004002 [0173.807] WbemLocator:IUnknown:QueryInterface (in: This=0x520c5e0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19b144 | out: ppvObject=0x19b144*=0x0) returned 0x80004002 [0173.807] WbemLocator:IUnknown:QueryInterface (in: This=0x520c5e0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b150 | out: ppvObject=0x19b150*=0x520c53c) returned 0x0 [0173.807] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520c53c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b158 | out: pCid=0x19b158*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0173.807] WbemLocator:IUnknown:Release (This=0x520c53c) returned 0x3 [0173.807] CoGetContextToken (in: pToken=0x19b1b0 | out: pToken=0x19b1b0) returned 0x0 [0173.807] CoGetContextToken (in: pToken=0x19b5b8 | out: pToken=0x19b5b8) returned 0x0 [0173.807] WbemLocator:IUnknown:QueryInterface (in: This=0x520c5e0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b644 | out: ppvObject=0x19b644*=0x520c5c4) returned 0x0 [0173.807] WbemLocator:IRpcOptions:Query (in: This=0x520c5c4, pPrx=0x520c5e0, dwProperty=2, pdwValue=0x19b650 | out: pdwValue=0x19b650) returned 0x0 [0173.807] WbemLocator:IUnknown:Release (This=0x520c5c4) returned 0x3 [0173.807] WbemLocator:IUnknown:Release (This=0x520c5e0) returned 0x2 [0173.807] WbemLocator:IUnknown:Release (This=0x520c5e0) returned 0x1 [0173.807] CoGetContextToken (in: pToken=0x19b930 | out: pToken=0x19b930) returned 0x0 [0173.807] WbemLocator:IUnknown:AddRef (This=0x520c5e0) returned 0x2 [0173.807] WbemLocator:IUnknown:QueryInterface (in: This=0x520c5e0, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbe8 | out: ppvObject=0x19bbe8*=0x520c5bc) returned 0x0 [0173.807] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x520c5bc, pProxy=0x520c5e0, pAuthnSvc=0x19bc38, pAuthzSvc=0x19bc34, pServerPrincName=0x19bc2c, pAuthnLevel=0x19bc30, pImpLevel=0x19bc20, pAuthInfo=0x19bc24, pCapabilites=0x19bc28 | out: pAuthnSvc=0x19bc38*=0xa, pAuthzSvc=0x19bc34*=0x0, pServerPrincName=0x19bc2c, pAuthnLevel=0x19bc30*=0x6, pImpLevel=0x19bc20*=0x2, pAuthInfo=0x19bc24, pCapabilites=0x19bc28*=0x1) returned 0x0 [0173.807] WbemLocator:IUnknown:Release (This=0x520c5bc) returned 0x2 [0173.808] WbemLocator:IUnknown:QueryInterface (in: This=0x520c5e0, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbdc | out: ppvObject=0x19bbdc*=0x520c5e0) returned 0x0 [0173.808] WbemLocator:IUnknown:QueryInterface (in: This=0x520c5e0, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbc8 | out: ppvObject=0x19bbc8*=0x520c5bc) returned 0x0 [0173.808] WbemLocator:IClientSecurity:SetBlanket (This=0x520c5bc, pProxy=0x520c5e0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0173.808] WbemLocator:IUnknown:Release (This=0x520c5bc) returned 0x3 [0173.808] WbemLocator:IUnknown:Release (This=0x520c5e0) returned 0x2 [0173.808] CoTaskMemFree (pv=0x51f8a68) [0173.808] WbemLocator:IUnknown:Release (This=0x520c5e0) returned 0x1 [0173.808] SysStringLen (param_1=0x0) returned 0x0 [0173.808] CoGetContextToken (in: pToken=0x19bba8 | out: pToken=0x19bba8) returned 0x0 [0173.808] CoGetContextToken (in: pToken=0x19bb08 | out: pToken=0x19bb08) returned 0x0 [0173.808] WbemLocator:IUnknown:QueryInterface (in: This=0x520c5e0, riid=0x19bbd8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19bbd4 | out: ppvObject=0x19bbd4*=0x51f13c8) returned 0x0 [0173.809] WbemLocator:IUnknown:AddRef (This=0x51f13c8) returned 0x3 [0173.809] WbemLocator:IUnknown:Release (This=0x51f13c8) returned 0x2 [0173.809] CoGetContextToken (in: pToken=0x19bb68 | out: pToken=0x19bb68) returned 0x0 [0173.809] WbemLocator:IUnknown:AddRef (This=0x51f13c8) returned 0x3 [0173.809] WbemLocator:IUnknown:QueryInterface (in: This=0x51f13c8, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbe8 | out: ppvObject=0x19bbe8*=0x520c5bc) returned 0x0 [0173.809] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x520c5bc, pProxy=0x51f13c8, pAuthnSvc=0x19bc38, pAuthzSvc=0x19bc34, pServerPrincName=0x19bc2c, pAuthnLevel=0x19bc30, pImpLevel=0x19bc20, pAuthInfo=0x19bc24, pCapabilites=0x19bc28 | out: pAuthnSvc=0x19bc38*=0xa, pAuthzSvc=0x19bc34*=0x0, pServerPrincName=0x19bc2c, pAuthnLevel=0x19bc30*=0x6, pImpLevel=0x19bc20*=0x2, pAuthInfo=0x19bc24, pCapabilites=0x19bc28*=0x1) returned 0x0 [0173.809] WbemLocator:IUnknown:Release (This=0x520c5bc) returned 0x3 [0173.809] WbemLocator:IUnknown:QueryInterface (in: This=0x51f13c8, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbdc | out: ppvObject=0x19bbdc*=0x520c5e0) returned 0x0 [0173.809] WbemLocator:IUnknown:QueryInterface (in: This=0x51f13c8, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbc8 | out: ppvObject=0x19bbc8*=0x520c5bc) returned 0x0 [0173.810] WbemLocator:IClientSecurity:SetBlanket (This=0x520c5bc, pProxy=0x51f13c8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0173.810] WbemLocator:IUnknown:Release (This=0x520c5bc) returned 0x4 [0173.810] WbemLocator:IUnknown:Release (This=0x520c5e0) returned 0x3 [0173.810] CoTaskMemFree (pv=0x51f8a68) [0173.810] WbemLocator:IUnknown:Release (This=0x51f13c8) returned 0x2 [0173.810] SysStringLen (param_1=0x0) returned 0x0 [0173.810] CoGetContextToken (in: pToken=0x19bae8 | out: pToken=0x19bae8) returned 0x0 [0173.810] WbemLocator:IUnknown:AddRef (This=0x51f13c8) returned 0x3 [0173.810] IWbemServices:ExecQuery (in: This=0x51f13c8, strQueryLanguage="WQL", strQuery="SELECT * FROM AntivirusProduct", lFlags=16, pCtx=0x0, ppEnum=0x19bcf8 | out: ppEnum=0x19bcf8*=0x6d2010) returned 0x0 [0173.854] IUnknown:QueryInterface (in: This=0x6d2010, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb54 | out: ppvObject=0x19bb54*=0x6d2014) returned 0x0 [0173.854] IClientSecurity:QueryBlanket (in: This=0x6d2014, pProxy=0x6d2010, pAuthnSvc=0x19bba4, pAuthzSvc=0x19bba0, pServerPrincName=0x19bb98, pAuthnLevel=0x19bb9c, pImpLevel=0x19bb8c, pAuthInfo=0x19bb90, pCapabilites=0x19bb94 | out: pAuthnSvc=0x19bba4*=0xa, pAuthzSvc=0x19bba0*=0x0, pServerPrincName=0x19bb98, pAuthnLevel=0x19bb9c*=0x6, pImpLevel=0x19bb8c*=0x2, pAuthInfo=0x19bb90, pCapabilites=0x19bb94*=0x1) returned 0x0 [0173.854] IUnknown:Release (This=0x6d2014) returned 0x1 [0173.854] IUnknown:QueryInterface (in: This=0x6d2010, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb48 | out: ppvObject=0x19bb48*=0x520b4e0) returned 0x0 [0173.855] IUnknown:QueryInterface (in: This=0x6d2010, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb34 | out: ppvObject=0x19bb34*=0x6d2014) returned 0x0 [0173.855] IClientSecurity:SetBlanket (This=0x6d2014, pProxy=0x6d2010, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0173.857] IUnknown:Release (This=0x6d2014) returned 0x2 [0173.857] WbemLocator:IUnknown:Release (This=0x520b4e0) returned 0x1 [0173.857] CoTaskMemFree (pv=0x51f8a68) [0173.857] IUnknown:QueryInterface (in: This=0x6d2010, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b740 | out: ppvObject=0x19b740*=0x520b4e0) returned 0x0 [0173.857] WbemLocator:IUnknown:QueryInterface (in: This=0x520b4e0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b6fc | out: ppvObject=0x19b6fc*=0x0) returned 0x80004002 [0173.858] WbemLocator:IUnknown:QueryInterface (in: This=0x520b4e0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b51c | out: ppvObject=0x19b51c*=0x0) returned 0x80004002 [0173.858] IUnknown:QueryInterface (in: This=0x6d2010, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b2f4 | out: ppvObject=0x19b2f4*=0x0) returned 0x80004002 [0173.859] WbemLocator:IUnknown:AddRef (This=0x520b4e0) returned 0x3 [0173.859] WbemLocator:IUnknown:QueryInterface (in: This=0x520b4e0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b054 | out: ppvObject=0x19b054*=0x0) returned 0x80004002 [0173.859] WbemLocator:IUnknown:QueryInterface (in: This=0x520b4e0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19b004 | out: ppvObject=0x19b004*=0x0) returned 0x80004002 [0173.859] WbemLocator:IUnknown:QueryInterface (in: This=0x520b4e0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b010 | out: ppvObject=0x19b010*=0x520b43c) returned 0x0 [0173.859] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520b43c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b018 | out: pCid=0x19b018*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0173.859] WbemLocator:IUnknown:Release (This=0x520b43c) returned 0x3 [0173.859] CoGetContextToken (in: pToken=0x19b070 | out: pToken=0x19b070) returned 0x0 [0173.859] CoGetContextToken (in: pToken=0x19b478 | out: pToken=0x19b478) returned 0x0 [0173.859] WbemLocator:IUnknown:QueryInterface (in: This=0x520b4e0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b504 | out: ppvObject=0x19b504*=0x520b4c4) returned 0x0 [0173.859] WbemLocator:IRpcOptions:Query (in: This=0x520b4c4, pPrx=0x520b4e0, dwProperty=2, pdwValue=0x19b510 | out: pdwValue=0x19b510) returned 0x80004002 [0173.859] WbemLocator:IUnknown:Release (This=0x520b4c4) returned 0x3 [0173.859] WbemLocator:IUnknown:Release (This=0x520b4e0) returned 0x2 [0173.859] CoGetContextToken (in: pToken=0x19ba50 | out: pToken=0x19ba50) returned 0x0 [0173.859] CoGetContextToken (in: pToken=0x19b9b0 | out: pToken=0x19b9b0) returned 0x0 [0173.859] WbemLocator:IUnknown:QueryInterface (in: This=0x520b4e0, riid=0x19ba80*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19ba7c | out: ppvObject=0x19ba7c*=0x6d2010) returned 0x0 [0173.859] IUnknown:AddRef (This=0x6d2010) returned 0x4 [0173.859] IUnknown:Release (This=0x6d2010) returned 0x3 [0173.859] IUnknown:Release (This=0x6d2010) returned 0x2 [0173.859] WbemLocator:IUnknown:Release (This=0x51f13c8) returned 0x2 [0173.859] SysStringLen (param_1=0x0) returned 0x0 [0173.860] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b00, puCount=0x19bd44 | out: puCount=0x19bd44*=0x2) returned 0x0 [0173.860] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b00, lFlags=4, puBuffLength=0x19bd40*=0x0, pszText=0x0 | out: puBuffLength=0x19bd40*=0x19, pszText=0x0) returned 0x0 [0173.860] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b00, lFlags=4, puBuffLength=0x19bd40*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x19bd40*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0173.860] CoGetContextToken (in: pToken=0x19bb90 | out: pToken=0x19bb90) returned 0x0 [0173.860] IUnknown:AddRef (This=0x6d2010) returned 0x3 [0173.860] IEnumWbemClassObject:Clone (in: This=0x6d2010, ppEnum=0x19bd50 | out: ppEnum=0x19bd50*=0x6d2a38) returned 0x0 [0173.861] IUnknown:QueryInterface (in: This=0x6d2a38, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bc0c | out: ppvObject=0x19bc0c*=0x6d2a3c) returned 0x0 [0173.861] IClientSecurity:QueryBlanket (in: This=0x6d2a3c, pProxy=0x6d2a38, pAuthnSvc=0x19bc5c, pAuthzSvc=0x19bc58, pServerPrincName=0x19bc50, pAuthnLevel=0x19bc54, pImpLevel=0x19bc44, pAuthInfo=0x19bc48, pCapabilites=0x19bc4c | out: pAuthnSvc=0x19bc5c*=0xa, pAuthzSvc=0x19bc58*=0x0, pServerPrincName=0x19bc50, pAuthnLevel=0x19bc54*=0x6, pImpLevel=0x19bc44*=0x2, pAuthInfo=0x19bc48, pCapabilites=0x19bc4c*=0x1) returned 0x0 [0173.861] IUnknown:Release (This=0x6d2a3c) returned 0x1 [0173.861] IUnknown:QueryInterface (in: This=0x6d2a38, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bc00 | out: ppvObject=0x19bc00*=0x520c7e0) returned 0x0 [0173.861] IUnknown:QueryInterface (in: This=0x6d2a38, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbec | out: ppvObject=0x19bbec*=0x6d2a3c) returned 0x0 [0173.861] IClientSecurity:SetBlanket (This=0x6d2a3c, pProxy=0x6d2a38, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0173.862] IUnknown:Release (This=0x6d2a3c) returned 0x2 [0173.862] WbemLocator:IUnknown:Release (This=0x520c7e0) returned 0x1 [0173.862] CoTaskMemFree (pv=0x51f8a98) [0173.862] IUnknown:QueryInterface (in: This=0x6d2a38, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b7e8 | out: ppvObject=0x19b7e8*=0x520c7e0) returned 0x0 [0173.863] WbemLocator:IUnknown:QueryInterface (in: This=0x520c7e0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b7a4 | out: ppvObject=0x19b7a4*=0x0) returned 0x80004002 [0173.863] WbemLocator:IUnknown:QueryInterface (in: This=0x520c7e0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b5c4 | out: ppvObject=0x19b5c4*=0x0) returned 0x80004002 [0173.863] IUnknown:QueryInterface (in: This=0x6d2a38, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b39c | out: ppvObject=0x19b39c*=0x0) returned 0x80004002 [0173.864] WbemLocator:IUnknown:AddRef (This=0x520c7e0) returned 0x3 [0173.864] WbemLocator:IUnknown:QueryInterface (in: This=0x520c7e0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0173.864] WbemLocator:IUnknown:QueryInterface (in: This=0x520c7e0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19b0ac | out: ppvObject=0x19b0ac*=0x0) returned 0x80004002 [0173.864] WbemLocator:IUnknown:QueryInterface (in: This=0x520c7e0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0b8 | out: ppvObject=0x19b0b8*=0x520c73c) returned 0x0 [0173.864] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520c73c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b0c0 | out: pCid=0x19b0c0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0173.864] WbemLocator:IUnknown:Release (This=0x520c73c) returned 0x3 [0173.864] CoGetContextToken (in: pToken=0x19b118 | out: pToken=0x19b118) returned 0x0 [0173.864] CoGetContextToken (in: pToken=0x19b520 | out: pToken=0x19b520) returned 0x0 [0173.864] WbemLocator:IUnknown:QueryInterface (in: This=0x520c7e0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b5ac | out: ppvObject=0x19b5ac*=0x520c7c4) returned 0x0 [0173.864] WbemLocator:IRpcOptions:Query (in: This=0x520c7c4, pPrx=0x520c7e0, dwProperty=2, pdwValue=0x19b5b8 | out: pdwValue=0x19b5b8) returned 0x80004002 [0173.864] WbemLocator:IUnknown:Release (This=0x520c7c4) returned 0x3 [0173.864] WbemLocator:IUnknown:Release (This=0x520c7e0) returned 0x2 [0173.864] CoGetContextToken (in: pToken=0x19baf8 | out: pToken=0x19baf8) returned 0x0 [0173.864] CoGetContextToken (in: pToken=0x19ba58 | out: pToken=0x19ba58) returned 0x0 [0173.864] WbemLocator:IUnknown:QueryInterface (in: This=0x520c7e0, riid=0x19bb28*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19bb24 | out: ppvObject=0x19bb24*=0x6d2a38) returned 0x0 [0173.865] IUnknown:AddRef (This=0x6d2a38) returned 0x4 [0173.865] IUnknown:Release (This=0x6d2a38) returned 0x3 [0173.865] IUnknown:Release (This=0x6d2a38) returned 0x2 [0173.865] IUnknown:Release (This=0x6d2010) returned 0x2 [0173.865] SysStringLen (param_1=0x0) returned 0x0 [0173.865] IEnumWbemClassObject:Reset (This=0x6d2a38) returned 0x0 [0173.865] CoTaskMemAlloc (cb=0x4) returned 0x51de8a8 [0173.865] IEnumWbemClassObject:Next (in: This=0x6d2a38, lTimeout=-1, uCount=0x1, apObjects=0x51de8a8, puReturned=0x291ce44 | out: apObjects=0x51de8a8*=0x719130, puReturned=0x291ce44*=0x1) returned 0x0 [0173.866] IUnknown:QueryInterface (in: This=0x719130, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3a8 | out: ppvObject=0x19b3a8*=0x719130) returned 0x0 [0173.866] IUnknown:QueryInterface (in: This=0x719130, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b364 | out: ppvObject=0x19b364*=0x0) returned 0x80004002 [0173.866] IUnknown:QueryInterface (in: This=0x719130, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b184 | out: ppvObject=0x19b184*=0x0) returned 0x80004002 [0173.866] IUnknown:QueryInterface (in: This=0x719130, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af5c | out: ppvObject=0x19af5c*=0x0) returned 0x80004002 [0173.867] IUnknown:AddRef (This=0x719130) returned 0x3 [0173.867] IUnknown:QueryInterface (in: This=0x719130, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acbc | out: ppvObject=0x19acbc*=0x0) returned 0x80004002 [0173.867] IUnknown:QueryInterface (in: This=0x719130, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac6c | out: ppvObject=0x19ac6c*=0x0) returned 0x80004002 [0173.867] IUnknown:QueryInterface (in: This=0x719130, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac78 | out: ppvObject=0x19ac78*=0x719134) returned 0x0 [0173.867] IMarshal:GetUnmarshalClass (in: This=0x719134, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19ac80 | out: pCid=0x19ac80*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0173.867] IUnknown:Release (This=0x719134) returned 0x3 [0173.867] CoGetContextToken (in: pToken=0x19acd8 | out: pToken=0x19acd8) returned 0x0 [0173.867] CoGetContextToken (in: pToken=0x19b0e0 | out: pToken=0x19b0e0) returned 0x0 [0173.867] IUnknown:QueryInterface (in: This=0x719130, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b16c | out: ppvObject=0x19b16c*=0x0) returned 0x80004002 [0173.867] IUnknown:Release (This=0x719130) returned 0x2 [0173.867] CoGetContextToken (in: pToken=0x19b6b8 | out: pToken=0x19b6b8) returned 0x0 [0173.867] CoGetContextToken (in: pToken=0x19b618 | out: pToken=0x19b618) returned 0x0 [0173.867] IUnknown:QueryInterface (in: This=0x719130, riid=0x19b6e8*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b6e4 | out: ppvObject=0x19b6e4*=0x719130) returned 0x0 [0173.867] IUnknown:AddRef (This=0x719130) returned 0x4 [0173.867] IUnknown:Release (This=0x719130) returned 0x3 [0173.867] IUnknown:Release (This=0x719130) returned 0x2 [0173.867] CoTaskMemFree (pv=0x51de8a8) [0173.867] CoGetContextToken (in: pToken=0x19ba30 | out: pToken=0x19ba30) returned 0x0 [0173.867] IUnknown:AddRef (This=0x719130) returned 0x3 [0173.867] IWbemClassObject:Get (in: This=0x719130, wszName="__GENUS", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc0*=0, plFlavor=0x19bdbc*=0 | out: pVal=0x19bd40*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bdc0*=3, plFlavor=0x19bdbc*=64) returned 0x0 [0173.867] IWbemClassObject:Get (in: This=0x719130, wszName="__PATH", lFlags=0, pVal=0x19bd24*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bda8*=0, plFlavor=0x19bda4*=0 | out: pVal=0x19bd24*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\SecurityCenter2:AntiVirusProduct.instanceGuid=\"{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}\"", varVal2=0x0), pType=0x19bda8*=8, plFlavor=0x19bda4*=64) returned 0x0 [0173.868] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\SecurityCenter2:AntiVirusProduct.instanceGuid=\"{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}\"") returned 0xc8 [0173.868] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\SecurityCenter2:AntiVirusProduct.instanceGuid=\"{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}\"") returned 0xc8 [0173.868] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x558 [0173.868] SetEvent (hEvent=0x638) returned 1 [0173.868] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bcfc*=0x558, lpdwindex=0x19bb1c | out: lpdwindex=0x19bb1c) returned 0x0 [0173.873] CoGetContextToken (in: pToken=0x19bbc8 | out: pToken=0x19bbc8) returned 0x0 [0173.873] CoGetContextToken (in: pToken=0x19bb28 | out: pToken=0x19bb28) returned 0x0 [0173.873] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d77f0, riid=0x19bbf8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bbf4 | out: ppvObject=0x19bbf4*=0x51d77f0) returned 0x0 [0173.873] WbemDefPath:IUnknown:AddRef (This=0x51d77f0) returned 0x3 [0173.873] WbemDefPath:IUnknown:Release (This=0x51d77f0) returned 0x2 [0173.873] WbemDefPath:IWbemPath:SetText (This=0x51d77f0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\SecurityCenter2:AntiVirusProduct.instanceGuid=\"{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}\"") returned 0x0 [0173.873] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b00, puCount=0x19bd7c | out: puCount=0x19bd7c*=0x2) returned 0x0 [0173.873] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b00, lFlags=4, puBuffLength=0x19bd78*=0x0, pszText=0x0 | out: puBuffLength=0x19bd78*=0x19, pszText=0x0) returned 0x0 [0173.873] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b00, lFlags=4, puBuffLength=0x19bd78*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x19bd78*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0173.873] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b00, puCount=0x19bd48 | out: puCount=0x19bd48*=0x2) returned 0x0 [0173.873] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b00, lFlags=4, puBuffLength=0x19bd44*=0x0, pszText=0x0 | out: puBuffLength=0x19bd44*=0x19, pszText=0x0) returned 0x0 [0173.873] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b00, lFlags=4, puBuffLength=0x19bd44*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x19bd44*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0173.873] IWbemClassObject:Get (in: This=0x719130, wszName="displayName", lFlags=0, pVal=0x19bd44*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x291d768*=0, plFlavor=0x291d76c*=0 | out: pVal=0x19bd44*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Windows Defender", varVal2=0x0), pType=0x291d768*=8, plFlavor=0x291d76c*=0) returned 0x0 [0173.874] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0173.874] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0173.874] IWbemClassObject:Get (in: This=0x719130, wszName="displayName", lFlags=0, pVal=0x19bd4c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x291d768*=8, plFlavor=0x291d76c*=0 | out: pVal=0x19bd4c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Windows Defender", varVal2=0x0), pType=0x291d768*=8, plFlavor=0x291d76c*=0) returned 0x0 [0173.874] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0173.874] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0173.874] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b00, puCount=0x19bd48 | out: puCount=0x19bd48*=0x2) returned 0x0 [0173.874] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b00, lFlags=4, puBuffLength=0x19bd44*=0x0, pszText=0x0 | out: puBuffLength=0x19bd44*=0x19, pszText=0x0) returned 0x0 [0173.874] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b00, lFlags=4, puBuffLength=0x19bd44*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x19bd44*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0173.874] IWbemClassObject:Get (in: This=0x719130, wszName="displayName", lFlags=0, pVal=0x19bd44*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x291d878*=0, plFlavor=0x291d87c*=0 | out: pVal=0x19bd44*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Windows Defender", varVal2=0x0), pType=0x291d878*=8, plFlavor=0x291d87c*=0) returned 0x0 [0173.874] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0173.874] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0173.874] IWbemClassObject:Get (in: This=0x719130, wszName="displayName", lFlags=0, pVal=0x19bd4c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x291d878*=8, plFlavor=0x291d87c*=0 | out: pVal=0x19bd4c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Windows Defender", varVal2=0x0), pType=0x291d878*=8, plFlavor=0x291d87c*=0) returned 0x0 [0173.874] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0173.874] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0173.874] CoTaskMemAlloc (cb=0x4) returned 0x51de858 [0173.875] IEnumWbemClassObject:Next (in: This=0x6d2a38, lTimeout=-1, uCount=0x1, apObjects=0x51de858, puReturned=0x291ce44 | out: apObjects=0x51de858*=0x0, puReturned=0x291ce44*=0x0) returned 0x1 [0173.877] CoTaskMemFree (pv=0x51de858) [0173.877] CoGetContextToken (in: pToken=0x19bc70 | out: pToken=0x19bc70) returned 0x0 [0173.877] WbemLocator:IUnknown:Release (This=0x520c7e0) returned 0x1 [0173.877] IUnknown:Release (This=0x6d2a38) returned 0x0 [0173.879] CoGetContextToken (in: pToken=0x19bc70 | out: pToken=0x19bc70) returned 0x0 [0173.879] WbemLocator:IUnknown:Release (This=0x520b4e0) returned 0x1 [0173.879] IUnknown:Release (This=0x6d2010) returned 0x0 [0173.880] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3b4 [0173.880] SetEvent (hEvent=0x638) returned 1 [0173.880] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x3b4, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0173.882] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0173.882] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0173.882] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7e80, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x51d7e80) returned 0x0 [0173.883] WbemDefPath:IUnknown:AddRef (This=0x51d7e80) returned 0x3 [0173.883] WbemDefPath:IUnknown:Release (This=0x51d7e80) returned 0x2 [0173.883] WbemDefPath:IWbemPath:SetText (This=0x51d7e80, uMode=0x4, pszPath="ROOT\\SecurityCenter2") returned 0x0 [0173.883] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7e80, puCount=0x19bd94 | out: puCount=0x19bd94*=0x2) returned 0x0 [0173.883] WbemDefPath:IWbemPath:GetText (in: This=0x51d7e80, lFlags=4, puBuffLength=0x19bd90*=0x0, pszText=0x0 | out: puBuffLength=0x19bd90*=0x19, pszText=0x0) returned 0x0 [0173.883] WbemDefPath:IWbemPath:GetText (in: This=0x51d7e80, lFlags=4, puBuffLength=0x19bd90*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x19bd90*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0173.883] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7e80, puCount=0x19bd80 | out: puCount=0x19bd80*=0x2) returned 0x0 [0173.883] WbemDefPath:IWbemPath:GetText (in: This=0x51d7e80, lFlags=4, puBuffLength=0x19bd7c*=0x0, pszText=0x0 | out: puBuffLength=0x19bd7c*=0x19, pszText=0x0) returned 0x0 [0173.883] WbemDefPath:IWbemPath:GetText (in: This=0x51d7e80, lFlags=4, puBuffLength=0x19bd7c*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x19bd7c*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0173.890] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc30*=0x488, lpdwindex=0x19bae4 | out: lpdwindex=0x19bae4) returned 0x0 [0173.956] CoGetContextToken (in: pToken=0x19b9f0 | out: pToken=0x19b9f0) returned 0x0 [0173.956] CoGetContextToken (in: pToken=0x19b998 | out: pToken=0x19b998) returned 0x0 [0173.956] IUnknown:QueryInterface (in: This=0x66f9c0, riid=0x6f12da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b974 | out: ppvObject=0x19b974*=0x66f9d0) returned 0x0 [0173.956] CObjectContext::ContextCallback () returned 0x0 [0173.958] IUnknown:Release (This=0x66f9d0) returned 0x1 [0173.958] CoUnmarshalInterface (in: pStm=0x51e14f0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19b9e4 | out: ppv=0x19b9e4*=0x520c6e0) returned 0x0 [0173.958] CoMarshalInterface (pStm=0x51e14f0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x520c6e0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0173.958] WbemLocator:IUnknown:QueryInterface (in: This=0x520c6e0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b884 | out: ppvObject=0x19b884*=0x520c6e0) returned 0x0 [0173.958] WbemLocator:IUnknown:QueryInterface (in: This=0x520c6e0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b840 | out: ppvObject=0x19b840*=0x0) returned 0x80004002 [0173.959] WbemLocator:IUnknown:QueryInterface (in: This=0x520c6e0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x0) returned 0x80004002 [0173.959] WbemLocator:IUnknown:QueryInterface (in: This=0x520c6e0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b434 | out: ppvObject=0x19b434*=0x0) returned 0x80004002 [0173.960] WbemLocator:IUnknown:AddRef (This=0x520c6e0) returned 0x3 [0173.960] WbemLocator:IUnknown:QueryInterface (in: This=0x520c6e0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b194 | out: ppvObject=0x19b194*=0x0) returned 0x80004002 [0173.960] WbemLocator:IUnknown:QueryInterface (in: This=0x520c6e0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19b144 | out: ppvObject=0x19b144*=0x0) returned 0x80004002 [0173.960] WbemLocator:IUnknown:QueryInterface (in: This=0x520c6e0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b150 | out: ppvObject=0x19b150*=0x520c63c) returned 0x0 [0173.960] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520c63c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b158 | out: pCid=0x19b158*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0173.960] WbemLocator:IUnknown:Release (This=0x520c63c) returned 0x3 [0173.960] CoGetContextToken (in: pToken=0x19b1b0 | out: pToken=0x19b1b0) returned 0x0 [0173.960] CoGetContextToken (in: pToken=0x19b5b8 | out: pToken=0x19b5b8) returned 0x0 [0173.960] WbemLocator:IUnknown:QueryInterface (in: This=0x520c6e0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b644 | out: ppvObject=0x19b644*=0x520c6c4) returned 0x0 [0173.960] WbemLocator:IRpcOptions:Query (in: This=0x520c6c4, pPrx=0x520c6e0, dwProperty=2, pdwValue=0x19b650 | out: pdwValue=0x19b650) returned 0x0 [0173.960] WbemLocator:IUnknown:Release (This=0x520c6c4) returned 0x3 [0173.960] WbemLocator:IUnknown:Release (This=0x520c6e0) returned 0x2 [0173.960] WbemLocator:IUnknown:Release (This=0x520c6e0) returned 0x1 [0173.960] CoGetContextToken (in: pToken=0x19b930 | out: pToken=0x19b930) returned 0x0 [0173.960] WbemLocator:IUnknown:AddRef (This=0x520c6e0) returned 0x2 [0173.961] WbemLocator:IUnknown:QueryInterface (in: This=0x520c6e0, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbe8 | out: ppvObject=0x19bbe8*=0x520c6bc) returned 0x0 [0173.961] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x520c6bc, pProxy=0x520c6e0, pAuthnSvc=0x19bc38, pAuthzSvc=0x19bc34, pServerPrincName=0x19bc2c, pAuthnLevel=0x19bc30, pImpLevel=0x19bc20, pAuthInfo=0x19bc24, pCapabilites=0x19bc28 | out: pAuthnSvc=0x19bc38*=0xa, pAuthzSvc=0x19bc34*=0x0, pServerPrincName=0x19bc2c, pAuthnLevel=0x19bc30*=0x6, pImpLevel=0x19bc20*=0x2, pAuthInfo=0x19bc24, pCapabilites=0x19bc28*=0x1) returned 0x0 [0173.961] WbemLocator:IUnknown:Release (This=0x520c6bc) returned 0x2 [0173.961] WbemLocator:IUnknown:QueryInterface (in: This=0x520c6e0, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbdc | out: ppvObject=0x19bbdc*=0x520c6e0) returned 0x0 [0173.961] WbemLocator:IUnknown:QueryInterface (in: This=0x520c6e0, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbc8 | out: ppvObject=0x19bbc8*=0x520c6bc) returned 0x0 [0173.961] WbemLocator:IClientSecurity:SetBlanket (This=0x520c6bc, pProxy=0x520c6e0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0173.961] WbemLocator:IUnknown:Release (This=0x520c6bc) returned 0x3 [0173.961] WbemLocator:IUnknown:Release (This=0x520c6e0) returned 0x2 [0173.961] CoTaskMemFree (pv=0x51f8a68) [0173.962] WbemLocator:IUnknown:Release (This=0x520c6e0) returned 0x1 [0173.962] SysStringLen (param_1=0x0) returned 0x0 [0173.962] CoGetContextToken (in: pToken=0x19bba8 | out: pToken=0x19bba8) returned 0x0 [0173.962] CoGetContextToken (in: pToken=0x19bb08 | out: pToken=0x19bb08) returned 0x0 [0173.962] WbemLocator:IUnknown:QueryInterface (in: This=0x520c6e0, riid=0x19bbd8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19bbd4 | out: ppvObject=0x19bbd4*=0x51f15f8) returned 0x0 [0173.962] WbemLocator:IUnknown:AddRef (This=0x51f15f8) returned 0x3 [0173.962] WbemLocator:IUnknown:Release (This=0x51f15f8) returned 0x2 [0173.962] CoGetContextToken (in: pToken=0x19bb68 | out: pToken=0x19bb68) returned 0x0 [0173.963] WbemLocator:IUnknown:AddRef (This=0x51f15f8) returned 0x3 [0173.963] WbemLocator:IUnknown:QueryInterface (in: This=0x51f15f8, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbe8 | out: ppvObject=0x19bbe8*=0x520c6bc) returned 0x0 [0173.963] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x520c6bc, pProxy=0x51f15f8, pAuthnSvc=0x19bc38, pAuthzSvc=0x19bc34, pServerPrincName=0x19bc2c, pAuthnLevel=0x19bc30, pImpLevel=0x19bc20, pAuthInfo=0x19bc24, pCapabilites=0x19bc28 | out: pAuthnSvc=0x19bc38*=0xa, pAuthzSvc=0x19bc34*=0x0, pServerPrincName=0x19bc2c, pAuthnLevel=0x19bc30*=0x6, pImpLevel=0x19bc20*=0x2, pAuthInfo=0x19bc24, pCapabilites=0x19bc28*=0x1) returned 0x0 [0173.963] WbemLocator:IUnknown:Release (This=0x520c6bc) returned 0x3 [0173.963] WbemLocator:IUnknown:QueryInterface (in: This=0x51f15f8, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbdc | out: ppvObject=0x19bbdc*=0x520c6e0) returned 0x0 [0173.963] WbemLocator:IUnknown:QueryInterface (in: This=0x51f15f8, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbc8 | out: ppvObject=0x19bbc8*=0x520c6bc) returned 0x0 [0173.963] WbemLocator:IClientSecurity:SetBlanket (This=0x520c6bc, pProxy=0x51f15f8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0173.963] WbemLocator:IUnknown:Release (This=0x520c6bc) returned 0x4 [0173.963] WbemLocator:IUnknown:Release (This=0x520c6e0) returned 0x3 [0173.963] CoTaskMemFree (pv=0x51f8a98) [0173.963] WbemLocator:IUnknown:Release (This=0x51f15f8) returned 0x2 [0173.963] SysStringLen (param_1=0x0) returned 0x0 [0173.963] CoGetContextToken (in: pToken=0x19bae8 | out: pToken=0x19bae8) returned 0x0 [0173.963] WbemLocator:IUnknown:AddRef (This=0x51f15f8) returned 0x3 [0173.964] IWbemServices:ExecQuery (in: This=0x51f15f8, strQueryLanguage="WQL", strQuery="SELECT * FROM AntiSpyWareProduct", lFlags=16, pCtx=0x0, ppEnum=0x19bcf8 | out: ppEnum=0x19bcf8*=0x6d2588) returned 0x0 [0173.969] IUnknown:QueryInterface (in: This=0x6d2588, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb50 | out: ppvObject=0x19bb50*=0x6d258c) returned 0x0 [0173.969] IClientSecurity:QueryBlanket (in: This=0x6d258c, pProxy=0x6d2588, pAuthnSvc=0x19bba0, pAuthzSvc=0x19bb9c, pServerPrincName=0x19bb94, pAuthnLevel=0x19bb98, pImpLevel=0x19bb88, pAuthInfo=0x19bb8c, pCapabilites=0x19bb90 | out: pAuthnSvc=0x19bba0*=0xa, pAuthzSvc=0x19bb9c*=0x0, pServerPrincName=0x19bb94, pAuthnLevel=0x19bb98*=0x6, pImpLevel=0x19bb88*=0x2, pAuthInfo=0x19bb8c, pCapabilites=0x19bb90*=0x1) returned 0x0 [0173.969] IUnknown:Release (This=0x6d258c) returned 0x1 [0173.969] IUnknown:QueryInterface (in: This=0x6d2588, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb44 | out: ppvObject=0x19bb44*=0x520b9e0) returned 0x0 [0173.970] IUnknown:QueryInterface (in: This=0x6d2588, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb30 | out: ppvObject=0x19bb30*=0x6d258c) returned 0x0 [0173.970] IClientSecurity:SetBlanket (This=0x6d258c, pProxy=0x6d2588, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0173.971] IUnknown:Release (This=0x6d258c) returned 0x2 [0173.972] WbemLocator:IUnknown:Release (This=0x520b9e0) returned 0x1 [0173.972] CoTaskMemFree (pv=0x51f8ac8) [0173.972] IUnknown:QueryInterface (in: This=0x6d2588, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b73c | out: ppvObject=0x19b73c*=0x520b9e0) returned 0x0 [0173.972] WbemLocator:IUnknown:QueryInterface (in: This=0x520b9e0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b6f8 | out: ppvObject=0x19b6f8*=0x0) returned 0x80004002 [0173.972] WbemLocator:IUnknown:QueryInterface (in: This=0x520b9e0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b514 | out: ppvObject=0x19b514*=0x0) returned 0x80004002 [0173.973] IUnknown:QueryInterface (in: This=0x6d2588, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b2ec | out: ppvObject=0x19b2ec*=0x0) returned 0x80004002 [0173.973] WbemLocator:IUnknown:AddRef (This=0x520b9e0) returned 0x3 [0173.973] WbemLocator:IUnknown:QueryInterface (in: This=0x520b9e0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b04c | out: ppvObject=0x19b04c*=0x0) returned 0x80004002 [0173.973] WbemLocator:IUnknown:QueryInterface (in: This=0x520b9e0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19affc | out: ppvObject=0x19affc*=0x0) returned 0x80004002 [0173.973] WbemLocator:IUnknown:QueryInterface (in: This=0x520b9e0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b008 | out: ppvObject=0x19b008*=0x520b93c) returned 0x0 [0173.974] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520b93c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b010 | out: pCid=0x19b010*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0173.974] WbemLocator:IUnknown:Release (This=0x520b93c) returned 0x3 [0173.974] CoGetContextToken (in: pToken=0x19b068 | out: pToken=0x19b068) returned 0x0 [0173.974] CoGetContextToken (in: pToken=0x19b470 | out: pToken=0x19b470) returned 0x0 [0173.974] WbemLocator:IUnknown:QueryInterface (in: This=0x520b9e0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b4fc | out: ppvObject=0x19b4fc*=0x520b9c4) returned 0x0 [0173.974] WbemLocator:IRpcOptions:Query (in: This=0x520b9c4, pPrx=0x520b9e0, dwProperty=2, pdwValue=0x19b508 | out: pdwValue=0x19b508) returned 0x80004002 [0173.974] WbemLocator:IUnknown:Release (This=0x520b9c4) returned 0x3 [0173.974] WbemLocator:IUnknown:Release (This=0x520b9e0) returned 0x2 [0173.974] CoGetContextToken (in: pToken=0x19ba50 | out: pToken=0x19ba50) returned 0x0 [0173.974] CoGetContextToken (in: pToken=0x19b9b0 | out: pToken=0x19b9b0) returned 0x0 [0173.974] WbemLocator:IUnknown:QueryInterface (in: This=0x520b9e0, riid=0x19ba80*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19ba7c | out: ppvObject=0x19ba7c*=0x6d2588) returned 0x0 [0173.974] IUnknown:AddRef (This=0x6d2588) returned 0x4 [0173.974] IUnknown:Release (This=0x6d2588) returned 0x3 [0173.974] IUnknown:Release (This=0x6d2588) returned 0x2 [0173.974] WbemLocator:IUnknown:Release (This=0x51f15f8) returned 0x2 [0173.974] SysStringLen (param_1=0x0) returned 0x0 [0173.974] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7e80, puCount=0x19bd44 | out: puCount=0x19bd44*=0x2) returned 0x0 [0173.975] WbemDefPath:IWbemPath:GetText (in: This=0x51d7e80, lFlags=4, puBuffLength=0x19bd40*=0x0, pszText=0x0 | out: puBuffLength=0x19bd40*=0x19, pszText=0x0) returned 0x0 [0173.975] WbemDefPath:IWbemPath:GetText (in: This=0x51d7e80, lFlags=4, puBuffLength=0x19bd40*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x19bd40*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0173.975] CoGetContextToken (in: pToken=0x19bb90 | out: pToken=0x19bb90) returned 0x0 [0173.975] IUnknown:AddRef (This=0x6d2588) returned 0x3 [0173.975] IEnumWbemClassObject:Clone (in: This=0x6d2588, ppEnum=0x19bd50 | out: ppEnum=0x19bd50*=0x6d1c28) returned 0x0 [0173.976] IUnknown:QueryInterface (in: This=0x6d1c28, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bc0c | out: ppvObject=0x19bc0c*=0x6d1c2c) returned 0x0 [0173.976] IClientSecurity:QueryBlanket (in: This=0x6d1c2c, pProxy=0x6d1c28, pAuthnSvc=0x19bc5c, pAuthzSvc=0x19bc58, pServerPrincName=0x19bc50, pAuthnLevel=0x19bc54, pImpLevel=0x19bc44, pAuthInfo=0x19bc48, pCapabilites=0x19bc4c | out: pAuthnSvc=0x19bc5c*=0xa, pAuthzSvc=0x19bc58*=0x0, pServerPrincName=0x19bc50, pAuthnLevel=0x19bc54*=0x6, pImpLevel=0x19bc44*=0x2, pAuthInfo=0x19bc48, pCapabilites=0x19bc4c*=0x1) returned 0x0 [0173.976] IUnknown:Release (This=0x6d1c2c) returned 0x1 [0173.976] IUnknown:QueryInterface (in: This=0x6d1c28, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bc00 | out: ppvObject=0x19bc00*=0x520cae0) returned 0x0 [0173.976] IUnknown:QueryInterface (in: This=0x6d1c28, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbec | out: ppvObject=0x19bbec*=0x6d1c2c) returned 0x0 [0173.976] IClientSecurity:SetBlanket (This=0x6d1c2c, pProxy=0x6d1c28, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0173.978] IUnknown:Release (This=0x6d1c2c) returned 0x2 [0173.978] WbemLocator:IUnknown:Release (This=0x520cae0) returned 0x1 [0173.978] CoTaskMemFree (pv=0x51f8f18) [0173.978] IUnknown:QueryInterface (in: This=0x6d1c28, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b7e8 | out: ppvObject=0x19b7e8*=0x520cae0) returned 0x0 [0173.979] WbemLocator:IUnknown:QueryInterface (in: This=0x520cae0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b7a4 | out: ppvObject=0x19b7a4*=0x0) returned 0x80004002 [0173.979] WbemLocator:IUnknown:QueryInterface (in: This=0x520cae0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b5c4 | out: ppvObject=0x19b5c4*=0x0) returned 0x80004002 [0173.980] IUnknown:QueryInterface (in: This=0x6d1c28, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b39c | out: ppvObject=0x19b39c*=0x0) returned 0x80004002 [0173.980] WbemLocator:IUnknown:AddRef (This=0x520cae0) returned 0x3 [0173.980] WbemLocator:IUnknown:QueryInterface (in: This=0x520cae0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0173.980] WbemLocator:IUnknown:QueryInterface (in: This=0x520cae0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19b0ac | out: ppvObject=0x19b0ac*=0x0) returned 0x80004002 [0173.980] WbemLocator:IUnknown:QueryInterface (in: This=0x520cae0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0b8 | out: ppvObject=0x19b0b8*=0x520ca3c) returned 0x0 [0173.980] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520ca3c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b0c0 | out: pCid=0x19b0c0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0173.980] WbemLocator:IUnknown:Release (This=0x520ca3c) returned 0x3 [0173.980] CoGetContextToken (in: pToken=0x19b118 | out: pToken=0x19b118) returned 0x0 [0173.980] CoGetContextToken (in: pToken=0x19b520 | out: pToken=0x19b520) returned 0x0 [0173.980] WbemLocator:IUnknown:QueryInterface (in: This=0x520cae0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b5ac | out: ppvObject=0x19b5ac*=0x520cac4) returned 0x0 [0173.981] WbemLocator:IRpcOptions:Query (in: This=0x520cac4, pPrx=0x520cae0, dwProperty=2, pdwValue=0x19b5b8 | out: pdwValue=0x19b5b8) returned 0x80004002 [0173.981] WbemLocator:IUnknown:Release (This=0x520cac4) returned 0x3 [0173.981] WbemLocator:IUnknown:Release (This=0x520cae0) returned 0x2 [0173.981] CoGetContextToken (in: pToken=0x19baf8 | out: pToken=0x19baf8) returned 0x0 [0173.981] CoGetContextToken (in: pToken=0x19ba58 | out: pToken=0x19ba58) returned 0x0 [0173.981] WbemLocator:IUnknown:QueryInterface (in: This=0x520cae0, riid=0x19bb28*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19bb24 | out: ppvObject=0x19bb24*=0x6d1c28) returned 0x0 [0173.981] IUnknown:AddRef (This=0x6d1c28) returned 0x4 [0173.981] IUnknown:Release (This=0x6d1c28) returned 0x3 [0173.981] IUnknown:Release (This=0x6d1c28) returned 0x2 [0173.981] IUnknown:Release (This=0x6d2588) returned 0x2 [0173.981] SysStringLen (param_1=0x0) returned 0x0 [0173.981] IEnumWbemClassObject:Reset (This=0x6d1c28) returned 0x0 [0173.982] CoTaskMemAlloc (cb=0x4) returned 0x51de878 [0173.982] IEnumWbemClassObject:Next (in: This=0x6d1c28, lTimeout=-1, uCount=0x1, apObjects=0x51de878, puReturned=0x291eb14 | out: apObjects=0x51de878*=0x5207e38, puReturned=0x291eb14*=0x1) returned 0x0 [0173.984] IUnknown:QueryInterface (in: This=0x5207e38, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3a8 | out: ppvObject=0x19b3a8*=0x5207e38) returned 0x0 [0173.984] IUnknown:QueryInterface (in: This=0x5207e38, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b364 | out: ppvObject=0x19b364*=0x0) returned 0x80004002 [0173.985] IUnknown:QueryInterface (in: This=0x5207e38, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b184 | out: ppvObject=0x19b184*=0x0) returned 0x80004002 [0173.985] IUnknown:QueryInterface (in: This=0x5207e38, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af5c | out: ppvObject=0x19af5c*=0x0) returned 0x80004002 [0173.985] IUnknown:AddRef (This=0x5207e38) returned 0x3 [0173.985] IUnknown:QueryInterface (in: This=0x5207e38, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acbc | out: ppvObject=0x19acbc*=0x0) returned 0x80004002 [0173.985] IUnknown:QueryInterface (in: This=0x5207e38, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac6c | out: ppvObject=0x19ac6c*=0x0) returned 0x80004002 [0173.985] IUnknown:QueryInterface (in: This=0x5207e38, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac78 | out: ppvObject=0x19ac78*=0x5207e3c) returned 0x0 [0173.985] IMarshal:GetUnmarshalClass (in: This=0x5207e3c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19ac80 | out: pCid=0x19ac80*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0173.985] IUnknown:Release (This=0x5207e3c) returned 0x3 [0173.985] CoGetContextToken (in: pToken=0x19acd8 | out: pToken=0x19acd8) returned 0x0 [0173.985] CoGetContextToken (in: pToken=0x19b0e0 | out: pToken=0x19b0e0) returned 0x0 [0173.985] IUnknown:QueryInterface (in: This=0x5207e38, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b16c | out: ppvObject=0x19b16c*=0x0) returned 0x80004002 [0173.985] IUnknown:Release (This=0x5207e38) returned 0x2 [0173.985] CoGetContextToken (in: pToken=0x19b6b8 | out: pToken=0x19b6b8) returned 0x0 [0173.985] CoGetContextToken (in: pToken=0x19b618 | out: pToken=0x19b618) returned 0x0 [0173.985] IUnknown:QueryInterface (in: This=0x5207e38, riid=0x19b6e8*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b6e4 | out: ppvObject=0x19b6e4*=0x5207e38) returned 0x0 [0173.985] IUnknown:AddRef (This=0x5207e38) returned 0x4 [0173.985] IUnknown:Release (This=0x5207e38) returned 0x3 [0173.985] IUnknown:Release (This=0x5207e38) returned 0x2 [0173.985] CoTaskMemFree (pv=0x51de878) [0173.985] CoGetContextToken (in: pToken=0x19ba30 | out: pToken=0x19ba30) returned 0x0 [0173.985] IUnknown:AddRef (This=0x5207e38) returned 0x3 [0173.986] IWbemClassObject:Get (in: This=0x5207e38, wszName="__GENUS", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc0*=0, plFlavor=0x19bdbc*=0 | out: pVal=0x19bd40*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bdc0*=3, plFlavor=0x19bdbc*=64) returned 0x0 [0173.986] IWbemClassObject:Get (in: This=0x5207e38, wszName="__PATH", lFlags=0, pVal=0x19bd24*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bda8*=0, plFlavor=0x19bda4*=0 | out: pVal=0x19bd24*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\SecurityCenter2:AntiSpywareProduct.instanceGuid=\"{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}\"", varVal2=0x0), pType=0x19bda8*=8, plFlavor=0x19bda4*=64) returned 0x0 [0173.987] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\SecurityCenter2:AntiSpywareProduct.instanceGuid=\"{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}\"") returned 0xcc [0173.987] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\SecurityCenter2:AntiSpywareProduct.instanceGuid=\"{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}\"") returned 0xcc [0173.987] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x494 [0173.987] SetEvent (hEvent=0x638) returned 1 [0173.988] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bcfc*=0x494, lpdwindex=0x19bb1c | out: lpdwindex=0x19bb1c) returned 0x0 [0173.990] CoGetContextToken (in: pToken=0x19bbc8 | out: pToken=0x19bbc8) returned 0x0 [0173.990] CoGetContextToken (in: pToken=0x19bb28 | out: pToken=0x19bb28) returned 0x0 [0173.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7780, riid=0x19bbf8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bbf4 | out: ppvObject=0x19bbf4*=0x51d7780) returned 0x0 [0173.991] WbemDefPath:IUnknown:AddRef (This=0x51d7780) returned 0x3 [0173.991] WbemDefPath:IUnknown:Release (This=0x51d7780) returned 0x2 [0173.991] WbemDefPath:IWbemPath:SetText (This=0x51d7780, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\SecurityCenter2:AntiSpywareProduct.instanceGuid=\"{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}\"") returned 0x0 [0173.991] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7e80, puCount=0x19bd7c | out: puCount=0x19bd7c*=0x2) returned 0x0 [0173.991] WbemDefPath:IWbemPath:GetText (in: This=0x51d7e80, lFlags=4, puBuffLength=0x19bd78*=0x0, pszText=0x0 | out: puBuffLength=0x19bd78*=0x19, pszText=0x0) returned 0x0 [0173.991] WbemDefPath:IWbemPath:GetText (in: This=0x51d7e80, lFlags=4, puBuffLength=0x19bd78*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x19bd78*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0173.991] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7e80, puCount=0x19bd48 | out: puCount=0x19bd48*=0x2) returned 0x0 [0173.991] WbemDefPath:IWbemPath:GetText (in: This=0x51d7e80, lFlags=4, puBuffLength=0x19bd44*=0x0, pszText=0x0 | out: puBuffLength=0x19bd44*=0x19, pszText=0x0) returned 0x0 [0173.991] WbemDefPath:IWbemPath:GetText (in: This=0x51d7e80, lFlags=4, puBuffLength=0x19bd44*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x19bd44*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0173.991] IWbemClassObject:Get (in: This=0x5207e38, wszName="displayName", lFlags=0, pVal=0x19bd44*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x291f43c*=0, plFlavor=0x291f440*=0 | out: pVal=0x19bd44*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Windows Defender", varVal2=0x0), pType=0x291f43c*=8, plFlavor=0x291f440*=0) returned 0x0 [0173.991] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0173.991] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0173.991] IWbemClassObject:Get (in: This=0x5207e38, wszName="displayName", lFlags=0, pVal=0x19bd4c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x291f43c*=8, plFlavor=0x291f440*=0 | out: pVal=0x19bd4c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Windows Defender", varVal2=0x0), pType=0x291f43c*=8, plFlavor=0x291f440*=0) returned 0x0 [0173.991] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0173.991] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0173.991] CoTaskMemAlloc (cb=0x4) returned 0x51de858 [0173.991] IEnumWbemClassObject:Next (in: This=0x6d1c28, lTimeout=-1, uCount=0x1, apObjects=0x51de858, puReturned=0x291eb14 | out: apObjects=0x51de858*=0x0, puReturned=0x291eb14*=0x0) returned 0x1 [0173.992] CoTaskMemFree (pv=0x51de858) [0173.992] CoGetContextToken (in: pToken=0x19bc70 | out: pToken=0x19bc70) returned 0x0 [0173.993] WbemLocator:IUnknown:Release (This=0x520cae0) returned 0x1 [0173.993] IUnknown:Release (This=0x6d1c28) returned 0x0 [0173.994] CoGetContextToken (in: pToken=0x19bc70 | out: pToken=0x19bc70) returned 0x0 [0173.994] WbemLocator:IUnknown:Release (This=0x520b9e0) returned 0x1 [0173.994] IUnknown:Release (This=0x6d2588) returned 0x0 [0173.995] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4c0 [0173.995] SetEvent (hEvent=0x638) returned 1 [0173.996] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x4c0, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0173.998] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0173.998] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0173.998] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7a20, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x51d7a20) returned 0x0 [0173.998] WbemDefPath:IUnknown:AddRef (This=0x51d7a20) returned 0x3 [0173.998] WbemDefPath:IUnknown:Release (This=0x51d7a20) returned 0x2 [0173.998] WbemDefPath:IWbemPath:SetText (This=0x51d7a20, uMode=0x4, pszPath="ROOT\\SecurityCenter2") returned 0x0 [0173.998] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7a20, puCount=0x19bd94 | out: puCount=0x19bd94*=0x2) returned 0x0 [0173.998] WbemDefPath:IWbemPath:GetText (in: This=0x51d7a20, lFlags=4, puBuffLength=0x19bd90*=0x0, pszText=0x0 | out: puBuffLength=0x19bd90*=0x19, pszText=0x0) returned 0x0 [0173.998] WbemDefPath:IWbemPath:GetText (in: This=0x51d7a20, lFlags=4, puBuffLength=0x19bd90*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x19bd90*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0173.998] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7a20, puCount=0x19bd80 | out: puCount=0x19bd80*=0x2) returned 0x0 [0173.998] WbemDefPath:IWbemPath:GetText (in: This=0x51d7a20, lFlags=4, puBuffLength=0x19bd7c*=0x0, pszText=0x0 | out: puBuffLength=0x19bd7c*=0x19, pszText=0x0) returned 0x0 [0173.998] WbemDefPath:IWbemPath:GetText (in: This=0x51d7a20, lFlags=4, puBuffLength=0x19bd7c*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x19bd7c*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0174.011] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc30*=0x740, lpdwindex=0x19bae4 | out: lpdwindex=0x19bae4) returned 0x0 [0174.047] CoGetContextToken (in: pToken=0x19b9f0 | out: pToken=0x19b9f0) returned 0x0 [0174.047] CoGetContextToken (in: pToken=0x19b998 | out: pToken=0x19b998) returned 0x0 [0174.047] IUnknown:QueryInterface (in: This=0x66f9c0, riid=0x6f12da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b974 | out: ppvObject=0x19b974*=0x66f9d0) returned 0x0 [0174.047] CObjectContext::ContextCallback () returned 0x0 [0174.049] IUnknown:Release (This=0x66f9d0) returned 0x1 [0174.049] CoUnmarshalInterface (in: pStm=0x5209b20, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19b9e4 | out: ppv=0x19b9e4*=0x520b9e0) returned 0x0 [0174.049] CoMarshalInterface (pStm=0x5209b20, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x520b9e0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0174.050] WbemLocator:IUnknown:QueryInterface (in: This=0x520b9e0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b884 | out: ppvObject=0x19b884*=0x520b9e0) returned 0x0 [0174.050] WbemLocator:IUnknown:QueryInterface (in: This=0x520b9e0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b840 | out: ppvObject=0x19b840*=0x0) returned 0x80004002 [0174.050] WbemLocator:IUnknown:QueryInterface (in: This=0x520b9e0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x0) returned 0x80004002 [0174.051] WbemLocator:IUnknown:QueryInterface (in: This=0x520b9e0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b434 | out: ppvObject=0x19b434*=0x0) returned 0x80004002 [0174.052] WbemLocator:IUnknown:AddRef (This=0x520b9e0) returned 0x3 [0174.052] WbemLocator:IUnknown:QueryInterface (in: This=0x520b9e0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b194 | out: ppvObject=0x19b194*=0x0) returned 0x80004002 [0174.052] WbemLocator:IUnknown:QueryInterface (in: This=0x520b9e0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19b144 | out: ppvObject=0x19b144*=0x0) returned 0x80004002 [0174.052] WbemLocator:IUnknown:QueryInterface (in: This=0x520b9e0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b150 | out: ppvObject=0x19b150*=0x520b93c) returned 0x0 [0174.052] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520b93c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b158 | out: pCid=0x19b158*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0174.052] WbemLocator:IUnknown:Release (This=0x520b93c) returned 0x3 [0174.052] CoGetContextToken (in: pToken=0x19b1b0 | out: pToken=0x19b1b0) returned 0x0 [0174.052] CoGetContextToken (in: pToken=0x19b5b8 | out: pToken=0x19b5b8) returned 0x0 [0174.052] WbemLocator:IUnknown:QueryInterface (in: This=0x520b9e0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b644 | out: ppvObject=0x19b644*=0x520b9c4) returned 0x0 [0174.052] WbemLocator:IRpcOptions:Query (in: This=0x520b9c4, pPrx=0x520b9e0, dwProperty=2, pdwValue=0x19b650 | out: pdwValue=0x19b650) returned 0x0 [0174.052] WbemLocator:IUnknown:Release (This=0x520b9c4) returned 0x3 [0174.052] WbemLocator:IUnknown:Release (This=0x520b9e0) returned 0x2 [0174.052] WbemLocator:IUnknown:Release (This=0x520b9e0) returned 0x1 [0174.052] CoGetContextToken (in: pToken=0x19b930 | out: pToken=0x19b930) returned 0x0 [0174.052] WbemLocator:IUnknown:AddRef (This=0x520b9e0) returned 0x2 [0174.053] WbemLocator:IUnknown:QueryInterface (in: This=0x520b9e0, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbe8 | out: ppvObject=0x19bbe8*=0x520b9bc) returned 0x0 [0174.053] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x520b9bc, pProxy=0x520b9e0, pAuthnSvc=0x19bc38, pAuthzSvc=0x19bc34, pServerPrincName=0x19bc2c, pAuthnLevel=0x19bc30, pImpLevel=0x19bc20, pAuthInfo=0x19bc24, pCapabilites=0x19bc28 | out: pAuthnSvc=0x19bc38*=0xa, pAuthzSvc=0x19bc34*=0x0, pServerPrincName=0x19bc2c, pAuthnLevel=0x19bc30*=0x6, pImpLevel=0x19bc20*=0x2, pAuthInfo=0x19bc24, pCapabilites=0x19bc28*=0x1) returned 0x0 [0174.053] WbemLocator:IUnknown:Release (This=0x520b9bc) returned 0x2 [0174.053] WbemLocator:IUnknown:QueryInterface (in: This=0x520b9e0, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbdc | out: ppvObject=0x19bbdc*=0x520b9e0) returned 0x0 [0174.053] WbemLocator:IUnknown:QueryInterface (in: This=0x520b9e0, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbc8 | out: ppvObject=0x19bbc8*=0x520b9bc) returned 0x0 [0174.053] WbemLocator:IClientSecurity:SetBlanket (This=0x520b9bc, pProxy=0x520b9e0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0174.053] WbemLocator:IUnknown:Release (This=0x520b9bc) returned 0x3 [0174.053] WbemLocator:IUnknown:Release (This=0x520b9e0) returned 0x2 [0174.053] CoTaskMemFree (pv=0x51f8a98) [0174.054] WbemLocator:IUnknown:Release (This=0x520b9e0) returned 0x1 [0174.054] SysStringLen (param_1=0x0) returned 0x0 [0174.054] CoGetContextToken (in: pToken=0x19bba8 | out: pToken=0x19bba8) returned 0x0 [0174.054] CoGetContextToken (in: pToken=0x19bb08 | out: pToken=0x19bb08) returned 0x0 [0174.054] WbemLocator:IUnknown:QueryInterface (in: This=0x520b9e0, riid=0x19bbd8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19bbd4 | out: ppvObject=0x19bbd4*=0x51f1c38) returned 0x0 [0174.055] WbemLocator:IUnknown:AddRef (This=0x51f1c38) returned 0x3 [0174.055] WbemLocator:IUnknown:Release (This=0x51f1c38) returned 0x2 [0174.055] CoGetContextToken (in: pToken=0x19bb68 | out: pToken=0x19bb68) returned 0x0 [0174.055] WbemLocator:IUnknown:AddRef (This=0x51f1c38) returned 0x3 [0174.055] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1c38, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbe8 | out: ppvObject=0x19bbe8*=0x520b9bc) returned 0x0 [0174.055] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x520b9bc, pProxy=0x51f1c38, pAuthnSvc=0x19bc38, pAuthzSvc=0x19bc34, pServerPrincName=0x19bc2c, pAuthnLevel=0x19bc30, pImpLevel=0x19bc20, pAuthInfo=0x19bc24, pCapabilites=0x19bc28 | out: pAuthnSvc=0x19bc38*=0xa, pAuthzSvc=0x19bc34*=0x0, pServerPrincName=0x19bc2c, pAuthnLevel=0x19bc30*=0x6, pImpLevel=0x19bc20*=0x2, pAuthInfo=0x19bc24, pCapabilites=0x19bc28*=0x1) returned 0x0 [0174.055] WbemLocator:IUnknown:Release (This=0x520b9bc) returned 0x3 [0174.055] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1c38, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbdc | out: ppvObject=0x19bbdc*=0x520b9e0) returned 0x0 [0174.055] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1c38, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbc8 | out: ppvObject=0x19bbc8*=0x520b9bc) returned 0x0 [0174.055] WbemLocator:IClientSecurity:SetBlanket (This=0x520b9bc, pProxy=0x51f1c38, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0174.055] WbemLocator:IUnknown:Release (This=0x520b9bc) returned 0x4 [0174.055] WbemLocator:IUnknown:Release (This=0x520b9e0) returned 0x3 [0174.055] CoTaskMemFree (pv=0x51f8f18) [0174.056] WbemLocator:IUnknown:Release (This=0x51f1c38) returned 0x2 [0174.056] SysStringLen (param_1=0x0) returned 0x0 [0174.056] CoGetContextToken (in: pToken=0x19bae8 | out: pToken=0x19bae8) returned 0x0 [0174.056] WbemLocator:IUnknown:AddRef (This=0x51f1c38) returned 0x3 [0174.056] IWbemServices:ExecQuery (in: This=0x51f1c38, strQueryLanguage="WQL", strQuery="SELECT * FROM FirewallProduct", lFlags=16, pCtx=0x0, ppEnum=0x19bcf8 | out: ppEnum=0x19bcf8*=0x6d2a38) returned 0x0 [0174.063] IUnknown:QueryInterface (in: This=0x6d2a38, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb54 | out: ppvObject=0x19bb54*=0x6d2a3c) returned 0x0 [0174.063] IClientSecurity:QueryBlanket (in: This=0x6d2a3c, pProxy=0x6d2a38, pAuthnSvc=0x19bba4, pAuthzSvc=0x19bba0, pServerPrincName=0x19bb98, pAuthnLevel=0x19bb9c, pImpLevel=0x19bb8c, pAuthInfo=0x19bb90, pCapabilites=0x19bb94 | out: pAuthnSvc=0x19bba4*=0xa, pAuthzSvc=0x19bba0*=0x0, pServerPrincName=0x19bb98, pAuthnLevel=0x19bb9c*=0x6, pImpLevel=0x19bb8c*=0x2, pAuthInfo=0x19bb90, pCapabilites=0x19bb94*=0x1) returned 0x0 [0174.063] IUnknown:Release (This=0x6d2a3c) returned 0x1 [0174.063] IUnknown:QueryInterface (in: This=0x6d2a38, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb48 | out: ppvObject=0x19bb48*=0x520c7e0) returned 0x0 [0174.063] IUnknown:QueryInterface (in: This=0x6d2a38, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb34 | out: ppvObject=0x19bb34*=0x6d2a3c) returned 0x0 [0174.063] IClientSecurity:SetBlanket (This=0x6d2a3c, pProxy=0x6d2a38, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0174.065] IUnknown:Release (This=0x6d2a3c) returned 0x2 [0174.065] WbemLocator:IUnknown:Release (This=0x520c7e0) returned 0x1 [0174.065] CoTaskMemFree (pv=0x51f8fa8) [0174.065] IUnknown:QueryInterface (in: This=0x6d2a38, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b740 | out: ppvObject=0x19b740*=0x520c7e0) returned 0x0 [0174.065] WbemLocator:IUnknown:QueryInterface (in: This=0x520c7e0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b6fc | out: ppvObject=0x19b6fc*=0x0) returned 0x80004002 [0174.066] WbemLocator:IUnknown:QueryInterface (in: This=0x520c7e0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b51c | out: ppvObject=0x19b51c*=0x0) returned 0x80004002 [0174.066] IUnknown:QueryInterface (in: This=0x6d2a38, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b2f4 | out: ppvObject=0x19b2f4*=0x0) returned 0x80004002 [0174.066] WbemLocator:IUnknown:AddRef (This=0x520c7e0) returned 0x3 [0174.066] WbemLocator:IUnknown:QueryInterface (in: This=0x520c7e0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b054 | out: ppvObject=0x19b054*=0x0) returned 0x80004002 [0174.066] WbemLocator:IUnknown:QueryInterface (in: This=0x520c7e0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19b004 | out: ppvObject=0x19b004*=0x0) returned 0x80004002 [0174.066] WbemLocator:IUnknown:QueryInterface (in: This=0x520c7e0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b010 | out: ppvObject=0x19b010*=0x520c73c) returned 0x0 [0174.067] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520c73c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b018 | out: pCid=0x19b018*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0174.067] WbemLocator:IUnknown:Release (This=0x520c73c) returned 0x3 [0174.067] CoGetContextToken (in: pToken=0x19b070 | out: pToken=0x19b070) returned 0x0 [0174.067] CoGetContextToken (in: pToken=0x19b478 | out: pToken=0x19b478) returned 0x0 [0174.067] WbemLocator:IUnknown:QueryInterface (in: This=0x520c7e0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b504 | out: ppvObject=0x19b504*=0x520c7c4) returned 0x0 [0174.067] WbemLocator:IRpcOptions:Query (in: This=0x520c7c4, pPrx=0x520c7e0, dwProperty=2, pdwValue=0x19b510 | out: pdwValue=0x19b510) returned 0x80004002 [0174.067] WbemLocator:IUnknown:Release (This=0x520c7c4) returned 0x3 [0174.067] WbemLocator:IUnknown:Release (This=0x520c7e0) returned 0x2 [0174.067] CoGetContextToken (in: pToken=0x19ba50 | out: pToken=0x19ba50) returned 0x0 [0174.067] CoGetContextToken (in: pToken=0x19b9b0 | out: pToken=0x19b9b0) returned 0x0 [0174.067] WbemLocator:IUnknown:QueryInterface (in: This=0x520c7e0, riid=0x19ba80*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19ba7c | out: ppvObject=0x19ba7c*=0x6d2a38) returned 0x0 [0174.067] IUnknown:AddRef (This=0x6d2a38) returned 0x4 [0174.067] IUnknown:Release (This=0x6d2a38) returned 0x3 [0174.067] IUnknown:Release (This=0x6d2a38) returned 0x2 [0174.067] WbemLocator:IUnknown:Release (This=0x51f1c38) returned 0x2 [0174.067] SysStringLen (param_1=0x0) returned 0x0 [0174.067] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7a20, puCount=0x19bd44 | out: puCount=0x19bd44*=0x2) returned 0x0 [0174.067] WbemDefPath:IWbemPath:GetText (in: This=0x51d7a20, lFlags=4, puBuffLength=0x19bd40*=0x0, pszText=0x0 | out: puBuffLength=0x19bd40*=0x19, pszText=0x0) returned 0x0 [0174.067] WbemDefPath:IWbemPath:GetText (in: This=0x51d7a20, lFlags=4, puBuffLength=0x19bd40*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x19bd40*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0174.067] CoGetContextToken (in: pToken=0x19bb90 | out: pToken=0x19bb90) returned 0x0 [0174.067] IUnknown:AddRef (This=0x6d2a38) returned 0x3 [0174.068] IEnumWbemClassObject:Clone (in: This=0x6d2a38, ppEnum=0x19bd50 | out: ppEnum=0x19bd50*=0x6d1db8) returned 0x0 [0174.068] IUnknown:QueryInterface (in: This=0x6d1db8, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bc0c | out: ppvObject=0x19bc0c*=0x6d1dbc) returned 0x0 [0174.069] IClientSecurity:QueryBlanket (in: This=0x6d1dbc, pProxy=0x6d1db8, pAuthnSvc=0x19bc5c, pAuthzSvc=0x19bc58, pServerPrincName=0x19bc50, pAuthnLevel=0x19bc54, pImpLevel=0x19bc44, pAuthInfo=0x19bc48, pCapabilites=0x19bc4c | out: pAuthnSvc=0x19bc5c*=0xa, pAuthzSvc=0x19bc58*=0x0, pServerPrincName=0x19bc50, pAuthnLevel=0x19bc54*=0x6, pImpLevel=0x19bc44*=0x2, pAuthInfo=0x19bc48, pCapabilites=0x19bc4c*=0x1) returned 0x0 [0174.069] IUnknown:Release (This=0x6d1dbc) returned 0x1 [0174.069] IUnknown:QueryInterface (in: This=0x6d1db8, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bc00 | out: ppvObject=0x19bc00*=0x520bfe0) returned 0x0 [0174.069] IUnknown:QueryInterface (in: This=0x6d1db8, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbec | out: ppvObject=0x19bbec*=0x6d1dbc) returned 0x0 [0174.069] IClientSecurity:SetBlanket (This=0x6d1dbc, pProxy=0x6d1db8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0174.070] IUnknown:Release (This=0x6d1dbc) returned 0x2 [0174.070] WbemLocator:IUnknown:Release (This=0x520bfe0) returned 0x1 [0174.070] CoTaskMemFree (pv=0x51f8ee8) [0174.070] IUnknown:QueryInterface (in: This=0x6d1db8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b7e8 | out: ppvObject=0x19b7e8*=0x520bfe0) returned 0x0 [0174.070] WbemLocator:IUnknown:QueryInterface (in: This=0x520bfe0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b7a4 | out: ppvObject=0x19b7a4*=0x0) returned 0x80004002 [0174.071] WbemLocator:IUnknown:QueryInterface (in: This=0x520bfe0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b5c4 | out: ppvObject=0x19b5c4*=0x0) returned 0x80004002 [0174.071] IUnknown:QueryInterface (in: This=0x6d1db8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b39c | out: ppvObject=0x19b39c*=0x0) returned 0x80004002 [0174.072] WbemLocator:IUnknown:AddRef (This=0x520bfe0) returned 0x3 [0174.072] WbemLocator:IUnknown:QueryInterface (in: This=0x520bfe0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0174.072] WbemLocator:IUnknown:QueryInterface (in: This=0x520bfe0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19b0ac | out: ppvObject=0x19b0ac*=0x0) returned 0x80004002 [0174.072] WbemLocator:IUnknown:QueryInterface (in: This=0x520bfe0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0b8 | out: ppvObject=0x19b0b8*=0x520bf3c) returned 0x0 [0174.072] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520bf3c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b0c0 | out: pCid=0x19b0c0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0174.072] WbemLocator:IUnknown:Release (This=0x520bf3c) returned 0x3 [0174.072] CoGetContextToken (in: pToken=0x19b118 | out: pToken=0x19b118) returned 0x0 [0174.072] CoGetContextToken (in: pToken=0x19b520 | out: pToken=0x19b520) returned 0x0 [0174.072] WbemLocator:IUnknown:QueryInterface (in: This=0x520bfe0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b5ac | out: ppvObject=0x19b5ac*=0x520bfc4) returned 0x0 [0174.072] WbemLocator:IRpcOptions:Query (in: This=0x520bfc4, pPrx=0x520bfe0, dwProperty=2, pdwValue=0x19b5b8 | out: pdwValue=0x19b5b8) returned 0x80004002 [0174.072] WbemLocator:IUnknown:Release (This=0x520bfc4) returned 0x3 [0174.072] WbemLocator:IUnknown:Release (This=0x520bfe0) returned 0x2 [0174.072] CoGetContextToken (in: pToken=0x19baf8 | out: pToken=0x19baf8) returned 0x0 [0174.073] CoGetContextToken (in: pToken=0x19ba58 | out: pToken=0x19ba58) returned 0x0 [0174.073] WbemLocator:IUnknown:QueryInterface (in: This=0x520bfe0, riid=0x19bb28*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19bb24 | out: ppvObject=0x19bb24*=0x6d1db8) returned 0x0 [0174.073] IUnknown:AddRef (This=0x6d1db8) returned 0x4 [0174.073] IUnknown:Release (This=0x6d1db8) returned 0x3 [0174.073] IUnknown:Release (This=0x6d1db8) returned 0x2 [0174.073] IUnknown:Release (This=0x6d2a38) returned 0x2 [0174.073] SysStringLen (param_1=0x0) returned 0x0 [0174.073] IEnumWbemClassObject:Reset (This=0x6d1db8) returned 0x0 [0174.073] CoTaskMemAlloc (cb=0x4) returned 0x51de7f8 [0174.073] IEnumWbemClassObject:Next (in: This=0x6d1db8, lTimeout=-1, uCount=0x1, apObjects=0x51de7f8, puReturned=0x29206b4 | out: apObjects=0x51de7f8*=0x0, puReturned=0x29206b4*=0x0) returned 0x1 [0174.074] CoTaskMemFree (pv=0x51de7f8) [0174.074] CoGetContextToken (in: pToken=0x19bc70 | out: pToken=0x19bc70) returned 0x0 [0174.074] WbemLocator:IUnknown:Release (This=0x520bfe0) returned 0x1 [0174.074] IUnknown:Release (This=0x6d1db8) returned 0x0 [0174.076] CoGetContextToken (in: pToken=0x19bc70 | out: pToken=0x19bc70) returned 0x0 [0174.076] WbemLocator:IUnknown:Release (This=0x520c7e0) returned 0x1 [0174.076] IUnknown:Release (This=0x6d2a38) returned 0x0 [0174.269] CoTaskMemAlloc (cb=0x20c) returned 0x51e95a0 [0174.269] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x51e95a0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0174.269] CoTaskMemFree (pv=0x51e95a0) [0174.269] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19b7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0174.269] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NordVPN", nBufferLength=0x105, lpBuffer=0x19b874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NordVPN", lpFilePart=0x0) returned 0x2b [0174.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd54) returned 1 [0174.270] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NordVPN" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\nordvpn"), fInfoLevelId=0x0, lpFileInformation=0x2920fa8 | out: lpFileInformation=0x2920fa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0174.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bd50) returned 1 [0174.282] ExpandEnvironmentStringsW (in: lpSrc="%USERPFile.WriteROFILE%", lpDst=0x19bc50, nSize=0x64 | out: lpDst="%USERPFile.WriteROFILE%") returned 0x18 [0174.282] ExpandEnvironmentStringsW (in: lpSrc="%USERPFile.WriteROFILE%\\AppFile.WriteData\\RoamiFile.Writeng", lpDst=0x19bc50, nSize=0x64 | out: lpDst="%USERPFile.WriteROFILE%\\AppFile.WriteData\\RoamiFile.Writeng") returned 0x3c [0174.356] GetFullPathNameW (in: lpFileName="%USERPROFILE%\\AppData\\Roaming\\OpenVPN Connect\\profiles", nBufferLength=0x105, lpBuffer=0x19b884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\%USERPROFILE%\\AppData\\Roaming\\OpenVPN Connect\\profiles", lpFilePart=0x0) returned 0x54 [0174.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd98) returned 1 [0174.356] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\%USERPROFILE%\\AppData\\Roaming\\OpenVPN Connect\\profiles", nBufferLength=0x105, lpBuffer=0x19b858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\%USERPROFILE%\\AppData\\Roaming\\OpenVPN Connect\\profiles", lpFilePart=0x0) returned 0x54 [0174.357] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\%USERPROFILE%\\AppData\\Roaming\\OpenVPN Connect\\profiles\\*ovpn" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\c:\\users\\rdhj0cnfevzx"), lpFindFileData=0x19bac0 | out: lpFindFileData=0x19bac0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0174.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bd5c) returned 1 [0174.368] ExpandEnvironmentStringsW (in: lpSrc="%USERPserviceInterface.ExtensionROFILE%", lpDst=0x19bc5c, nSize=0x64 | out: lpDst="%USERPserviceInterface.ExtensionROFILE%") returned 0x28 [0174.368] ExpandEnvironmentStringsW (in: lpSrc="%USERPserviceInterface.ExtensionROFILE%\\ApserviceInterface.ExtensionpData\\LocaserviceInterface.Extensionl", lpDst=0x19bc5c, nSize=0x64 | out: lpDst="%USERPserviceInterface.ExtensionROFILE%\\ApserviceInterface.ExtensionpData\\LocaserviceInterface.Exte\x19墐") returned 0x6a [0174.368] ExpandEnvironmentStringsW (in: lpSrc="%USERPserviceInterface.ExtensionROFILE%\\ApserviceInterface.ExtensionpData\\LocaserviceInterface.Extensionl", lpDst=0x19bc50, nSize=0x6a | out: lpDst="%USERPserviceInterface.ExtensionROFILE%\\ApserviceInterface.ExtensionpData\\LocaserviceInterface.Extensionl") returned 0x6a [0174.368] GetFullPathNameW (in: lpFileName="%USERPROFILE%\\AppData\\Local\\ProtonVPN", nBufferLength=0x105, lpBuffer=0x19b884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\%USERPROFILE%\\AppData\\Local\\ProtonVPN", lpFilePart=0x0) returned 0x43 [0174.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd98) returned 1 [0174.369] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\%USERPROFILE%\\AppData\\Local\\ProtonVPN", nBufferLength=0x105, lpBuffer=0x19b858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\%USERPROFILE%\\AppData\\Local\\ProtonVPN", lpFilePart=0x0) returned 0x43 [0174.369] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\%USERPROFILE%\\AppData\\Local\\ProtonVPN\\*ovpn" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\c:\\users\\rdhj0cnfevzx"), lpFindFileData=0x19bac0 | out: lpFindFileData=0x19bac0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0174.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bd5c) returned 1 [0174.421] GetCurrentProcessId () returned 0x11b4 [0174.428] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x37e9958, Length=0x20000, ResultLength=0x19bd18 | out: SystemInformation=0x37e9958, ResultLength=0x19bd18*=0x14a48) returned 0x0 [0174.449] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd00 | out: puCount=0x19bd00*=0x2) returned 0x0 [0174.449] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcfc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcfc*=0xf, pszText=0x0) returned 0x0 [0174.449] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcfc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcfc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0174.459] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bba8*=0x750, lpdwindex=0x19ba5c | out: lpdwindex=0x19ba5c) returned 0x0 [0174.490] CoGetContextToken (in: pToken=0x19b968 | out: pToken=0x19b968) returned 0x0 [0174.490] CoGetContextToken (in: pToken=0x19b910 | out: pToken=0x19b910) returned 0x0 [0174.490] IUnknown:QueryInterface (in: This=0x66f9c0, riid=0x6f12da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b8ec | out: ppvObject=0x19b8ec*=0x66f9d0) returned 0x0 [0174.490] CObjectContext::ContextCallback () returned 0x0 [0174.491] IUnknown:Release (This=0x66f9d0) returned 0x1 [0174.491] CoUnmarshalInterface (in: pStm=0x52099a0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19b95c | out: ppv=0x19b95c*=0x520c8e0) returned 0x0 [0174.492] CoMarshalInterface (pStm=0x52099a0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x520c8e0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0174.492] WbemLocator:IUnknown:QueryInterface (in: This=0x520c8e0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b7fc | out: ppvObject=0x19b7fc*=0x520c8e0) returned 0x0 [0174.492] WbemLocator:IUnknown:QueryInterface (in: This=0x520c8e0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b7b8 | out: ppvObject=0x19b7b8*=0x0) returned 0x80004002 [0174.492] WbemLocator:IUnknown:QueryInterface (in: This=0x520c8e0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b5d4 | out: ppvObject=0x19b5d4*=0x0) returned 0x80004002 [0174.493] WbemLocator:IUnknown:QueryInterface (in: This=0x520c8e0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b3ac | out: ppvObject=0x19b3ac*=0x0) returned 0x80004002 [0174.493] WbemLocator:IUnknown:AddRef (This=0x520c8e0) returned 0x3 [0174.493] WbemLocator:IUnknown:QueryInterface (in: This=0x520c8e0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b10c | out: ppvObject=0x19b10c*=0x0) returned 0x80004002 [0174.493] WbemLocator:IUnknown:QueryInterface (in: This=0x520c8e0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19b0bc | out: ppvObject=0x19b0bc*=0x0) returned 0x80004002 [0174.493] WbemLocator:IUnknown:QueryInterface (in: This=0x520c8e0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0c8 | out: ppvObject=0x19b0c8*=0x520c83c) returned 0x0 [0174.493] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520c83c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b0d0 | out: pCid=0x19b0d0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0174.493] WbemLocator:IUnknown:Release (This=0x520c83c) returned 0x3 [0174.493] CoGetContextToken (in: pToken=0x19b128 | out: pToken=0x19b128) returned 0x0 [0174.494] CoGetContextToken (in: pToken=0x19b530 | out: pToken=0x19b530) returned 0x0 [0174.494] WbemLocator:IUnknown:QueryInterface (in: This=0x520c8e0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b5bc | out: ppvObject=0x19b5bc*=0x520c8c4) returned 0x0 [0174.494] WbemLocator:IRpcOptions:Query (in: This=0x520c8c4, pPrx=0x520c8e0, dwProperty=2, pdwValue=0x19b5c8 | out: pdwValue=0x19b5c8) returned 0x0 [0174.494] WbemLocator:IUnknown:Release (This=0x520c8c4) returned 0x3 [0174.494] WbemLocator:IUnknown:Release (This=0x520c8e0) returned 0x2 [0174.494] WbemLocator:IUnknown:Release (This=0x520c8e0) returned 0x1 [0174.494] CoGetContextToken (in: pToken=0x19b8a8 | out: pToken=0x19b8a8) returned 0x0 [0174.494] WbemLocator:IUnknown:AddRef (This=0x520c8e0) returned 0x2 [0174.494] WbemLocator:IUnknown:QueryInterface (in: This=0x520c8e0, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb60 | out: ppvObject=0x19bb60*=0x520c8bc) returned 0x0 [0174.494] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x520c8bc, pProxy=0x520c8e0, pAuthnSvc=0x19bbb0, pAuthzSvc=0x19bbac, pServerPrincName=0x19bba4, pAuthnLevel=0x19bba8, pImpLevel=0x19bb98, pAuthInfo=0x19bb9c, pCapabilites=0x19bba0 | out: pAuthnSvc=0x19bbb0*=0xa, pAuthzSvc=0x19bbac*=0x0, pServerPrincName=0x19bba4, pAuthnLevel=0x19bba8*=0x6, pImpLevel=0x19bb98*=0x2, pAuthInfo=0x19bb9c, pCapabilites=0x19bba0*=0x1) returned 0x0 [0174.494] WbemLocator:IUnknown:Release (This=0x520c8bc) returned 0x2 [0174.494] WbemLocator:IUnknown:QueryInterface (in: This=0x520c8e0, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb54 | out: ppvObject=0x19bb54*=0x520c8e0) returned 0x0 [0174.494] WbemLocator:IUnknown:QueryInterface (in: This=0x520c8e0, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb40 | out: ppvObject=0x19bb40*=0x520c8bc) returned 0x0 [0174.494] WbemLocator:IClientSecurity:SetBlanket (This=0x520c8bc, pProxy=0x520c8e0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0174.495] WbemLocator:IUnknown:Release (This=0x520c8bc) returned 0x3 [0174.495] WbemLocator:IUnknown:Release (This=0x520c8e0) returned 0x2 [0174.495] CoTaskMemFree (pv=0x51f8ee8) [0174.495] WbemLocator:IUnknown:Release (This=0x520c8e0) returned 0x1 [0174.495] SysStringLen (param_1=0x0) returned 0x0 [0174.495] CoGetContextToken (in: pToken=0x19bb20 | out: pToken=0x19bb20) returned 0x0 [0174.495] CoGetContextToken (in: pToken=0x19ba80 | out: pToken=0x19ba80) returned 0x0 [0174.495] WbemLocator:IUnknown:QueryInterface (in: This=0x520c8e0, riid=0x19bb50*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19bb4c | out: ppvObject=0x19bb4c*=0x51f1d28) returned 0x0 [0174.496] WbemLocator:IUnknown:AddRef (This=0x51f1d28) returned 0x3 [0174.496] WbemLocator:IUnknown:Release (This=0x51f1d28) returned 0x2 [0174.496] CoGetContextToken (in: pToken=0x19bae0 | out: pToken=0x19bae0) returned 0x0 [0174.496] WbemLocator:IUnknown:AddRef (This=0x51f1d28) returned 0x3 [0174.496] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1d28, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb60 | out: ppvObject=0x19bb60*=0x520c8bc) returned 0x0 [0174.496] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x520c8bc, pProxy=0x51f1d28, pAuthnSvc=0x19bbb0, pAuthzSvc=0x19bbac, pServerPrincName=0x19bba4, pAuthnLevel=0x19bba8, pImpLevel=0x19bb98, pAuthInfo=0x19bb9c, pCapabilites=0x19bba0 | out: pAuthnSvc=0x19bbb0*=0xa, pAuthzSvc=0x19bbac*=0x0, pServerPrincName=0x19bba4, pAuthnLevel=0x19bba8*=0x6, pImpLevel=0x19bb98*=0x2, pAuthInfo=0x19bb9c, pCapabilites=0x19bba0*=0x1) returned 0x0 [0174.496] WbemLocator:IUnknown:Release (This=0x520c8bc) returned 0x3 [0174.496] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1d28, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb54 | out: ppvObject=0x19bb54*=0x520c8e0) returned 0x0 [0174.496] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1d28, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb40 | out: ppvObject=0x19bb40*=0x520c8bc) returned 0x0 [0174.496] WbemLocator:IClientSecurity:SetBlanket (This=0x520c8bc, pProxy=0x51f1d28, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0174.496] WbemLocator:IUnknown:Release (This=0x520c8bc) returned 0x4 [0174.496] WbemLocator:IUnknown:Release (This=0x520c8e0) returned 0x3 [0174.496] CoTaskMemFree (pv=0x51f8ee8) [0174.497] WbemLocator:IUnknown:Release (This=0x51f1d28) returned 0x2 [0174.497] SysStringLen (param_1=0x0) returned 0x0 [0174.497] CoGetContextToken (in: pToken=0x19ba40 | out: pToken=0x19ba40) returned 0x0 [0174.497] WbemLocator:IUnknown:AddRef (This=0x51f1d28) returned 0x3 [0174.497] IWbemServices:ExecQuery (in: This=0x51f1d28, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_Process Where SessionId='1'", lFlags=16, pCtx=0x0, ppEnum=0x19bc70 | out: ppEnum=0x19bc70*=0x6d2a38) returned 0x0 [0174.569] IUnknown:QueryInterface (in: This=0x6d2a38, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19baa8 | out: ppvObject=0x19baa8*=0x6d2a3c) returned 0x0 [0174.570] IClientSecurity:QueryBlanket (in: This=0x6d2a3c, pProxy=0x6d2a38, pAuthnSvc=0x19baf8, pAuthzSvc=0x19baf4, pServerPrincName=0x19baec, pAuthnLevel=0x19baf0, pImpLevel=0x19bae0, pAuthInfo=0x19bae4, pCapabilites=0x19bae8 | out: pAuthnSvc=0x19baf8*=0xa, pAuthzSvc=0x19baf4*=0x0, pServerPrincName=0x19baec, pAuthnLevel=0x19baf0*=0x6, pImpLevel=0x19bae0*=0x2, pAuthInfo=0x19bae4, pCapabilites=0x19bae8*=0x1) returned 0x0 [0174.570] IUnknown:Release (This=0x6d2a3c) returned 0x1 [0174.570] IUnknown:QueryInterface (in: This=0x6d2a38, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ba9c | out: ppvObject=0x19ba9c*=0x520b6e0) returned 0x0 [0174.570] IUnknown:QueryInterface (in: This=0x6d2a38, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ba88 | out: ppvObject=0x19ba88*=0x6d2a3c) returned 0x0 [0174.570] IClientSecurity:SetBlanket (This=0x6d2a3c, pProxy=0x6d2a38, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0174.571] IUnknown:Release (This=0x6d2a3c) returned 0x2 [0174.571] WbemLocator:IUnknown:Release (This=0x520b6e0) returned 0x1 [0174.571] CoTaskMemFree (pv=0x51f9008) [0174.572] IUnknown:QueryInterface (in: This=0x6d2a38, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b694 | out: ppvObject=0x19b694*=0x520b6e0) returned 0x0 [0174.572] WbemLocator:IUnknown:QueryInterface (in: This=0x520b6e0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b650 | out: ppvObject=0x19b650*=0x0) returned 0x80004002 [0174.572] WbemLocator:IUnknown:QueryInterface (in: This=0x520b6e0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b46c | out: ppvObject=0x19b46c*=0x0) returned 0x80004002 [0174.573] IUnknown:QueryInterface (in: This=0x6d2a38, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b244 | out: ppvObject=0x19b244*=0x0) returned 0x80004002 [0174.574] WbemLocator:IUnknown:AddRef (This=0x520b6e0) returned 0x3 [0174.574] WbemLocator:IUnknown:QueryInterface (in: This=0x520b6e0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19afa4 | out: ppvObject=0x19afa4*=0x0) returned 0x80004002 [0174.574] WbemLocator:IUnknown:QueryInterface (in: This=0x520b6e0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19af54 | out: ppvObject=0x19af54*=0x0) returned 0x80004002 [0174.574] WbemLocator:IUnknown:QueryInterface (in: This=0x520b6e0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19af60 | out: ppvObject=0x19af60*=0x520b63c) returned 0x0 [0174.574] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520b63c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19af68 | out: pCid=0x19af68*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0174.574] WbemLocator:IUnknown:Release (This=0x520b63c) returned 0x3 [0174.574] CoGetContextToken (in: pToken=0x19afc0 | out: pToken=0x19afc0) returned 0x0 [0174.574] CoGetContextToken (in: pToken=0x19b3c8 | out: pToken=0x19b3c8) returned 0x0 [0174.574] WbemLocator:IUnknown:QueryInterface (in: This=0x520b6e0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b454 | out: ppvObject=0x19b454*=0x520b6c4) returned 0x0 [0174.574] WbemLocator:IRpcOptions:Query (in: This=0x520b6c4, pPrx=0x520b6e0, dwProperty=2, pdwValue=0x19b460 | out: pdwValue=0x19b460) returned 0x80004002 [0174.574] WbemLocator:IUnknown:Release (This=0x520b6c4) returned 0x3 [0174.574] WbemLocator:IUnknown:Release (This=0x520b6e0) returned 0x2 [0174.574] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0174.574] CoGetContextToken (in: pToken=0x19b908 | out: pToken=0x19b908) returned 0x0 [0174.574] WbemLocator:IUnknown:QueryInterface (in: This=0x520b6e0, riid=0x19b9d8*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19b9d4 | out: ppvObject=0x19b9d4*=0x6d2a38) returned 0x0 [0174.575] IUnknown:AddRef (This=0x6d2a38) returned 0x4 [0174.575] IUnknown:Release (This=0x6d2a38) returned 0x3 [0174.575] IUnknown:Release (This=0x6d2a38) returned 0x2 [0174.575] WbemLocator:IUnknown:Release (This=0x51f1d28) returned 0x2 [0174.575] SysStringLen (param_1=0x0) returned 0x0 [0174.575] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcbc | out: puCount=0x19bcbc*=0x2) returned 0x0 [0174.575] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcb8*=0x0, pszText=0x0 | out: puBuffLength=0x19bcb8*=0xf, pszText=0x0) returned 0x0 [0174.575] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcb8*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcb8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0174.575] CoGetContextToken (in: pToken=0x19bb08 | out: pToken=0x19bb08) returned 0x0 [0174.575] IUnknown:AddRef (This=0x6d2a38) returned 0x3 [0174.575] IEnumWbemClassObject:Clone (in: This=0x6d2a38, ppEnum=0x19bcc8 | out: ppEnum=0x19bcc8*=0x6d2010) returned 0x0 [0174.576] IUnknown:QueryInterface (in: This=0x6d2010, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb84 | out: ppvObject=0x19bb84*=0x6d2014) returned 0x0 [0174.577] IClientSecurity:QueryBlanket (in: This=0x6d2014, pProxy=0x6d2010, pAuthnSvc=0x19bbd4, pAuthzSvc=0x19bbd0, pServerPrincName=0x19bbc8, pAuthnLevel=0x19bbcc, pImpLevel=0x19bbbc, pAuthInfo=0x19bbc0, pCapabilites=0x19bbc4 | out: pAuthnSvc=0x19bbd4*=0xa, pAuthzSvc=0x19bbd0*=0x0, pServerPrincName=0x19bbc8, pAuthnLevel=0x19bbcc*=0x6, pImpLevel=0x19bbbc*=0x2, pAuthInfo=0x19bbc0, pCapabilites=0x19bbc4*=0x1) returned 0x0 [0174.577] IUnknown:Release (This=0x6d2014) returned 0x1 [0174.577] IUnknown:QueryInterface (in: This=0x6d2010, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb78 | out: ppvObject=0x19bb78*=0x520cde0) returned 0x0 [0174.577] IUnknown:QueryInterface (in: This=0x6d2010, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb64 | out: ppvObject=0x19bb64*=0x6d2014) returned 0x0 [0174.577] IClientSecurity:SetBlanket (This=0x6d2014, pProxy=0x6d2010, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0174.703] IUnknown:Release (This=0x6d2014) returned 0x2 [0174.703] WbemLocator:IUnknown:Release (This=0x520cde0) returned 0x1 [0174.703] CoTaskMemFree (pv=0x51f9068) [0174.703] IUnknown:QueryInterface (in: This=0x6d2010, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b760 | out: ppvObject=0x19b760*=0x520cde0) returned 0x0 [0174.704] WbemLocator:IUnknown:QueryInterface (in: This=0x520cde0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b71c | out: ppvObject=0x19b71c*=0x0) returned 0x80004002 [0174.705] WbemLocator:IUnknown:QueryInterface (in: This=0x520cde0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b53c | out: ppvObject=0x19b53c*=0x0) returned 0x80004002 [0174.747] IUnknown:QueryInterface (in: This=0x6d2010, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b314 | out: ppvObject=0x19b314*=0x0) returned 0x80004002 [0174.795] WbemLocator:IUnknown:AddRef (This=0x520cde0) returned 0x3 [0174.795] WbemLocator:IUnknown:QueryInterface (in: This=0x520cde0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b074 | out: ppvObject=0x19b074*=0x0) returned 0x80004002 [0174.795] WbemLocator:IUnknown:QueryInterface (in: This=0x520cde0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19b024 | out: ppvObject=0x19b024*=0x0) returned 0x80004002 [0174.795] WbemLocator:IUnknown:QueryInterface (in: This=0x520cde0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b030 | out: ppvObject=0x19b030*=0x520cd3c) returned 0x0 [0174.795] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520cd3c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b038 | out: pCid=0x19b038*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0174.795] WbemLocator:IUnknown:Release (This=0x520cd3c) returned 0x3 [0174.795] CoGetContextToken (in: pToken=0x19b090 | out: pToken=0x19b090) returned 0x0 [0174.795] CoGetContextToken (in: pToken=0x19b498 | out: pToken=0x19b498) returned 0x0 [0174.795] WbemLocator:IUnknown:QueryInterface (in: This=0x520cde0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b524 | out: ppvObject=0x19b524*=0x520cdc4) returned 0x0 [0174.795] WbemLocator:IRpcOptions:Query (in: This=0x520cdc4, pPrx=0x520cde0, dwProperty=2, pdwValue=0x19b530 | out: pdwValue=0x19b530) returned 0x80004002 [0174.795] WbemLocator:IUnknown:Release (This=0x520cdc4) returned 0x3 [0174.796] WbemLocator:IUnknown:Release (This=0x520cde0) returned 0x2 [0174.796] CoGetContextToken (in: pToken=0x19ba70 | out: pToken=0x19ba70) returned 0x0 [0174.796] CoGetContextToken (in: pToken=0x19b9d0 | out: pToken=0x19b9d0) returned 0x0 [0174.796] WbemLocator:IUnknown:QueryInterface (in: This=0x520cde0, riid=0x19baa0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19ba9c | out: ppvObject=0x19ba9c*=0x6d2010) returned 0x0 [0174.796] IUnknown:AddRef (This=0x6d2010) returned 0x4 [0174.796] IUnknown:Release (This=0x6d2010) returned 0x3 [0174.796] IUnknown:Release (This=0x6d2010) returned 0x2 [0174.796] IUnknown:Release (This=0x6d2a38) returned 0x2 [0174.796] SysStringLen (param_1=0x0) returned 0x0 [0174.796] IEnumWbemClassObject:Reset (This=0x6d2010) returned 0x0 [0174.841] CoTaskMemAlloc (cb=0x4) returned 0x51de8c8 [0174.841] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de8c8, puReturned=0x2945c70 | out: apObjects=0x51de8c8*=0x52089c0, puReturned=0x2945c70*=0x1) returned 0x0 [0175.454] IUnknown:QueryInterface (in: This=0x52089c0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x52089c0) returned 0x0 [0175.455] IUnknown:QueryInterface (in: This=0x52089c0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0175.455] IUnknown:QueryInterface (in: This=0x52089c0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0175.455] IUnknown:QueryInterface (in: This=0x52089c0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0175.455] IUnknown:AddRef (This=0x52089c0) returned 0x3 [0175.455] IUnknown:QueryInterface (in: This=0x52089c0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0175.455] IUnknown:QueryInterface (in: This=0x52089c0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0175.455] IUnknown:QueryInterface (in: This=0x52089c0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x52089c4) returned 0x0 [0175.455] IMarshal:GetUnmarshalClass (in: This=0x52089c4, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0175.455] IUnknown:Release (This=0x52089c4) returned 0x3 [0175.455] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0175.456] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0175.456] IUnknown:QueryInterface (in: This=0x52089c0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0175.456] IUnknown:Release (This=0x52089c0) returned 0x2 [0175.456] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0175.456] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0175.456] IUnknown:QueryInterface (in: This=0x52089c0, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x52089c0) returned 0x0 [0175.456] IUnknown:AddRef (This=0x52089c0) returned 0x4 [0175.456] IUnknown:Release (This=0x52089c0) returned 0x3 [0175.456] IUnknown:Release (This=0x52089c0) returned 0x2 [0175.456] CoTaskMemFree (pv=0x51de8c8) [0175.456] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0175.456] IUnknown:AddRef (This=0x52089c0) returned 0x3 [0175.456] IWbemClassObject:Get (in: This=0x52089c0, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0175.457] IWbemClassObject:Get (in: This=0x52089c0, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"456\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0175.457] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"456\"") returned 0x5c [0175.457] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"456\"") returned 0x5c [0175.457] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x758 [0175.457] SetEvent (hEvent=0x638) returned 1 [0175.457] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x758, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0175.503] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0175.503] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0175.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d78d0, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x51d78d0) returned 0x0 [0175.503] WbemDefPath:IUnknown:AddRef (This=0x51d78d0) returned 0x3 [0175.503] WbemDefPath:IUnknown:Release (This=0x51d78d0) returned 0x2 [0175.503] WbemDefPath:IWbemPath:SetText (This=0x51d78d0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"456\"") returned 0x0 [0175.503] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0175.503] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0175.503] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0175.503] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0175.503] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0175.503] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0175.503] IWbemClassObject:Get (in: This=0x52089c0, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29464e4*=0, plFlavor=0x29464e8*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="csrss.exe", varVal2=0x0), pType=0x29464e4*=8, plFlavor=0x29464e8*=0) returned 0x0 [0175.503] SysStringByteLen (bstr="csrss.exe") returned 0x12 [0175.503] SysStringByteLen (bstr="csrss.exe") returned 0x12 [0175.503] IWbemClassObject:Get (in: This=0x52089c0, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29464e4*=8, plFlavor=0x29464e8*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="csrss.exe", varVal2=0x0), pType=0x29464e4*=8, plFlavor=0x29464e8*=0) returned 0x0 [0175.503] SysStringByteLen (bstr="csrss.exe") returned 0x12 [0175.504] SysStringByteLen (bstr="csrss.exe") returned 0x12 [0175.504] CoTaskMemAlloc (cb=0x4) returned 0x51de858 [0175.504] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de858, puReturned=0x2945c70 | out: apObjects=0x51de858*=0x521d420, puReturned=0x2945c70*=0x1) returned 0x0 [0175.545] IUnknown:QueryInterface (in: This=0x521d420, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x521d420) returned 0x0 [0175.545] IUnknown:QueryInterface (in: This=0x521d420, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0175.545] IUnknown:QueryInterface (in: This=0x521d420, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0175.545] IUnknown:QueryInterface (in: This=0x521d420, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0175.545] IUnknown:AddRef (This=0x521d420) returned 0x3 [0175.545] IUnknown:QueryInterface (in: This=0x521d420, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0175.545] IUnknown:QueryInterface (in: This=0x521d420, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0175.545] IUnknown:QueryInterface (in: This=0x521d420, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x521d424) returned 0x0 [0175.546] IMarshal:GetUnmarshalClass (in: This=0x521d424, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0175.546] IUnknown:Release (This=0x521d424) returned 0x3 [0175.546] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0175.546] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0175.546] IUnknown:QueryInterface (in: This=0x521d420, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0175.546] IUnknown:Release (This=0x521d420) returned 0x2 [0175.546] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0175.546] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0175.546] IUnknown:QueryInterface (in: This=0x521d420, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x521d420) returned 0x0 [0175.546] IUnknown:AddRef (This=0x521d420) returned 0x4 [0175.546] IUnknown:Release (This=0x521d420) returned 0x3 [0175.546] IUnknown:Release (This=0x521d420) returned 0x2 [0175.546] CoTaskMemFree (pv=0x51de858) [0175.546] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0175.546] IUnknown:AddRef (This=0x521d420) returned 0x3 [0175.546] IWbemClassObject:Get (in: This=0x521d420, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0175.546] IWbemClassObject:Get (in: This=0x521d420, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"508\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0175.546] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"508\"") returned 0x5c [0175.546] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"508\"") returned 0x5c [0175.547] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x75c [0175.547] SetEvent (hEvent=0x638) returned 1 [0175.547] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x75c, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0175.593] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0175.593] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0175.593] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7ef0, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x51d7ef0) returned 0x0 [0175.593] WbemDefPath:IUnknown:AddRef (This=0x51d7ef0) returned 0x3 [0175.593] WbemDefPath:IUnknown:Release (This=0x51d7ef0) returned 0x2 [0175.593] WbemDefPath:IWbemPath:SetText (This=0x51d7ef0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"508\"") returned 0x0 [0175.593] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0175.593] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0175.594] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0175.594] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0175.594] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0175.594] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0175.594] IWbemClassObject:Get (in: This=0x521d420, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2946dac*=0, plFlavor=0x2946db0*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="winlogon.exe", varVal2=0x0), pType=0x2946dac*=8, plFlavor=0x2946db0*=0) returned 0x0 [0175.594] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0175.594] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0175.594] IWbemClassObject:Get (in: This=0x521d420, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2946dac*=8, plFlavor=0x2946db0*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="winlogon.exe", varVal2=0x0), pType=0x2946dac*=8, plFlavor=0x2946db0*=0) returned 0x0 [0175.594] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0175.594] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0175.594] CoTaskMemAlloc (cb=0x4) returned 0x51de8c8 [0175.594] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de8c8, puReturned=0x2945c70 | out: apObjects=0x51de8c8*=0x521d878, puReturned=0x2945c70*=0x1) returned 0x0 [0175.638] IUnknown:QueryInterface (in: This=0x521d878, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x521d878) returned 0x0 [0175.638] IUnknown:QueryInterface (in: This=0x521d878, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0175.638] IUnknown:QueryInterface (in: This=0x521d878, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0175.639] IUnknown:QueryInterface (in: This=0x521d878, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0175.639] IUnknown:AddRef (This=0x521d878) returned 0x3 [0175.639] IUnknown:QueryInterface (in: This=0x521d878, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0175.639] IUnknown:QueryInterface (in: This=0x521d878, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0175.639] IUnknown:QueryInterface (in: This=0x521d878, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x521d87c) returned 0x0 [0175.639] IMarshal:GetUnmarshalClass (in: This=0x521d87c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0175.639] IUnknown:Release (This=0x521d87c) returned 0x3 [0175.639] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0175.639] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0175.639] IUnknown:QueryInterface (in: This=0x521d878, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0175.639] IUnknown:Release (This=0x521d878) returned 0x2 [0175.639] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0175.639] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0175.639] IUnknown:QueryInterface (in: This=0x521d878, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x521d878) returned 0x0 [0175.639] IUnknown:AddRef (This=0x521d878) returned 0x4 [0175.639] IUnknown:Release (This=0x521d878) returned 0x3 [0175.639] IUnknown:Release (This=0x521d878) returned 0x2 [0175.639] CoTaskMemFree (pv=0x51de8c8) [0175.639] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0175.639] IUnknown:AddRef (This=0x521d878) returned 0x3 [0175.640] IWbemClassObject:Get (in: This=0x521d878, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0175.640] IWbemClassObject:Get (in: This=0x521d878, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"780\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0175.640] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"780\"") returned 0x5c [0175.640] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"780\"") returned 0x5c [0175.640] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x760 [0175.640] SetEvent (hEvent=0x638) returned 1 [0175.640] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x760, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0175.686] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0175.686] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0175.686] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7f60, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x51d7f60) returned 0x0 [0175.687] WbemDefPath:IUnknown:AddRef (This=0x51d7f60) returned 0x3 [0175.687] WbemDefPath:IUnknown:Release (This=0x51d7f60) returned 0x2 [0175.687] WbemDefPath:IWbemPath:SetText (This=0x51d7f60, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"780\"") returned 0x0 [0175.687] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0175.687] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0175.687] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0175.687] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0175.687] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0175.687] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0175.687] IWbemClassObject:Get (in: This=0x521d878, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2947684*=0, plFlavor=0x2947688*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="dwm.exe", varVal2=0x0), pType=0x2947684*=8, plFlavor=0x2947688*=0) returned 0x0 [0175.687] SysStringByteLen (bstr="dwm.exe") returned 0xe [0175.687] SysStringByteLen (bstr="dwm.exe") returned 0xe [0175.687] IWbemClassObject:Get (in: This=0x521d878, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2947684*=8, plFlavor=0x2947688*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="dwm.exe", varVal2=0x0), pType=0x2947684*=8, plFlavor=0x2947688*=0) returned 0x0 [0175.687] SysStringByteLen (bstr="dwm.exe") returned 0xe [0175.687] SysStringByteLen (bstr="dwm.exe") returned 0xe [0175.687] CoTaskMemAlloc (cb=0x4) returned 0x51deb38 [0175.687] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51deb38, puReturned=0x2945c70 | out: apObjects=0x51deb38*=0x521dcc8, puReturned=0x2945c70*=0x1) returned 0x0 [0175.732] IUnknown:QueryInterface (in: This=0x521dcc8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x521dcc8) returned 0x0 [0175.733] IUnknown:QueryInterface (in: This=0x521dcc8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0175.733] IUnknown:QueryInterface (in: This=0x521dcc8, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0175.733] IUnknown:QueryInterface (in: This=0x521dcc8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0175.733] IUnknown:AddRef (This=0x521dcc8) returned 0x3 [0175.733] IUnknown:QueryInterface (in: This=0x521dcc8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0175.733] IUnknown:QueryInterface (in: This=0x521dcc8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0175.733] IUnknown:QueryInterface (in: This=0x521dcc8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x521dccc) returned 0x0 [0175.733] IMarshal:GetUnmarshalClass (in: This=0x521dccc, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0175.733] IUnknown:Release (This=0x521dccc) returned 0x3 [0175.733] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0175.733] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0175.733] IUnknown:QueryInterface (in: This=0x521dcc8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0175.734] IUnknown:Release (This=0x521dcc8) returned 0x2 [0175.734] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0175.734] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0175.734] IUnknown:QueryInterface (in: This=0x521dcc8, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x521dcc8) returned 0x0 [0175.734] IUnknown:AddRef (This=0x521dcc8) returned 0x4 [0175.734] IUnknown:Release (This=0x521dcc8) returned 0x3 [0175.734] IUnknown:Release (This=0x521dcc8) returned 0x2 [0175.734] CoTaskMemFree (pv=0x51deb38) [0175.734] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0175.734] IUnknown:AddRef (This=0x521dcc8) returned 0x3 [0175.734] IWbemClassObject:Get (in: This=0x521dcc8, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0175.734] IWbemClassObject:Get (in: This=0x521dcc8, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1356\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0175.734] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1356\"") returned 0x5e [0175.734] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1356\"") returned 0x5e [0175.734] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x768 [0175.734] SetEvent (hEvent=0x638) returned 1 [0175.735] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x768, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0175.780] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0175.780] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0175.780] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7550, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x51d7550) returned 0x0 [0175.780] WbemDefPath:IUnknown:AddRef (This=0x51d7550) returned 0x3 [0175.780] WbemDefPath:IUnknown:Release (This=0x51d7550) returned 0x2 [0175.781] WbemDefPath:IWbemPath:SetText (This=0x51d7550, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1356\"") returned 0x0 [0175.781] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0175.781] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0175.781] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0175.781] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0175.781] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0175.781] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0175.781] IWbemClassObject:Get (in: This=0x521dcc8, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2947f44*=0, plFlavor=0x2947f48*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="sihost.exe", varVal2=0x0), pType=0x2947f44*=8, plFlavor=0x2947f48*=0) returned 0x0 [0175.781] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0175.781] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0175.781] IWbemClassObject:Get (in: This=0x521dcc8, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2947f44*=8, plFlavor=0x2947f48*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="sihost.exe", varVal2=0x0), pType=0x2947f44*=8, plFlavor=0x2947f48*=0) returned 0x0 [0175.781] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0175.781] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0175.781] CoTaskMemAlloc (cb=0x4) returned 0x51deb38 [0175.781] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51deb38, puReturned=0x2945c70 | out: apObjects=0x51deb38*=0x521d108, puReturned=0x2945c70*=0x1) returned 0x0 [0175.827] IUnknown:QueryInterface (in: This=0x521d108, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x521d108) returned 0x0 [0175.827] IUnknown:QueryInterface (in: This=0x521d108, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0175.827] IUnknown:QueryInterface (in: This=0x521d108, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0175.827] IUnknown:QueryInterface (in: This=0x521d108, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0175.828] IUnknown:AddRef (This=0x521d108) returned 0x3 [0175.828] IUnknown:QueryInterface (in: This=0x521d108, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0175.828] IUnknown:QueryInterface (in: This=0x521d108, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0175.828] IUnknown:QueryInterface (in: This=0x521d108, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x521d10c) returned 0x0 [0175.828] IMarshal:GetUnmarshalClass (in: This=0x521d10c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0175.828] IUnknown:Release (This=0x521d10c) returned 0x3 [0175.828] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0175.828] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0175.828] IUnknown:QueryInterface (in: This=0x521d108, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0175.828] IUnknown:Release (This=0x521d108) returned 0x2 [0175.828] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0175.828] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0175.828] IUnknown:QueryInterface (in: This=0x521d108, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x521d108) returned 0x0 [0175.828] IUnknown:AddRef (This=0x521d108) returned 0x4 [0175.829] IUnknown:Release (This=0x521d108) returned 0x3 [0175.829] IUnknown:Release (This=0x521d108) returned 0x2 [0175.829] CoTaskMemFree (pv=0x51deb38) [0175.829] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0175.829] IUnknown:AddRef (This=0x521d108) returned 0x3 [0175.829] IWbemClassObject:Get (in: This=0x521d108, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0175.829] IWbemClassObject:Get (in: This=0x521d108, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1540\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0175.829] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1540\"") returned 0x5e [0175.829] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1540\"") returned 0x5e [0175.829] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x764 [0175.829] SetEvent (hEvent=0x638) returned 1 [0175.830] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x764, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0175.888] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0175.888] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0175.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7940, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x51d7940) returned 0x0 [0175.888] WbemDefPath:IUnknown:AddRef (This=0x51d7940) returned 0x3 [0175.888] WbemDefPath:IUnknown:Release (This=0x51d7940) returned 0x2 [0175.888] WbemDefPath:IWbemPath:SetText (This=0x51d7940, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1540\"") returned 0x0 [0175.889] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0175.889] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0175.889] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0175.889] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0175.889] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0175.889] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0175.889] IWbemClassObject:Get (in: This=0x521d108, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2948814*=0, plFlavor=0x2948818*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="RuntimeBroker.exe", varVal2=0x0), pType=0x2948814*=8, plFlavor=0x2948818*=0) returned 0x0 [0175.889] SysStringByteLen (bstr="RuntimeBroker.exe") returned 0x22 [0175.889] SysStringByteLen (bstr="RuntimeBroker.exe") returned 0x22 [0175.889] IWbemClassObject:Get (in: This=0x521d108, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2948814*=8, plFlavor=0x2948818*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="RuntimeBroker.exe", varVal2=0x0), pType=0x2948814*=8, plFlavor=0x2948818*=0) returned 0x0 [0175.889] SysStringByteLen (bstr="RuntimeBroker.exe") returned 0x22 [0175.890] SysStringByteLen (bstr="RuntimeBroker.exe") returned 0x22 [0175.890] CoTaskMemAlloc (cb=0x4) returned 0x51deb38 [0175.890] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51deb38, puReturned=0x2945c70 | out: apObjects=0x51deb38*=0x5219e20, puReturned=0x2945c70*=0x1) returned 0x0 [0175.938] IUnknown:QueryInterface (in: This=0x5219e20, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5219e20) returned 0x0 [0175.938] IUnknown:QueryInterface (in: This=0x5219e20, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0175.938] IUnknown:QueryInterface (in: This=0x5219e20, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0175.938] IUnknown:QueryInterface (in: This=0x5219e20, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0175.938] IUnknown:AddRef (This=0x5219e20) returned 0x3 [0175.938] IUnknown:QueryInterface (in: This=0x5219e20, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0175.938] IUnknown:QueryInterface (in: This=0x5219e20, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0175.939] IUnknown:QueryInterface (in: This=0x5219e20, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x5219e24) returned 0x0 [0175.939] IMarshal:GetUnmarshalClass (in: This=0x5219e24, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0175.939] IUnknown:Release (This=0x5219e24) returned 0x3 [0175.939] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0175.939] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0175.939] IUnknown:QueryInterface (in: This=0x5219e20, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0175.939] IUnknown:Release (This=0x5219e20) returned 0x2 [0175.939] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0175.939] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0175.939] IUnknown:QueryInterface (in: This=0x5219e20, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5219e20) returned 0x0 [0175.939] IUnknown:AddRef (This=0x5219e20) returned 0x4 [0175.939] IUnknown:Release (This=0x5219e20) returned 0x3 [0175.939] IUnknown:Release (This=0x5219e20) returned 0x2 [0175.939] CoTaskMemFree (pv=0x51deb38) [0175.939] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0175.940] IUnknown:AddRef (This=0x5219e20) returned 0x3 [0175.940] IWbemClassObject:Get (in: This=0x5219e20, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0175.940] IWbemClassObject:Get (in: This=0x5219e20, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1972\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0175.940] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1972\"") returned 0x5e [0175.940] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1972\"") returned 0x5e [0175.940] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x76c [0175.940] SetEvent (hEvent=0x638) returned 1 [0175.941] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x76c, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0175.983] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0175.983] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0175.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8120, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x51d8120) returned 0x0 [0175.983] WbemDefPath:IUnknown:AddRef (This=0x51d8120) returned 0x3 [0175.983] WbemDefPath:IUnknown:Release (This=0x51d8120) returned 0x2 [0175.983] WbemDefPath:IWbemPath:SetText (This=0x51d8120, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1972\"") returned 0x0 [0175.983] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0175.983] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0175.984] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0175.984] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0175.984] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0175.984] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0175.984] IWbemClassObject:Get (in: This=0x5219e20, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29490fc*=0, plFlavor=0x2949100*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="explorer.exe", varVal2=0x0), pType=0x29490fc*=8, plFlavor=0x2949100*=0) returned 0x0 [0175.984] SysStringByteLen (bstr="explorer.exe") returned 0x18 [0175.984] SysStringByteLen (bstr="explorer.exe") returned 0x18 [0175.984] IWbemClassObject:Get (in: This=0x5219e20, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29490fc*=8, plFlavor=0x2949100*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="explorer.exe", varVal2=0x0), pType=0x29490fc*=8, plFlavor=0x2949100*=0) returned 0x0 [0175.984] SysStringByteLen (bstr="explorer.exe") returned 0x18 [0175.984] SysStringByteLen (bstr="explorer.exe") returned 0x18 [0175.984] CoTaskMemAlloc (cb=0x4) returned 0x51deb38 [0175.984] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51deb38, puReturned=0x2945c70 | out: apObjects=0x51deb38*=0x5219838, puReturned=0x2945c70*=0x1) returned 0x0 [0176.032] IUnknown:QueryInterface (in: This=0x5219838, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5219838) returned 0x0 [0176.032] IUnknown:QueryInterface (in: This=0x5219838, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0176.032] IUnknown:QueryInterface (in: This=0x5219838, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0176.032] IUnknown:QueryInterface (in: This=0x5219838, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0176.032] IUnknown:AddRef (This=0x5219838) returned 0x3 [0176.032] IUnknown:QueryInterface (in: This=0x5219838, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0176.032] IUnknown:QueryInterface (in: This=0x5219838, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0176.033] IUnknown:QueryInterface (in: This=0x5219838, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x521983c) returned 0x0 [0176.033] IMarshal:GetUnmarshalClass (in: This=0x521983c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0176.033] IUnknown:Release (This=0x521983c) returned 0x3 [0176.033] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0176.033] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0176.033] IUnknown:QueryInterface (in: This=0x5219838, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0176.033] IUnknown:Release (This=0x5219838) returned 0x2 [0176.033] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0176.033] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0176.033] IUnknown:QueryInterface (in: This=0x5219838, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5219838) returned 0x0 [0176.033] IUnknown:AddRef (This=0x5219838) returned 0x4 [0176.033] IUnknown:Release (This=0x5219838) returned 0x3 [0176.033] IUnknown:Release (This=0x5219838) returned 0x2 [0176.033] CoTaskMemFree (pv=0x51deb38) [0176.033] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0176.033] IUnknown:AddRef (This=0x5219838) returned 0x3 [0176.034] IWbemClassObject:Get (in: This=0x5219838, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0176.034] IWbemClassObject:Get (in: This=0x5219838, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2028\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0176.034] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2028\"") returned 0x5e [0176.034] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2028\"") returned 0x5e [0176.034] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x770 [0176.035] SetEvent (hEvent=0x638) returned 1 [0176.036] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x770, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0176.078] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0176.078] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0176.078] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8190, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x51d8190) returned 0x0 [0176.078] WbemDefPath:IUnknown:AddRef (This=0x51d8190) returned 0x3 [0176.078] WbemDefPath:IUnknown:Release (This=0x51d8190) returned 0x2 [0176.078] WbemDefPath:IWbemPath:SetText (This=0x51d8190, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2028\"") returned 0x0 [0176.078] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0176.079] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0176.079] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0176.079] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0176.079] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0176.079] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0176.079] IWbemClassObject:Get (in: This=0x5219838, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29499d4*=0, plFlavor=0x29499d8*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="taskhostw.exe", varVal2=0x0), pType=0x29499d4*=8, plFlavor=0x29499d8*=0) returned 0x0 [0176.079] SysStringByteLen (bstr="taskhostw.exe") returned 0x1a [0176.079] SysStringByteLen (bstr="taskhostw.exe") returned 0x1a [0176.079] IWbemClassObject:Get (in: This=0x5219838, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29499d4*=8, plFlavor=0x29499d8*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="taskhostw.exe", varVal2=0x0), pType=0x29499d4*=8, plFlavor=0x29499d8*=0) returned 0x0 [0176.079] SysStringByteLen (bstr="taskhostw.exe") returned 0x1a [0176.079] SysStringByteLen (bstr="taskhostw.exe") returned 0x1a [0176.080] CoTaskMemAlloc (cb=0x4) returned 0x51deb38 [0176.080] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51deb38, puReturned=0x2945c70 | out: apObjects=0x51deb38*=0x521a278, puReturned=0x2945c70*=0x1) returned 0x0 [0176.155] IUnknown:QueryInterface (in: This=0x521a278, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x521a278) returned 0x0 [0176.156] IUnknown:QueryInterface (in: This=0x521a278, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0176.156] IUnknown:QueryInterface (in: This=0x521a278, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0176.156] IUnknown:QueryInterface (in: This=0x521a278, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0176.156] IUnknown:AddRef (This=0x521a278) returned 0x3 [0176.156] IUnknown:QueryInterface (in: This=0x521a278, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0176.156] IUnknown:QueryInterface (in: This=0x521a278, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0176.156] IUnknown:QueryInterface (in: This=0x521a278, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x521a27c) returned 0x0 [0176.156] IMarshal:GetUnmarshalClass (in: This=0x521a27c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0176.156] IUnknown:Release (This=0x521a27c) returned 0x3 [0176.156] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0176.156] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0176.156] IUnknown:QueryInterface (in: This=0x521a278, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0176.156] IUnknown:Release (This=0x521a278) returned 0x2 [0176.157] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0176.157] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0176.157] IUnknown:QueryInterface (in: This=0x521a278, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x521a278) returned 0x0 [0176.157] IUnknown:AddRef (This=0x521a278) returned 0x4 [0176.157] IUnknown:Release (This=0x521a278) returned 0x3 [0176.157] IUnknown:Release (This=0x521a278) returned 0x2 [0176.157] CoTaskMemFree (pv=0x51deb38) [0176.157] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0176.157] IUnknown:AddRef (This=0x521a278) returned 0x3 [0176.157] IWbemClassObject:Get (in: This=0x521a278, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0176.157] IWbemClassObject:Get (in: This=0x521a278, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2196\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0176.157] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2196\"") returned 0x5e [0176.157] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2196\"") returned 0x5e [0176.157] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x774 [0176.158] SetEvent (hEvent=0x638) returned 1 [0176.158] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x774, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0176.202] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0176.202] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0176.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d79b0, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x51d79b0) returned 0x0 [0176.202] WbemDefPath:IUnknown:AddRef (This=0x51d79b0) returned 0x3 [0176.202] WbemDefPath:IUnknown:Release (This=0x51d79b0) returned 0x2 [0176.202] WbemDefPath:IWbemPath:SetText (This=0x51d79b0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2196\"") returned 0x0 [0176.202] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0176.202] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0176.202] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0176.202] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0176.202] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0176.202] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0176.203] IWbemClassObject:Get (in: This=0x521a278, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294a2ac*=0, plFlavor=0x294a2b0*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ShellExperienceHost.exe", varVal2=0x0), pType=0x294a2ac*=8, plFlavor=0x294a2b0*=0) returned 0x0 [0176.203] SysStringByteLen (bstr="ShellExperienceHost.exe") returned 0x2e [0176.203] SysStringByteLen (bstr="ShellExperienceHost.exe") returned 0x2e [0176.203] IWbemClassObject:Get (in: This=0x521a278, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294a2ac*=8, plFlavor=0x294a2b0*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ShellExperienceHost.exe", varVal2=0x0), pType=0x294a2ac*=8, plFlavor=0x294a2b0*=0) returned 0x0 [0176.203] SysStringByteLen (bstr="ShellExperienceHost.exe") returned 0x2e [0176.203] SysStringByteLen (bstr="ShellExperienceHost.exe") returned 0x2e [0176.203] CoTaskMemAlloc (cb=0x4) returned 0x51deb38 [0176.203] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51deb38, puReturned=0x2945c70 | out: apObjects=0x51deb38*=0x521a868, puReturned=0x2945c70*=0x1) returned 0x0 [0176.248] IUnknown:QueryInterface (in: This=0x521a868, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x521a868) returned 0x0 [0176.249] IUnknown:QueryInterface (in: This=0x521a868, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0176.249] IUnknown:QueryInterface (in: This=0x521a868, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0176.249] IUnknown:QueryInterface (in: This=0x521a868, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0176.249] IUnknown:AddRef (This=0x521a868) returned 0x3 [0176.249] IUnknown:QueryInterface (in: This=0x521a868, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0176.249] IUnknown:QueryInterface (in: This=0x521a868, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0176.249] IUnknown:QueryInterface (in: This=0x521a868, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x521a86c) returned 0x0 [0176.249] IMarshal:GetUnmarshalClass (in: This=0x521a86c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0176.249] IUnknown:Release (This=0x521a86c) returned 0x3 [0176.249] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0176.249] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0176.250] IUnknown:QueryInterface (in: This=0x521a868, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0176.250] IUnknown:Release (This=0x521a868) returned 0x2 [0176.250] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0176.250] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0176.250] IUnknown:QueryInterface (in: This=0x521a868, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x521a868) returned 0x0 [0176.250] IUnknown:AddRef (This=0x521a868) returned 0x4 [0176.250] IUnknown:Release (This=0x521a868) returned 0x3 [0176.250] IUnknown:Release (This=0x521a868) returned 0x2 [0176.250] CoTaskMemFree (pv=0x51deb38) [0176.250] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0176.250] IUnknown:AddRef (This=0x521a868) returned 0x3 [0176.250] IWbemClassObject:Get (in: This=0x521a868, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0176.250] IWbemClassObject:Get (in: This=0x521a868, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2312\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0176.250] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2312\"") returned 0x5e [0176.250] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2312\"") returned 0x5e [0176.250] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x778 [0176.250] SetEvent (hEvent=0x638) returned 1 [0176.251] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x778, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0176.296] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0176.296] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0176.296] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7c50, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x51d7c50) returned 0x0 [0176.296] WbemDefPath:IUnknown:AddRef (This=0x51d7c50) returned 0x3 [0176.296] WbemDefPath:IUnknown:Release (This=0x51d7c50) returned 0x2 [0176.296] WbemDefPath:IWbemPath:SetText (This=0x51d7c50, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2312\"") returned 0x0 [0176.296] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0176.296] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0176.296] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0176.296] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0176.296] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0176.296] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0176.296] IWbemClassObject:Get (in: This=0x521a868, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294abac*=0, plFlavor=0x294abb0*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="SearchUI.exe", varVal2=0x0), pType=0x294abac*=8, plFlavor=0x294abb0*=0) returned 0x0 [0176.296] SysStringByteLen (bstr="SearchUI.exe") returned 0x18 [0176.296] SysStringByteLen (bstr="SearchUI.exe") returned 0x18 [0176.296] IWbemClassObject:Get (in: This=0x521a868, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294abac*=8, plFlavor=0x294abb0*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="SearchUI.exe", varVal2=0x0), pType=0x294abac*=8, plFlavor=0x294abb0*=0) returned 0x0 [0176.297] SysStringByteLen (bstr="SearchUI.exe") returned 0x18 [0176.297] SysStringByteLen (bstr="SearchUI.exe") returned 0x18 [0176.297] CoTaskMemAlloc (cb=0x4) returned 0x51deb38 [0176.297] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51deb38, puReturned=0x2945c70 | out: apObjects=0x51deb38*=0x71f3c0, puReturned=0x2945c70*=0x1) returned 0x0 [0176.312] IUnknown:QueryInterface (in: This=0x71f3c0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x71f3c0) returned 0x0 [0176.313] IUnknown:QueryInterface (in: This=0x71f3c0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0176.313] IUnknown:QueryInterface (in: This=0x71f3c0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0176.313] IUnknown:QueryInterface (in: This=0x71f3c0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0176.313] IUnknown:AddRef (This=0x71f3c0) returned 0x3 [0176.313] IUnknown:QueryInterface (in: This=0x71f3c0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0176.313] IUnknown:QueryInterface (in: This=0x71f3c0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0176.313] IUnknown:QueryInterface (in: This=0x71f3c0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x71f3c4) returned 0x0 [0176.313] IMarshal:GetUnmarshalClass (in: This=0x71f3c4, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0176.313] IUnknown:Release (This=0x71f3c4) returned 0x3 [0176.313] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0176.313] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0176.313] IUnknown:QueryInterface (in: This=0x71f3c0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0176.313] IUnknown:Release (This=0x71f3c0) returned 0x2 [0176.313] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0176.313] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0176.313] IUnknown:QueryInterface (in: This=0x71f3c0, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x71f3c0) returned 0x0 [0176.314] IUnknown:AddRef (This=0x71f3c0) returned 0x4 [0176.314] IUnknown:Release (This=0x71f3c0) returned 0x3 [0176.314] IUnknown:Release (This=0x71f3c0) returned 0x2 [0176.314] CoTaskMemFree (pv=0x51deb38) [0176.314] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0176.314] IUnknown:AddRef (This=0x71f3c0) returned 0x3 [0176.314] IWbemClassObject:Get (in: This=0x71f3c0, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0176.314] IWbemClassObject:Get (in: This=0x71f3c0, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2264\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0176.314] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2264\"") returned 0x5e [0176.314] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2264\"") returned 0x5e [0176.314] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x77c [0176.314] SetEvent (hEvent=0x638) returned 1 [0176.314] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x77c, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0176.316] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0176.316] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0176.317] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7fd0, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x51d7fd0) returned 0x0 [0176.317] WbemDefPath:IUnknown:AddRef (This=0x51d7fd0) returned 0x3 [0176.317] WbemDefPath:IUnknown:Release (This=0x51d7fd0) returned 0x2 [0176.317] WbemDefPath:IWbemPath:SetText (This=0x51d7fd0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2264\"") returned 0x0 [0176.317] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0176.317] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0176.317] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0176.317] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0176.317] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0176.317] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0176.317] IWbemClassObject:Get (in: This=0x71f3c0, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294b484*=0, plFlavor=0x294b488*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="svchost.exe", varVal2=0x0), pType=0x294b484*=8, plFlavor=0x294b488*=0) returned 0x0 [0176.317] SysStringByteLen (bstr="svchost.exe") returned 0x16 [0176.317] SysStringByteLen (bstr="svchost.exe") returned 0x16 [0176.317] IWbemClassObject:Get (in: This=0x71f3c0, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294b484*=8, plFlavor=0x294b488*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="svchost.exe", varVal2=0x0), pType=0x294b484*=8, plFlavor=0x294b488*=0) returned 0x0 [0176.317] SysStringByteLen (bstr="svchost.exe") returned 0x16 [0176.317] SysStringByteLen (bstr="svchost.exe") returned 0x16 [0176.317] CoTaskMemAlloc (cb=0x4) returned 0x51deb38 [0176.317] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51deb38, puReturned=0x2945c70 | out: apObjects=0x51deb38*=0x71f6f0, puReturned=0x2945c70*=0x1) returned 0x0 [0176.359] IUnknown:QueryInterface (in: This=0x71f6f0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x71f6f0) returned 0x0 [0176.359] IUnknown:QueryInterface (in: This=0x71f6f0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0176.359] IUnknown:QueryInterface (in: This=0x71f6f0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0176.359] IUnknown:QueryInterface (in: This=0x71f6f0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0176.359] IUnknown:AddRef (This=0x71f6f0) returned 0x3 [0176.359] IUnknown:QueryInterface (in: This=0x71f6f0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0176.359] IUnknown:QueryInterface (in: This=0x71f6f0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0176.359] IUnknown:QueryInterface (in: This=0x71f6f0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x71f6f4) returned 0x0 [0176.359] IMarshal:GetUnmarshalClass (in: This=0x71f6f4, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0176.359] IUnknown:Release (This=0x71f6f4) returned 0x3 [0176.359] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0176.359] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0176.359] IUnknown:QueryInterface (in: This=0x71f6f0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0176.360] IUnknown:Release (This=0x71f6f0) returned 0x2 [0176.360] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0176.360] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0176.360] IUnknown:QueryInterface (in: This=0x71f6f0, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x71f6f0) returned 0x0 [0176.360] IUnknown:AddRef (This=0x71f6f0) returned 0x4 [0176.360] IUnknown:Release (This=0x71f6f0) returned 0x3 [0176.360] IUnknown:Release (This=0x71f6f0) returned 0x2 [0176.360] CoTaskMemFree (pv=0x51deb38) [0176.360] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0176.360] IUnknown:AddRef (This=0x71f6f0) returned 0x3 [0176.360] IWbemClassObject:Get (in: This=0x71f6f0, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0176.360] IWbemClassObject:Get (in: This=0x71f6f0, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1604\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0176.360] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1604\"") returned 0x5e [0176.360] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1604\"") returned 0x5e [0176.360] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x780 [0176.360] SetEvent (hEvent=0x638) returned 1 [0176.361] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x780, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0176.405] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0176.405] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0176.405] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8040, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x51d8040) returned 0x0 [0176.405] WbemDefPath:IUnknown:AddRef (This=0x51d8040) returned 0x3 [0176.405] WbemDefPath:IUnknown:Release (This=0x51d8040) returned 0x2 [0176.405] WbemDefPath:IWbemPath:SetText (This=0x51d8040, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1604\"") returned 0x0 [0176.405] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0176.405] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0176.405] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0176.405] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0176.405] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0176.405] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0176.406] IWbemClassObject:Get (in: This=0x71f6f0, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294bd54*=0, plFlavor=0x294bd58*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="iexplore.exe", varVal2=0x0), pType=0x294bd54*=8, plFlavor=0x294bd58*=0) returned 0x0 [0176.406] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0176.406] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0176.406] IWbemClassObject:Get (in: This=0x71f6f0, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294bd54*=8, plFlavor=0x294bd58*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="iexplore.exe", varVal2=0x0), pType=0x294bd54*=8, plFlavor=0x294bd58*=0) returned 0x0 [0176.406] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0176.406] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0176.406] CoTaskMemAlloc (cb=0x4) returned 0x51deb38 [0176.406] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51deb38, puReturned=0x2945c70 | out: apObjects=0x51deb38*=0x71fa20, puReturned=0x2945c70*=0x1) returned 0x0 [0176.469] IUnknown:QueryInterface (in: This=0x71fa20, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x71fa20) returned 0x0 [0176.474] IUnknown:QueryInterface (in: This=0x71fa20, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0176.474] IUnknown:QueryInterface (in: This=0x71fa20, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0176.474] IUnknown:QueryInterface (in: This=0x71fa20, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0176.474] IUnknown:AddRef (This=0x71fa20) returned 0x3 [0176.474] IUnknown:QueryInterface (in: This=0x71fa20, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0176.474] IUnknown:QueryInterface (in: This=0x71fa20, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0176.474] IUnknown:QueryInterface (in: This=0x71fa20, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x71fa24) returned 0x0 [0176.475] IMarshal:GetUnmarshalClass (in: This=0x71fa24, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0176.475] IUnknown:Release (This=0x71fa24) returned 0x3 [0176.475] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0176.475] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0176.475] IUnknown:QueryInterface (in: This=0x71fa20, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0176.475] IUnknown:Release (This=0x71fa20) returned 0x2 [0176.475] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0176.475] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0176.475] IUnknown:QueryInterface (in: This=0x71fa20, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x71fa20) returned 0x0 [0176.476] IUnknown:AddRef (This=0x71fa20) returned 0x4 [0176.476] IUnknown:Release (This=0x71fa20) returned 0x3 [0176.476] IUnknown:Release (This=0x71fa20) returned 0x2 [0176.476] CoTaskMemFree (pv=0x51deb38) [0176.476] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0176.476] IUnknown:AddRef (This=0x71fa20) returned 0x3 [0176.476] IWbemClassObject:Get (in: This=0x71fa20, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0176.476] IWbemClassObject:Get (in: This=0x71fa20, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"944\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0176.476] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"944\"") returned 0x5c [0176.476] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"944\"") returned 0x5c [0176.477] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x784 [0176.477] SetEvent (hEvent=0x638) returned 1 [0176.477] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x784, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0176.529] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0176.529] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0176.529] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d75c0, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x51d75c0) returned 0x0 [0176.529] WbemDefPath:IUnknown:AddRef (This=0x51d75c0) returned 0x3 [0176.529] WbemDefPath:IUnknown:Release (This=0x51d75c0) returned 0x2 [0176.529] WbemDefPath:IWbemPath:SetText (This=0x51d75c0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"944\"") returned 0x0 [0176.529] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0176.529] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0176.529] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0176.529] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0176.529] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0176.529] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0176.530] IWbemClassObject:Get (in: This=0x71fa20, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294c62c*=0, plFlavor=0x294c630*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="iexplore.exe", varVal2=0x0), pType=0x294c62c*=8, plFlavor=0x294c630*=0) returned 0x0 [0176.530] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0176.530] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0176.530] IWbemClassObject:Get (in: This=0x71fa20, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294c62c*=8, plFlavor=0x294c630*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="iexplore.exe", varVal2=0x0), pType=0x294c62c*=8, plFlavor=0x294c630*=0) returned 0x0 [0176.530] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0176.530] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0176.530] CoTaskMemAlloc (cb=0x4) returned 0x51deb58 [0176.530] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51deb58, puReturned=0x2945c70 | out: apObjects=0x51deb58*=0x71fd50, puReturned=0x2945c70*=0x1) returned 0x0 [0176.578] IUnknown:QueryInterface (in: This=0x71fd50, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x71fd50) returned 0x0 [0176.579] IUnknown:QueryInterface (in: This=0x71fd50, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0176.579] IUnknown:QueryInterface (in: This=0x71fd50, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0176.579] IUnknown:QueryInterface (in: This=0x71fd50, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0176.579] IUnknown:AddRef (This=0x71fd50) returned 0x3 [0176.579] IUnknown:QueryInterface (in: This=0x71fd50, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0176.579] IUnknown:QueryInterface (in: This=0x71fd50, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0176.579] IUnknown:QueryInterface (in: This=0x71fd50, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x71fd54) returned 0x0 [0176.579] IMarshal:GetUnmarshalClass (in: This=0x71fd54, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0176.579] IUnknown:Release (This=0x71fd54) returned 0x3 [0176.579] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0176.579] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0176.579] IUnknown:QueryInterface (in: This=0x71fd50, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0176.579] IUnknown:Release (This=0x71fd50) returned 0x2 [0176.580] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0176.580] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0176.580] IUnknown:QueryInterface (in: This=0x71fd50, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x71fd50) returned 0x0 [0176.580] IUnknown:AddRef (This=0x71fd50) returned 0x4 [0176.580] IUnknown:Release (This=0x71fd50) returned 0x3 [0176.580] IUnknown:Release (This=0x71fd50) returned 0x2 [0176.580] CoTaskMemFree (pv=0x51deb58) [0176.580] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0176.580] IUnknown:AddRef (This=0x71fd50) returned 0x3 [0176.580] IWbemClassObject:Get (in: This=0x71fd50, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0176.580] IWbemClassObject:Get (in: This=0x71fd50, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1644\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0176.580] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1644\"") returned 0x5e [0176.580] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1644\"") returned 0x5e [0176.580] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x788 [0176.580] SetEvent (hEvent=0x638) returned 1 [0176.581] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x788, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0176.623] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0176.623] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0176.623] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7630, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x51d7630) returned 0x0 [0176.623] WbemDefPath:IUnknown:AddRef (This=0x51d7630) returned 0x3 [0176.623] WbemDefPath:IUnknown:Release (This=0x51d7630) returned 0x2 [0176.623] WbemDefPath:IWbemPath:SetText (This=0x51d7630, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1644\"") returned 0x0 [0176.623] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0176.623] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0176.623] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0176.623] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0176.623] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0176.623] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0176.623] IWbemClassObject:Get (in: This=0x71fd50, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294cf04*=0, plFlavor=0x294cf08*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="tradefinancial.exe", varVal2=0x0), pType=0x294cf04*=8, plFlavor=0x294cf08*=0) returned 0x0 [0176.624] SysStringByteLen (bstr="tradefinancial.exe") returned 0x24 [0176.624] SysStringByteLen (bstr="tradefinancial.exe") returned 0x24 [0176.624] IWbemClassObject:Get (in: This=0x71fd50, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294cf04*=8, plFlavor=0x294cf08*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="tradefinancial.exe", varVal2=0x0), pType=0x294cf04*=8, plFlavor=0x294cf08*=0) returned 0x0 [0176.624] SysStringByteLen (bstr="tradefinancial.exe") returned 0x24 [0176.624] SysStringByteLen (bstr="tradefinancial.exe") returned 0x24 [0176.624] CoTaskMemAlloc (cb=0x4) returned 0x51deb58 [0176.624] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51deb58, puReturned=0x2945c70 | out: apObjects=0x51deb58*=0x71fee8, puReturned=0x2945c70*=0x1) returned 0x0 [0176.676] IUnknown:QueryInterface (in: This=0x71fee8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x71fee8) returned 0x0 [0176.676] IUnknown:QueryInterface (in: This=0x71fee8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0176.676] IUnknown:QueryInterface (in: This=0x71fee8, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0176.676] IUnknown:QueryInterface (in: This=0x71fee8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0176.676] IUnknown:AddRef (This=0x71fee8) returned 0x3 [0176.676] IUnknown:QueryInterface (in: This=0x71fee8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0176.676] IUnknown:QueryInterface (in: This=0x71fee8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0176.676] IUnknown:QueryInterface (in: This=0x71fee8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x71feec) returned 0x0 [0176.676] IMarshal:GetUnmarshalClass (in: This=0x71feec, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0176.677] IUnknown:Release (This=0x71feec) returned 0x3 [0176.677] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0176.677] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0176.677] IUnknown:QueryInterface (in: This=0x71fee8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0176.677] IUnknown:Release (This=0x71fee8) returned 0x2 [0176.677] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0176.677] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0176.677] IUnknown:QueryInterface (in: This=0x71fee8, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x71fee8) returned 0x0 [0176.677] IUnknown:AddRef (This=0x71fee8) returned 0x4 [0176.677] IUnknown:Release (This=0x71fee8) returned 0x3 [0176.677] IUnknown:Release (This=0x71fee8) returned 0x2 [0176.677] CoTaskMemFree (pv=0x51deb58) [0176.677] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0176.677] IUnknown:AddRef (This=0x71fee8) returned 0x3 [0176.677] IWbemClassObject:Get (in: This=0x71fee8, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0176.677] IWbemClassObject:Get (in: This=0x71fee8, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2516\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0176.677] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2516\"") returned 0x5e [0176.678] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2516\"") returned 0x5e [0176.678] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x78c [0176.678] SetEvent (hEvent=0x638) returned 1 [0176.678] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x78c, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0176.723] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0176.723] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0176.723] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d76a0, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x51d76a0) returned 0x0 [0176.723] WbemDefPath:IUnknown:AddRef (This=0x51d76a0) returned 0x3 [0176.723] WbemDefPath:IUnknown:Release (This=0x51d76a0) returned 0x2 [0176.723] WbemDefPath:IWbemPath:SetText (This=0x51d76a0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2516\"") returned 0x0 [0176.723] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0176.723] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0176.723] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0176.723] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0176.723] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0176.723] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0176.723] IWbemClassObject:Get (in: This=0x71fee8, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294d7f4*=0, plFlavor=0x294d7f8*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="final.exe", varVal2=0x0), pType=0x294d7f4*=8, plFlavor=0x294d7f8*=0) returned 0x0 [0176.723] SysStringByteLen (bstr="final.exe") returned 0x12 [0176.723] SysStringByteLen (bstr="final.exe") returned 0x12 [0176.724] IWbemClassObject:Get (in: This=0x71fee8, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294d7f4*=8, plFlavor=0x294d7f8*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="final.exe", varVal2=0x0), pType=0x294d7f4*=8, plFlavor=0x294d7f8*=0) returned 0x0 [0176.724] SysStringByteLen (bstr="final.exe") returned 0x12 [0176.724] SysStringByteLen (bstr="final.exe") returned 0x12 [0176.724] CoTaskMemAlloc (cb=0x4) returned 0x51deb58 [0176.724] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51deb58, puReturned=0x2945c70 | out: apObjects=0x51deb58*=0x71f228, puReturned=0x2945c70*=0x1) returned 0x0 [0176.769] IUnknown:QueryInterface (in: This=0x71f228, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x71f228) returned 0x0 [0176.769] IUnknown:QueryInterface (in: This=0x71f228, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0176.769] IUnknown:QueryInterface (in: This=0x71f228, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0176.769] IUnknown:QueryInterface (in: This=0x71f228, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0176.769] IUnknown:AddRef (This=0x71f228) returned 0x3 [0176.769] IUnknown:QueryInterface (in: This=0x71f228, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0176.769] IUnknown:QueryInterface (in: This=0x71f228, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0176.769] IUnknown:QueryInterface (in: This=0x71f228, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x71f22c) returned 0x0 [0176.770] IMarshal:GetUnmarshalClass (in: This=0x71f22c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0176.770] IUnknown:Release (This=0x71f22c) returned 0x3 [0176.770] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0176.770] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0176.770] IUnknown:QueryInterface (in: This=0x71f228, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0176.770] IUnknown:Release (This=0x71f228) returned 0x2 [0176.770] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0176.770] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0176.770] IUnknown:QueryInterface (in: This=0x71f228, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x71f228) returned 0x0 [0176.770] IUnknown:AddRef (This=0x71f228) returned 0x4 [0176.770] IUnknown:Release (This=0x71f228) returned 0x3 [0176.770] IUnknown:Release (This=0x71f228) returned 0x2 [0176.770] CoTaskMemFree (pv=0x51deb58) [0176.770] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0176.770] IUnknown:AddRef (This=0x71f228) returned 0x3 [0176.770] IWbemClassObject:Get (in: This=0x71f228, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0176.770] IWbemClassObject:Get (in: This=0x71f228, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"332\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0176.771] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"332\"") returned 0x5c [0176.771] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"332\"") returned 0x5c [0176.771] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x790 [0176.771] SetEvent (hEvent=0x638) returned 1 [0176.771] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x790, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0176.816] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0176.816] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0176.816] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d84a0, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x51d84a0) returned 0x0 [0176.816] WbemDefPath:IUnknown:AddRef (This=0x51d84a0) returned 0x3 [0176.816] WbemDefPath:IUnknown:Release (This=0x51d84a0) returned 0x2 [0176.816] WbemDefPath:IWbemPath:SetText (This=0x51d84a0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"332\"") returned 0x0 [0176.816] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0176.816] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0176.816] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0176.816] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0176.816] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0176.816] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0176.816] IWbemClassObject:Get (in: This=0x71f228, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294e0bc*=0, plFlavor=0x294e0c0*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="with-particular.exe", varVal2=0x0), pType=0x294e0bc*=8, plFlavor=0x294e0c0*=0) returned 0x0 [0176.816] SysStringByteLen (bstr="with-particular.exe") returned 0x26 [0176.816] SysStringByteLen (bstr="with-particular.exe") returned 0x26 [0176.816] IWbemClassObject:Get (in: This=0x71f228, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294e0bc*=8, plFlavor=0x294e0c0*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="with-particular.exe", varVal2=0x0), pType=0x294e0bc*=8, plFlavor=0x294e0c0*=0) returned 0x0 [0176.817] SysStringByteLen (bstr="with-particular.exe") returned 0x26 [0176.817] SysStringByteLen (bstr="with-particular.exe") returned 0x26 [0176.817] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0176.817] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x5223f38, puReturned=0x2945c70*=0x1) returned 0x0 [0176.862] IUnknown:QueryInterface (in: This=0x5223f38, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5223f38) returned 0x0 [0176.862] IUnknown:QueryInterface (in: This=0x5223f38, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0176.862] IUnknown:QueryInterface (in: This=0x5223f38, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0176.862] IUnknown:QueryInterface (in: This=0x5223f38, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0176.862] IUnknown:AddRef (This=0x5223f38) returned 0x3 [0176.863] IUnknown:QueryInterface (in: This=0x5223f38, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0176.863] IUnknown:QueryInterface (in: This=0x5223f38, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0176.863] IUnknown:QueryInterface (in: This=0x5223f38, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x5223f3c) returned 0x0 [0176.863] IMarshal:GetUnmarshalClass (in: This=0x5223f3c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0176.863] IUnknown:Release (This=0x5223f3c) returned 0x3 [0176.863] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0176.863] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0176.863] IUnknown:QueryInterface (in: This=0x5223f38, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0176.863] IUnknown:Release (This=0x5223f38) returned 0x2 [0176.863] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0176.863] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0176.863] IUnknown:QueryInterface (in: This=0x5223f38, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5223f38) returned 0x0 [0176.863] IUnknown:AddRef (This=0x5223f38) returned 0x4 [0176.863] IUnknown:Release (This=0x5223f38) returned 0x3 [0176.863] IUnknown:Release (This=0x5223f38) returned 0x2 [0176.863] CoTaskMemFree (pv=0x51de588) [0176.863] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0176.863] IUnknown:AddRef (This=0x5223f38) returned 0x3 [0176.863] IWbemClassObject:Get (in: This=0x5223f38, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0176.863] IWbemClassObject:Get (in: This=0x5223f38, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1508\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0176.864] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1508\"") returned 0x5e [0176.864] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1508\"") returned 0x5e [0176.864] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x794 [0176.864] SetEvent (hEvent=0x638) returned 1 [0176.864] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x794, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0176.910] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0176.910] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0176.910] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d83c0, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x51d83c0) returned 0x0 [0176.910] WbemDefPath:IUnknown:AddRef (This=0x51d83c0) returned 0x3 [0176.910] WbemDefPath:IUnknown:Release (This=0x51d83c0) returned 0x2 [0176.910] WbemDefPath:IWbemPath:SetText (This=0x51d83c0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1508\"") returned 0x0 [0176.910] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0176.910] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0176.910] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0176.910] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0176.910] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0176.910] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0176.910] IWbemClassObject:Get (in: This=0x5223f38, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294e9ac*=0, plFlavor=0x294e9b0*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="option.exe", varVal2=0x0), pType=0x294e9ac*=8, plFlavor=0x294e9b0*=0) returned 0x0 [0176.910] SysStringByteLen (bstr="option.exe") returned 0x14 [0176.910] SysStringByteLen (bstr="option.exe") returned 0x14 [0176.910] IWbemClassObject:Get (in: This=0x5223f38, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294e9ac*=8, plFlavor=0x294e9b0*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="option.exe", varVal2=0x0), pType=0x294e9ac*=8, plFlavor=0x294e9b0*=0) returned 0x0 [0176.910] SysStringByteLen (bstr="option.exe") returned 0x14 [0176.910] SysStringByteLen (bstr="option.exe") returned 0x14 [0176.910] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0176.910] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x5225d80, puReturned=0x2945c70*=0x1) returned 0x0 [0176.955] IUnknown:QueryInterface (in: This=0x5225d80, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5225d80) returned 0x0 [0176.955] IUnknown:QueryInterface (in: This=0x5225d80, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0176.955] IUnknown:QueryInterface (in: This=0x5225d80, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0176.955] IUnknown:QueryInterface (in: This=0x5225d80, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0176.956] IUnknown:AddRef (This=0x5225d80) returned 0x3 [0176.956] IUnknown:QueryInterface (in: This=0x5225d80, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0176.956] IUnknown:QueryInterface (in: This=0x5225d80, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0176.956] IUnknown:QueryInterface (in: This=0x5225d80, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x5225d84) returned 0x0 [0176.956] IMarshal:GetUnmarshalClass (in: This=0x5225d84, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0176.956] IUnknown:Release (This=0x5225d84) returned 0x3 [0176.956] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0176.956] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0176.956] IUnknown:QueryInterface (in: This=0x5225d80, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0176.956] IUnknown:Release (This=0x5225d80) returned 0x2 [0176.956] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0176.956] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0176.956] IUnknown:QueryInterface (in: This=0x5225d80, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5225d80) returned 0x0 [0176.956] IUnknown:AddRef (This=0x5225d80) returned 0x4 [0176.956] IUnknown:Release (This=0x5225d80) returned 0x3 [0176.956] IUnknown:Release (This=0x5225d80) returned 0x2 [0176.956] CoTaskMemFree (pv=0x51de588) [0176.956] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0176.956] IUnknown:AddRef (This=0x5225d80) returned 0x3 [0176.956] IWbemClassObject:Get (in: This=0x5225d80, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0176.956] IWbemClassObject:Get (in: This=0x5225d80, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1948\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0176.957] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1948\"") returned 0x5e [0176.957] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1948\"") returned 0x5e [0176.957] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x798 [0176.957] SetEvent (hEvent=0x638) returned 1 [0176.957] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x798, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.004] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.004] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.004] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8430, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x51d8430) returned 0x0 [0177.004] WbemDefPath:IUnknown:AddRef (This=0x51d8430) returned 0x3 [0177.004] WbemDefPath:IUnknown:Release (This=0x51d8430) returned 0x2 [0177.004] WbemDefPath:IWbemPath:SetText (This=0x51d8430, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1948\"") returned 0x0 [0177.004] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.004] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.004] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.004] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.004] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.004] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.004] IWbemClassObject:Get (in: This=0x5225d80, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294f27c*=0, plFlavor=0x294f280*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="include.exe", varVal2=0x0), pType=0x294f27c*=8, plFlavor=0x294f280*=0) returned 0x0 [0177.004] SysStringByteLen (bstr="include.exe") returned 0x16 [0177.004] SysStringByteLen (bstr="include.exe") returned 0x16 [0177.005] IWbemClassObject:Get (in: This=0x5225d80, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294f27c*=8, plFlavor=0x294f280*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="include.exe", varVal2=0x0), pType=0x294f27c*=8, plFlavor=0x294f280*=0) returned 0x0 [0177.005] SysStringByteLen (bstr="include.exe") returned 0x16 [0177.005] SysStringByteLen (bstr="include.exe") returned 0x16 [0177.005] CoTaskMemAlloc (cb=0x4) returned 0x51de598 [0177.005] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de598, puReturned=0x2945c70 | out: apObjects=0x51de598*=0x5224400, puReturned=0x2945c70*=0x1) returned 0x0 [0177.049] IUnknown:QueryInterface (in: This=0x5224400, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5224400) returned 0x0 [0177.049] IUnknown:QueryInterface (in: This=0x5224400, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.049] IUnknown:QueryInterface (in: This=0x5224400, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.049] IUnknown:QueryInterface (in: This=0x5224400, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.049] IUnknown:AddRef (This=0x5224400) returned 0x3 [0177.049] IUnknown:QueryInterface (in: This=0x5224400, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.049] IUnknown:QueryInterface (in: This=0x5224400, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.049] IUnknown:QueryInterface (in: This=0x5224400, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x5224404) returned 0x0 [0177.050] IMarshal:GetUnmarshalClass (in: This=0x5224404, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.050] IUnknown:Release (This=0x5224404) returned 0x3 [0177.050] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.050] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.050] IUnknown:QueryInterface (in: This=0x5224400, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.050] IUnknown:Release (This=0x5224400) returned 0x2 [0177.050] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.050] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.050] IUnknown:QueryInterface (in: This=0x5224400, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5224400) returned 0x0 [0177.050] IUnknown:AddRef (This=0x5224400) returned 0x4 [0177.050] IUnknown:Release (This=0x5224400) returned 0x3 [0177.050] IUnknown:Release (This=0x5224400) returned 0x2 [0177.050] CoTaskMemFree (pv=0x51de598) [0177.050] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.050] IUnknown:AddRef (This=0x5224400) returned 0x3 [0177.050] IWbemClassObject:Get (in: This=0x5224400, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.050] IWbemClassObject:Get (in: This=0x5224400, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1088\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.050] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1088\"") returned 0x5e [0177.050] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1088\"") returned 0x5e [0177.050] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x79c [0177.050] SetEvent (hEvent=0x638) returned 1 [0177.051] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x79c, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.098] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.098] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.098] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8350, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x51d8350) returned 0x0 [0177.098] WbemDefPath:IUnknown:AddRef (This=0x51d8350) returned 0x3 [0177.098] WbemDefPath:IUnknown:Release (This=0x51d8350) returned 0x2 [0177.098] WbemDefPath:IWbemPath:SetText (This=0x51d8350, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1088\"") returned 0x0 [0177.098] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.098] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.098] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.098] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.098] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.098] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.098] IWbemClassObject:Get (in: This=0x5224400, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294fb4c*=0, plFlavor=0x294fb50*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="society-walk.exe", varVal2=0x0), pType=0x294fb4c*=8, plFlavor=0x294fb50*=0) returned 0x0 [0177.099] SysStringByteLen (bstr="society-walk.exe") returned 0x20 [0177.099] SysStringByteLen (bstr="society-walk.exe") returned 0x20 [0177.099] IWbemClassObject:Get (in: This=0x5224400, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x294fb4c*=8, plFlavor=0x294fb50*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="society-walk.exe", varVal2=0x0), pType=0x294fb4c*=8, plFlavor=0x294fb50*=0) returned 0x0 [0177.099] SysStringByteLen (bstr="society-walk.exe") returned 0x20 [0177.099] SysStringByteLen (bstr="society-walk.exe") returned 0x20 [0177.099] CoTaskMemAlloc (cb=0x4) returned 0x51de638 [0177.099] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de638, puReturned=0x2945c70 | out: apObjects=0x51de638*=0x5225588, puReturned=0x2945c70*=0x1) returned 0x0 [0177.175] IUnknown:QueryInterface (in: This=0x5225588, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5225588) returned 0x0 [0177.176] IUnknown:QueryInterface (in: This=0x5225588, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.176] IUnknown:QueryInterface (in: This=0x5225588, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.176] IUnknown:QueryInterface (in: This=0x5225588, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.176] IUnknown:AddRef (This=0x5225588) returned 0x3 [0177.176] IUnknown:QueryInterface (in: This=0x5225588, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.176] IUnknown:QueryInterface (in: This=0x5225588, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.176] IUnknown:QueryInterface (in: This=0x5225588, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x522558c) returned 0x0 [0177.176] IMarshal:GetUnmarshalClass (in: This=0x522558c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.176] IUnknown:Release (This=0x522558c) returned 0x3 [0177.176] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.176] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.176] IUnknown:QueryInterface (in: This=0x5225588, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.176] IUnknown:Release (This=0x5225588) returned 0x2 [0177.176] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.176] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.177] IUnknown:QueryInterface (in: This=0x5225588, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5225588) returned 0x0 [0177.177] IUnknown:AddRef (This=0x5225588) returned 0x4 [0177.177] IUnknown:Release (This=0x5225588) returned 0x3 [0177.177] IUnknown:Release (This=0x5225588) returned 0x2 [0177.177] CoTaskMemFree (pv=0x51de638) [0177.177] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.177] IUnknown:AddRef (This=0x5225588) returned 0x3 [0177.177] IWbemClassObject:Get (in: This=0x5225588, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.177] IWbemClassObject:Get (in: This=0x5225588, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3080\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.177] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3080\"") returned 0x5e [0177.177] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3080\"") returned 0x5e [0177.177] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7a0 [0177.177] SetEvent (hEvent=0x638) returned 1 [0177.178] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x7a0, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.223] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.223] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.223] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ef318, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x6ef318) returned 0x0 [0177.223] WbemDefPath:IUnknown:AddRef (This=0x6ef318) returned 0x3 [0177.223] WbemDefPath:IUnknown:Release (This=0x6ef318) returned 0x2 [0177.223] WbemDefPath:IWbemPath:SetText (This=0x6ef318, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3080\"") returned 0x0 [0177.223] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.223] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.223] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.223] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.223] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.223] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.224] IWbemClassObject:Get (in: This=0x5225588, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2950434*=0, plFlavor=0x2950438*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="series girl into.exe", varVal2=0x0), pType=0x2950434*=8, plFlavor=0x2950438*=0) returned 0x0 [0177.224] SysStringByteLen (bstr="series girl into.exe") returned 0x28 [0177.224] SysStringByteLen (bstr="series girl into.exe") returned 0x28 [0177.224] IWbemClassObject:Get (in: This=0x5225588, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2950434*=8, plFlavor=0x2950438*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="series girl into.exe", varVal2=0x0), pType=0x2950434*=8, plFlavor=0x2950438*=0) returned 0x0 [0177.224] SysStringByteLen (bstr="series girl into.exe") returned 0x28 [0177.224] SysStringByteLen (bstr="series girl into.exe") returned 0x28 [0177.224] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.224] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x5225258, puReturned=0x2945c70*=0x1) returned 0x0 [0177.269] IUnknown:QueryInterface (in: This=0x5225258, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5225258) returned 0x0 [0177.269] IUnknown:QueryInterface (in: This=0x5225258, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.269] IUnknown:QueryInterface (in: This=0x5225258, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.269] IUnknown:QueryInterface (in: This=0x5225258, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.269] IUnknown:AddRef (This=0x5225258) returned 0x3 [0177.269] IUnknown:QueryInterface (in: This=0x5225258, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.269] IUnknown:QueryInterface (in: This=0x5225258, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.269] IUnknown:QueryInterface (in: This=0x5225258, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x522525c) returned 0x0 [0177.270] IMarshal:GetUnmarshalClass (in: This=0x522525c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.270] IUnknown:Release (This=0x522525c) returned 0x3 [0177.270] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.270] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.270] IUnknown:QueryInterface (in: This=0x5225258, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.270] IUnknown:Release (This=0x5225258) returned 0x2 [0177.270] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.270] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.270] IUnknown:QueryInterface (in: This=0x5225258, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5225258) returned 0x0 [0177.270] IUnknown:AddRef (This=0x5225258) returned 0x4 [0177.270] IUnknown:Release (This=0x5225258) returned 0x3 [0177.270] IUnknown:Release (This=0x5225258) returned 0x2 [0177.270] CoTaskMemFree (pv=0x51de588) [0177.270] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.270] IUnknown:AddRef (This=0x5225258) returned 0x3 [0177.270] IWbemClassObject:Get (in: This=0x5225258, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.271] IWbemClassObject:Get (in: This=0x5225258, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3088\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.271] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3088\"") returned 0x5e [0177.271] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3088\"") returned 0x5e [0177.271] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7a4 [0177.271] SetEvent (hEvent=0x638) returned 1 [0177.271] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x7a4, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.318] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.318] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.318] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227100, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5227100) returned 0x0 [0177.318] WbemDefPath:IUnknown:AddRef (This=0x5227100) returned 0x3 [0177.318] WbemDefPath:IUnknown:Release (This=0x5227100) returned 0x2 [0177.318] WbemDefPath:IWbemPath:SetText (This=0x5227100, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3088\"") returned 0x0 [0177.318] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.318] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.318] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.319] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.319] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.319] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.319] IWbemClassObject:Get (in: This=0x5225258, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2950d2c*=0, plFlavor=0x2950d30*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="something.exe", varVal2=0x0), pType=0x2950d2c*=8, plFlavor=0x2950d30*=0) returned 0x0 [0177.319] SysStringByteLen (bstr="something.exe") returned 0x1a [0177.319] SysStringByteLen (bstr="something.exe") returned 0x1a [0177.319] IWbemClassObject:Get (in: This=0x5225258, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2950d2c*=8, plFlavor=0x2950d30*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="something.exe", varVal2=0x0), pType=0x2950d2c*=8, plFlavor=0x2950d30*=0) returned 0x0 [0177.319] SysStringByteLen (bstr="something.exe") returned 0x1a [0177.319] SysStringByteLen (bstr="something.exe") returned 0x1a [0177.319] CoTaskMemAlloc (cb=0x4) returned 0x51de638 [0177.319] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de638, puReturned=0x2945c70 | out: apObjects=0x51de638*=0x52258b8, puReturned=0x2945c70*=0x1) returned 0x0 [0177.321] IUnknown:QueryInterface (in: This=0x52258b8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x52258b8) returned 0x0 [0177.321] IUnknown:QueryInterface (in: This=0x52258b8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.321] IUnknown:QueryInterface (in: This=0x52258b8, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.321] IUnknown:QueryInterface (in: This=0x52258b8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.321] IUnknown:AddRef (This=0x52258b8) returned 0x3 [0177.321] IUnknown:QueryInterface (in: This=0x52258b8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.321] IUnknown:QueryInterface (in: This=0x52258b8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.321] IUnknown:QueryInterface (in: This=0x52258b8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x52258bc) returned 0x0 [0177.321] IMarshal:GetUnmarshalClass (in: This=0x52258bc, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.321] IUnknown:Release (This=0x52258bc) returned 0x3 [0177.321] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.321] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.322] IUnknown:QueryInterface (in: This=0x52258b8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.322] IUnknown:Release (This=0x52258b8) returned 0x2 [0177.322] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.322] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.322] IUnknown:QueryInterface (in: This=0x52258b8, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x52258b8) returned 0x0 [0177.322] IUnknown:AddRef (This=0x52258b8) returned 0x4 [0177.322] IUnknown:Release (This=0x52258b8) returned 0x3 [0177.322] IUnknown:Release (This=0x52258b8) returned 0x2 [0177.322] CoTaskMemFree (pv=0x51de638) [0177.322] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.322] IUnknown:AddRef (This=0x52258b8) returned 0x3 [0177.322] IWbemClassObject:Get (in: This=0x52258b8, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.322] IWbemClassObject:Get (in: This=0x52258b8, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3096\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.322] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3096\"") returned 0x5e [0177.322] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3096\"") returned 0x5e [0177.322] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7a8 [0177.322] SetEvent (hEvent=0x638) returned 1 [0177.322] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x7a8, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.324] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.324] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.324] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227480, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5227480) returned 0x0 [0177.324] WbemDefPath:IUnknown:AddRef (This=0x5227480) returned 0x3 [0177.325] WbemDefPath:IUnknown:Release (This=0x5227480) returned 0x2 [0177.325] WbemDefPath:IWbemPath:SetText (This=0x5227480, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3096\"") returned 0x0 [0177.325] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.325] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.325] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.325] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.325] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.325] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.325] IWbemClassObject:Get (in: This=0x52258b8, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2951604*=0, plFlavor=0x2951608*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="at-produce.exe", varVal2=0x0), pType=0x2951604*=8, plFlavor=0x2951608*=0) returned 0x0 [0177.325] SysStringByteLen (bstr="at-produce.exe") returned 0x1c [0177.326] SysStringByteLen (bstr="at-produce.exe") returned 0x1c [0177.326] IWbemClassObject:Get (in: This=0x52258b8, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2951604*=8, plFlavor=0x2951608*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="at-produce.exe", varVal2=0x0), pType=0x2951604*=8, plFlavor=0x2951608*=0) returned 0x0 [0177.326] SysStringByteLen (bstr="at-produce.exe") returned 0x1c [0177.326] SysStringByteLen (bstr="at-produce.exe") returned 0x1c [0177.326] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.326] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x52253f0, puReturned=0x2945c70*=0x1) returned 0x0 [0177.327] IUnknown:QueryInterface (in: This=0x52253f0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x52253f0) returned 0x0 [0177.327] IUnknown:QueryInterface (in: This=0x52253f0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.328] IUnknown:QueryInterface (in: This=0x52253f0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.328] IUnknown:QueryInterface (in: This=0x52253f0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.328] IUnknown:AddRef (This=0x52253f0) returned 0x3 [0177.328] IUnknown:QueryInterface (in: This=0x52253f0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.328] IUnknown:QueryInterface (in: This=0x52253f0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.328] IUnknown:QueryInterface (in: This=0x52253f0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x52253f4) returned 0x0 [0177.328] IMarshal:GetUnmarshalClass (in: This=0x52253f4, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.328] IUnknown:Release (This=0x52253f4) returned 0x3 [0177.328] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.328] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.328] IUnknown:QueryInterface (in: This=0x52253f0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.328] IUnknown:Release (This=0x52253f0) returned 0x2 [0177.328] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.328] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.328] IUnknown:QueryInterface (in: This=0x52253f0, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x52253f0) returned 0x0 [0177.328] IUnknown:AddRef (This=0x52253f0) returned 0x4 [0177.328] IUnknown:Release (This=0x52253f0) returned 0x3 [0177.328] IUnknown:Release (This=0x52253f0) returned 0x2 [0177.328] CoTaskMemFree (pv=0x51de588) [0177.328] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.328] IUnknown:AddRef (This=0x52253f0) returned 0x3 [0177.328] IWbemClassObject:Get (in: This=0x52253f0, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.329] IWbemClassObject:Get (in: This=0x52253f0, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3104\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.329] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3104\"") returned 0x5e [0177.329] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3104\"") returned 0x5e [0177.329] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7ac [0177.329] SetEvent (hEvent=0x638) returned 1 [0177.329] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x7ac, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.331] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.331] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.331] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227170, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5227170) returned 0x0 [0177.331] WbemDefPath:IUnknown:AddRef (This=0x5227170) returned 0x3 [0177.331] WbemDefPath:IUnknown:Release (This=0x5227170) returned 0x2 [0177.331] WbemDefPath:IWbemPath:SetText (This=0x5227170, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3104\"") returned 0x0 [0177.331] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.331] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.331] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.331] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.331] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.332] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.332] IWbemClassObject:Get (in: This=0x52253f0, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2951ee4*=0, plFlavor=0x2951ee8*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="management training.exe", varVal2=0x0), pType=0x2951ee4*=8, plFlavor=0x2951ee8*=0) returned 0x0 [0177.332] SysStringByteLen (bstr="management training.exe") returned 0x2e [0177.332] SysStringByteLen (bstr="management training.exe") returned 0x2e [0177.332] IWbemClassObject:Get (in: This=0x52253f0, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2951ee4*=8, plFlavor=0x2951ee8*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="management training.exe", varVal2=0x0), pType=0x2951ee4*=8, plFlavor=0x2951ee8*=0) returned 0x0 [0177.332] SysStringByteLen (bstr="management training.exe") returned 0x2e [0177.332] SysStringByteLen (bstr="management training.exe") returned 0x2e [0177.332] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.332] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x52248c8, puReturned=0x2945c70*=0x1) returned 0x0 [0177.334] IUnknown:QueryInterface (in: This=0x52248c8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x52248c8) returned 0x0 [0177.334] IUnknown:QueryInterface (in: This=0x52248c8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.334] IUnknown:QueryInterface (in: This=0x52248c8, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.334] IUnknown:QueryInterface (in: This=0x52248c8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.335] IUnknown:AddRef (This=0x52248c8) returned 0x3 [0177.335] IUnknown:QueryInterface (in: This=0x52248c8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.335] IUnknown:QueryInterface (in: This=0x52248c8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.335] IUnknown:QueryInterface (in: This=0x52248c8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x52248cc) returned 0x0 [0177.335] IMarshal:GetUnmarshalClass (in: This=0x52248cc, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.335] IUnknown:Release (This=0x52248cc) returned 0x3 [0177.335] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.335] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.335] IUnknown:QueryInterface (in: This=0x52248c8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.335] IUnknown:Release (This=0x52248c8) returned 0x2 [0177.335] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.335] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.335] IUnknown:QueryInterface (in: This=0x52248c8, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x52248c8) returned 0x0 [0177.335] IUnknown:AddRef (This=0x52248c8) returned 0x4 [0177.335] IUnknown:Release (This=0x52248c8) returned 0x3 [0177.335] IUnknown:Release (This=0x52248c8) returned 0x2 [0177.335] CoTaskMemFree (pv=0x51de588) [0177.335] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.335] IUnknown:AddRef (This=0x52248c8) returned 0x3 [0177.335] IWbemClassObject:Get (in: This=0x52248c8, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.335] IWbemClassObject:Get (in: This=0x52248c8, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3112\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.336] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3112\"") returned 0x5e [0177.336] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3112\"") returned 0x5e [0177.336] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7b0 [0177.336] SetEvent (hEvent=0x638) returned 1 [0177.336] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x7b0, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.338] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.338] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.338] WbemDefPath:IUnknown:QueryInterface (in: This=0x52271e0, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x52271e0) returned 0x0 [0177.338] WbemDefPath:IUnknown:AddRef (This=0x52271e0) returned 0x3 [0177.338] WbemDefPath:IUnknown:Release (This=0x52271e0) returned 0x2 [0177.338] WbemDefPath:IWbemPath:SetText (This=0x52271e0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3112\"") returned 0x0 [0177.339] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.339] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.339] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.339] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.339] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.339] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.339] IWbemClassObject:Get (in: This=0x52248c8, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29527e4*=0, plFlavor=0x29527e8*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="better.exe", varVal2=0x0), pType=0x29527e4*=8, plFlavor=0x29527e8*=0) returned 0x0 [0177.340] SysStringByteLen (bstr="better.exe") returned 0x14 [0177.340] SysStringByteLen (bstr="better.exe") returned 0x14 [0177.340] IWbemClassObject:Get (in: This=0x52248c8, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29527e4*=8, plFlavor=0x29527e8*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="better.exe", varVal2=0x0), pType=0x29527e4*=8, plFlavor=0x29527e8*=0) returned 0x0 [0177.340] SysStringByteLen (bstr="better.exe") returned 0x14 [0177.340] SysStringByteLen (bstr="better.exe") returned 0x14 [0177.340] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.340] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x5225be8, puReturned=0x2945c70*=0x1) returned 0x0 [0177.341] IUnknown:QueryInterface (in: This=0x5225be8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5225be8) returned 0x0 [0177.341] IUnknown:QueryInterface (in: This=0x5225be8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.341] IUnknown:QueryInterface (in: This=0x5225be8, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.341] IUnknown:QueryInterface (in: This=0x5225be8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.341] IUnknown:AddRef (This=0x5225be8) returned 0x3 [0177.341] IUnknown:QueryInterface (in: This=0x5225be8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.341] IUnknown:QueryInterface (in: This=0x5225be8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.341] IUnknown:QueryInterface (in: This=0x5225be8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x5225bec) returned 0x0 [0177.342] IMarshal:GetUnmarshalClass (in: This=0x5225bec, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.342] IUnknown:Release (This=0x5225bec) returned 0x3 [0177.342] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.342] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.342] IUnknown:QueryInterface (in: This=0x5225be8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.342] IUnknown:Release (This=0x5225be8) returned 0x2 [0177.342] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.342] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.342] IUnknown:QueryInterface (in: This=0x5225be8, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5225be8) returned 0x0 [0177.342] IUnknown:AddRef (This=0x5225be8) returned 0x4 [0177.342] IUnknown:Release (This=0x5225be8) returned 0x3 [0177.342] IUnknown:Release (This=0x5225be8) returned 0x2 [0177.342] CoTaskMemFree (pv=0x51de588) [0177.342] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.342] IUnknown:AddRef (This=0x5225be8) returned 0x3 [0177.342] IWbemClassObject:Get (in: This=0x5225be8, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.342] IWbemClassObject:Get (in: This=0x5225be8, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3120\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.342] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3120\"") returned 0x5e [0177.342] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3120\"") returned 0x5e [0177.342] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7b4 [0177.343] SetEvent (hEvent=0x638) returned 1 [0177.343] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x7b4, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.345] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.345] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.345] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226d80, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5226d80) returned 0x0 [0177.345] WbemDefPath:IUnknown:AddRef (This=0x5226d80) returned 0x3 [0177.345] WbemDefPath:IUnknown:Release (This=0x5226d80) returned 0x2 [0177.345] WbemDefPath:IWbemPath:SetText (This=0x5226d80, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3120\"") returned 0x0 [0177.345] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.345] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.345] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.345] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.345] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.345] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.345] IWbemClassObject:Get (in: This=0x5225be8, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29530b4*=0, plFlavor=0x29530b8*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="out_public.exe", varVal2=0x0), pType=0x29530b4*=8, plFlavor=0x29530b8*=0) returned 0x0 [0177.345] SysStringByteLen (bstr="out_public.exe") returned 0x1c [0177.345] SysStringByteLen (bstr="out_public.exe") returned 0x1c [0177.346] IWbemClassObject:Get (in: This=0x5225be8, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29530b4*=8, plFlavor=0x29530b8*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="out_public.exe", varVal2=0x0), pType=0x29530b4*=8, plFlavor=0x29530b8*=0) returned 0x0 [0177.346] SysStringByteLen (bstr="out_public.exe") returned 0x1c [0177.346] SysStringByteLen (bstr="out_public.exe") returned 0x1c [0177.346] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.346] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x5225720, puReturned=0x2945c70*=0x1) returned 0x0 [0177.347] IUnknown:QueryInterface (in: This=0x5225720, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5225720) returned 0x0 [0177.347] IUnknown:QueryInterface (in: This=0x5225720, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.347] IUnknown:QueryInterface (in: This=0x5225720, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.347] IUnknown:QueryInterface (in: This=0x5225720, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.347] IUnknown:AddRef (This=0x5225720) returned 0x3 [0177.347] IUnknown:QueryInterface (in: This=0x5225720, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.347] IUnknown:QueryInterface (in: This=0x5225720, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.347] IUnknown:QueryInterface (in: This=0x5225720, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x5225724) returned 0x0 [0177.347] IMarshal:GetUnmarshalClass (in: This=0x5225724, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.347] IUnknown:Release (This=0x5225724) returned 0x3 [0177.347] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.347] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.347] IUnknown:QueryInterface (in: This=0x5225720, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.348] IUnknown:Release (This=0x5225720) returned 0x2 [0177.348] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.348] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.348] IUnknown:QueryInterface (in: This=0x5225720, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5225720) returned 0x0 [0177.348] IUnknown:AddRef (This=0x5225720) returned 0x4 [0177.348] IUnknown:Release (This=0x5225720) returned 0x3 [0177.348] IUnknown:Release (This=0x5225720) returned 0x2 [0177.348] CoTaskMemFree (pv=0x51de588) [0177.348] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.348] IUnknown:AddRef (This=0x5225720) returned 0x3 [0177.348] IWbemClassObject:Get (in: This=0x5225720, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.348] IWbemClassObject:Get (in: This=0x5225720, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3128\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.348] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3128\"") returned 0x5e [0177.348] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3128\"") returned 0x5e [0177.348] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7b8 [0177.348] SetEvent (hEvent=0x638) returned 1 [0177.348] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x7b8, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.350] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.350] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.350] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227250, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5227250) returned 0x0 [0177.350] WbemDefPath:IUnknown:AddRef (This=0x5227250) returned 0x3 [0177.350] WbemDefPath:IUnknown:Release (This=0x5227250) returned 0x2 [0177.351] WbemDefPath:IWbemPath:SetText (This=0x5227250, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3128\"") returned 0x0 [0177.351] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.351] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.351] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.351] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.351] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.351] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.351] IWbemClassObject:Get (in: This=0x5225720, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2953994*=0, plFlavor=0x2953998*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="start.exe", varVal2=0x0), pType=0x2953994*=8, plFlavor=0x2953998*=0) returned 0x0 [0177.351] SysStringByteLen (bstr="start.exe") returned 0x12 [0177.351] SysStringByteLen (bstr="start.exe") returned 0x12 [0177.351] IWbemClassObject:Get (in: This=0x5225720, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2953994*=8, plFlavor=0x2953998*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="start.exe", varVal2=0x0), pType=0x2953994*=8, plFlavor=0x2953998*=0) returned 0x0 [0177.351] SysStringByteLen (bstr="start.exe") returned 0x12 [0177.351] SysStringByteLen (bstr="start.exe") returned 0x12 [0177.351] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.351] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x5225a50, puReturned=0x2945c70*=0x1) returned 0x0 [0177.352] IUnknown:QueryInterface (in: This=0x5225a50, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5225a50) returned 0x0 [0177.353] IUnknown:QueryInterface (in: This=0x5225a50, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.353] IUnknown:QueryInterface (in: This=0x5225a50, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.353] IUnknown:QueryInterface (in: This=0x5225a50, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.353] IUnknown:AddRef (This=0x5225a50) returned 0x3 [0177.353] IUnknown:QueryInterface (in: This=0x5225a50, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.353] IUnknown:QueryInterface (in: This=0x5225a50, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.353] IUnknown:QueryInterface (in: This=0x5225a50, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x5225a54) returned 0x0 [0177.353] IMarshal:GetUnmarshalClass (in: This=0x5225a54, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.353] IUnknown:Release (This=0x5225a54) returned 0x3 [0177.353] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.353] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.353] IUnknown:QueryInterface (in: This=0x5225a50, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.353] IUnknown:Release (This=0x5225a50) returned 0x2 [0177.353] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.353] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.353] IUnknown:QueryInterface (in: This=0x5225a50, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5225a50) returned 0x0 [0177.353] IUnknown:AddRef (This=0x5225a50) returned 0x4 [0177.353] IUnknown:Release (This=0x5225a50) returned 0x3 [0177.353] IUnknown:Release (This=0x5225a50) returned 0x2 [0177.353] CoTaskMemFree (pv=0x51de588) [0177.353] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.353] IUnknown:AddRef (This=0x5225a50) returned 0x3 [0177.353] IWbemClassObject:Get (in: This=0x5225a50, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.354] IWbemClassObject:Get (in: This=0x5225a50, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3136\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.354] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3136\"") returned 0x5e [0177.354] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3136\"") returned 0x5e [0177.354] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7bc [0177.354] SetEvent (hEvent=0x638) returned 1 [0177.354] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x7bc, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.356] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.356] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.356] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227aa0, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5227aa0) returned 0x0 [0177.356] WbemDefPath:IUnknown:AddRef (This=0x5227aa0) returned 0x3 [0177.356] WbemDefPath:IUnknown:Release (This=0x5227aa0) returned 0x2 [0177.356] WbemDefPath:IWbemPath:SetText (This=0x5227aa0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3136\"") returned 0x0 [0177.356] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.356] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.356] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.356] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.356] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.356] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.356] IWbemClassObject:Get (in: This=0x5225a50, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295425c*=0, plFlavor=0x2954260*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="situation_group_head.exe", varVal2=0x0), pType=0x295425c*=8, plFlavor=0x2954260*=0) returned 0x0 [0177.356] SysStringByteLen (bstr="situation_group_head.exe") returned 0x30 [0177.356] SysStringByteLen (bstr="situation_group_head.exe") returned 0x30 [0177.357] IWbemClassObject:Get (in: This=0x5225a50, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295425c*=8, plFlavor=0x2954260*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="situation_group_head.exe", varVal2=0x0), pType=0x295425c*=8, plFlavor=0x2954260*=0) returned 0x0 [0177.357] SysStringByteLen (bstr="situation_group_head.exe") returned 0x30 [0177.357] SysStringByteLen (bstr="situation_group_head.exe") returned 0x30 [0177.357] CoTaskMemAlloc (cb=0x4) returned 0x51de638 [0177.357] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de638, puReturned=0x2945c70 | out: apObjects=0x51de638*=0x52240d0, puReturned=0x2945c70*=0x1) returned 0x0 [0177.358] IUnknown:QueryInterface (in: This=0x52240d0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x52240d0) returned 0x0 [0177.358] IUnknown:QueryInterface (in: This=0x52240d0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.358] IUnknown:QueryInterface (in: This=0x52240d0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.358] IUnknown:QueryInterface (in: This=0x52240d0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.358] IUnknown:AddRef (This=0x52240d0) returned 0x3 [0177.358] IUnknown:QueryInterface (in: This=0x52240d0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.358] IUnknown:QueryInterface (in: This=0x52240d0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.358] IUnknown:QueryInterface (in: This=0x52240d0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x52240d4) returned 0x0 [0177.358] IMarshal:GetUnmarshalClass (in: This=0x52240d4, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.358] IUnknown:Release (This=0x52240d4) returned 0x3 [0177.358] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.358] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.358] IUnknown:QueryInterface (in: This=0x52240d0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.358] IUnknown:Release (This=0x52240d0) returned 0x2 [0177.358] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.358] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.358] IUnknown:QueryInterface (in: This=0x52240d0, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x52240d0) returned 0x0 [0177.359] IUnknown:AddRef (This=0x52240d0) returned 0x4 [0177.359] IUnknown:Release (This=0x52240d0) returned 0x3 [0177.359] IUnknown:Release (This=0x52240d0) returned 0x2 [0177.359] CoTaskMemFree (pv=0x51de638) [0177.359] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.359] IUnknown:AddRef (This=0x52240d0) returned 0x3 [0177.359] IWbemClassObject:Get (in: This=0x52240d0, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.359] IWbemClassObject:Get (in: This=0x52240d0, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3148\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.359] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3148\"") returned 0x5e [0177.359] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3148\"") returned 0x5e [0177.359] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7c0 [0177.359] SetEvent (hEvent=0x638) returned 1 [0177.359] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x7c0, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.362] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.362] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.362] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227790, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5227790) returned 0x0 [0177.362] WbemDefPath:IUnknown:AddRef (This=0x5227790) returned 0x3 [0177.362] WbemDefPath:IUnknown:Release (This=0x5227790) returned 0x2 [0177.362] WbemDefPath:IWbemPath:SetText (This=0x5227790, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3148\"") returned 0x0 [0177.362] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.362] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.362] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.362] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.362] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.362] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.362] IWbemClassObject:Get (in: This=0x52240d0, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2954b64*=0, plFlavor=0x2954b68*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="collection-will-husband.exe", varVal2=0x0), pType=0x2954b64*=8, plFlavor=0x2954b68*=0) returned 0x0 [0177.363] SysStringByteLen (bstr="collection-will-husband.exe") returned 0x36 [0177.363] SysStringByteLen (bstr="collection-will-husband.exe") returned 0x36 [0177.363] IWbemClassObject:Get (in: This=0x52240d0, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2954b64*=8, plFlavor=0x2954b68*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="collection-will-husband.exe", varVal2=0x0), pType=0x2954b64*=8, plFlavor=0x2954b68*=0) returned 0x0 [0177.363] SysStringByteLen (bstr="collection-will-husband.exe") returned 0x36 [0177.363] SysStringByteLen (bstr="collection-will-husband.exe") returned 0x36 [0177.363] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.363] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x5224268, puReturned=0x2945c70*=0x1) returned 0x0 [0177.365] IUnknown:QueryInterface (in: This=0x5224268, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5224268) returned 0x0 [0177.365] IUnknown:QueryInterface (in: This=0x5224268, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.365] IUnknown:QueryInterface (in: This=0x5224268, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.365] IUnknown:QueryInterface (in: This=0x5224268, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.365] IUnknown:AddRef (This=0x5224268) returned 0x3 [0177.365] IUnknown:QueryInterface (in: This=0x5224268, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.365] IUnknown:QueryInterface (in: This=0x5224268, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.365] IUnknown:QueryInterface (in: This=0x5224268, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x522426c) returned 0x0 [0177.365] IMarshal:GetUnmarshalClass (in: This=0x522426c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.366] IUnknown:Release (This=0x522426c) returned 0x3 [0177.366] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.366] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.366] IUnknown:QueryInterface (in: This=0x5224268, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.366] IUnknown:Release (This=0x5224268) returned 0x2 [0177.366] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.366] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.366] IUnknown:QueryInterface (in: This=0x5224268, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5224268) returned 0x0 [0177.367] IUnknown:AddRef (This=0x5224268) returned 0x4 [0177.367] IUnknown:Release (This=0x5224268) returned 0x3 [0177.367] IUnknown:Release (This=0x5224268) returned 0x2 [0177.367] CoTaskMemFree (pv=0x51de588) [0177.367] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.367] IUnknown:AddRef (This=0x5224268) returned 0x3 [0177.367] IWbemClassObject:Get (in: This=0x5224268, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.368] IWbemClassObject:Get (in: This=0x5224268, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3520\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.368] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3520\"") returned 0x5e [0177.368] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3520\"") returned 0x5e [0177.368] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7c4 [0177.368] SetEvent (hEvent=0x638) returned 1 [0177.368] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x7c4, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.370] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.370] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.370] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226d10, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5226d10) returned 0x0 [0177.370] WbemDefPath:IUnknown:AddRef (This=0x5226d10) returned 0x3 [0177.370] WbemDefPath:IUnknown:Release (This=0x5226d10) returned 0x2 [0177.371] WbemDefPath:IWbemPath:SetText (This=0x5226d10, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3520\"") returned 0x0 [0177.371] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.371] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.371] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.371] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.371] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.371] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.371] IWbemClassObject:Get (in: This=0x5224268, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2955474*=0, plFlavor=0x2955478*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="foxmailincmail.exe", varVal2=0x0), pType=0x2955474*=8, plFlavor=0x2955478*=0) returned 0x0 [0177.371] SysStringByteLen (bstr="foxmailincmail.exe") returned 0x24 [0177.371] SysStringByteLen (bstr="foxmailincmail.exe") returned 0x24 [0177.371] IWbemClassObject:Get (in: This=0x5224268, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2955474*=8, plFlavor=0x2955478*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="foxmailincmail.exe", varVal2=0x0), pType=0x2955474*=8, plFlavor=0x2955478*=0) returned 0x0 [0177.371] SysStringByteLen (bstr="foxmailincmail.exe") returned 0x24 [0177.372] SysStringByteLen (bstr="foxmailincmail.exe") returned 0x24 [0177.372] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.372] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x5224598, puReturned=0x2945c70*=0x1) returned 0x0 [0177.375] IUnknown:QueryInterface (in: This=0x5224598, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5224598) returned 0x0 [0177.376] IUnknown:QueryInterface (in: This=0x5224598, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.376] IUnknown:QueryInterface (in: This=0x5224598, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.376] IUnknown:QueryInterface (in: This=0x5224598, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.376] IUnknown:AddRef (This=0x5224598) returned 0x3 [0177.376] IUnknown:QueryInterface (in: This=0x5224598, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.376] IUnknown:QueryInterface (in: This=0x5224598, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.376] IUnknown:QueryInterface (in: This=0x5224598, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x522459c) returned 0x0 [0177.376] IMarshal:GetUnmarshalClass (in: This=0x522459c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.376] IUnknown:Release (This=0x522459c) returned 0x3 [0177.376] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.376] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.376] IUnknown:QueryInterface (in: This=0x5224598, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.377] IUnknown:Release (This=0x5224598) returned 0x2 [0177.377] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.377] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.377] IUnknown:QueryInterface (in: This=0x5224598, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5224598) returned 0x0 [0177.377] IUnknown:AddRef (This=0x5224598) returned 0x4 [0177.377] IUnknown:Release (This=0x5224598) returned 0x3 [0177.377] IUnknown:Release (This=0x5224598) returned 0x2 [0177.377] CoTaskMemFree (pv=0x51de588) [0177.377] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.377] IUnknown:AddRef (This=0x5224598) returned 0x3 [0177.378] IWbemClassObject:Get (in: This=0x5224598, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.379] IWbemClassObject:Get (in: This=0x5224598, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3528\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.379] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3528\"") returned 0x5e [0177.379] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3528\"") returned 0x5e [0177.379] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7c8 [0177.379] SetEvent (hEvent=0x638) returned 1 [0177.379] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x7c8, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.382] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.382] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.382] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227640, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5227640) returned 0x0 [0177.382] WbemDefPath:IUnknown:AddRef (This=0x5227640) returned 0x3 [0177.382] WbemDefPath:IUnknown:Release (This=0x5227640) returned 0x2 [0177.382] WbemDefPath:IWbemPath:SetText (This=0x5227640, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3528\"") returned 0x0 [0177.382] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.382] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.382] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.382] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.382] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.382] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.382] IWbemClassObject:Get (in: This=0x5224598, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2955d64*=0, plFlavor=0x2955d68*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fling.exe", varVal2=0x0), pType=0x2955d64*=8, plFlavor=0x2955d68*=0) returned 0x0 [0177.382] SysStringByteLen (bstr="fling.exe") returned 0x12 [0177.382] SysStringByteLen (bstr="fling.exe") returned 0x12 [0177.383] IWbemClassObject:Get (in: This=0x5224598, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2955d64*=8, plFlavor=0x2955d68*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fling.exe", varVal2=0x0), pType=0x2955d64*=8, plFlavor=0x2955d68*=0) returned 0x0 [0177.383] SysStringByteLen (bstr="fling.exe") returned 0x12 [0177.383] SysStringByteLen (bstr="fling.exe") returned 0x12 [0177.384] CoTaskMemAlloc (cb=0x4) returned 0x51de638 [0177.384] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de638, puReturned=0x2945c70 | out: apObjects=0x51de638*=0x5224730, puReturned=0x2945c70*=0x1) returned 0x0 [0177.385] IUnknown:QueryInterface (in: This=0x5224730, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5224730) returned 0x0 [0177.385] IUnknown:QueryInterface (in: This=0x5224730, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.385] IUnknown:QueryInterface (in: This=0x5224730, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.385] IUnknown:QueryInterface (in: This=0x5224730, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.385] IUnknown:AddRef (This=0x5224730) returned 0x3 [0177.385] IUnknown:QueryInterface (in: This=0x5224730, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.385] IUnknown:QueryInterface (in: This=0x5224730, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.385] IUnknown:QueryInterface (in: This=0x5224730, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x5224734) returned 0x0 [0177.385] IMarshal:GetUnmarshalClass (in: This=0x5224734, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.385] IUnknown:Release (This=0x5224734) returned 0x3 [0177.385] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.386] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.386] IUnknown:QueryInterface (in: This=0x5224730, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.386] IUnknown:Release (This=0x5224730) returned 0x2 [0177.386] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.386] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.386] IUnknown:QueryInterface (in: This=0x5224730, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5224730) returned 0x0 [0177.386] IUnknown:AddRef (This=0x5224730) returned 0x4 [0177.386] IUnknown:Release (This=0x5224730) returned 0x3 [0177.386] IUnknown:Release (This=0x5224730) returned 0x2 [0177.386] CoTaskMemFree (pv=0x51de638) [0177.390] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.390] IUnknown:AddRef (This=0x5224730) returned 0x3 [0177.390] IWbemClassObject:Get (in: This=0x5224730, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.391] IWbemClassObject:Get (in: This=0x5224730, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3536\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.391] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3536\"") returned 0x5e [0177.391] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3536\"") returned 0x5e [0177.391] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7cc [0177.391] SetEvent (hEvent=0x638) returned 1 [0177.391] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x7cc, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.393] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.393] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.393] WbemDefPath:IUnknown:QueryInterface (in: This=0x52274f0, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x52274f0) returned 0x0 [0177.393] WbemDefPath:IUnknown:AddRef (This=0x52274f0) returned 0x3 [0177.393] WbemDefPath:IUnknown:Release (This=0x52274f0) returned 0x2 [0177.393] WbemDefPath:IWbemPath:SetText (This=0x52274f0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3536\"") returned 0x0 [0177.393] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.393] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.393] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.393] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.394] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.394] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.394] IWbemClassObject:Get (in: This=0x5224730, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295662c*=0, plFlavor=0x2956630*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="flashfxp.exe", varVal2=0x0), pType=0x295662c*=8, plFlavor=0x2956630*=0) returned 0x0 [0177.394] SysStringByteLen (bstr="flashfxp.exe") returned 0x18 [0177.394] SysStringByteLen (bstr="flashfxp.exe") returned 0x18 [0177.394] IWbemClassObject:Get (in: This=0x5224730, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295662c*=8, plFlavor=0x2956630*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="flashfxp.exe", varVal2=0x0), pType=0x295662c*=8, plFlavor=0x2956630*=0) returned 0x0 [0177.394] SysStringByteLen (bstr="flashfxp.exe") returned 0x18 [0177.394] SysStringByteLen (bstr="flashfxp.exe") returned 0x18 [0177.394] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.394] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x5224a60, puReturned=0x2945c70*=0x1) returned 0x0 [0177.398] IUnknown:QueryInterface (in: This=0x5224a60, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5224a60) returned 0x0 [0177.398] IUnknown:QueryInterface (in: This=0x5224a60, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.398] IUnknown:QueryInterface (in: This=0x5224a60, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.398] IUnknown:QueryInterface (in: This=0x5224a60, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.399] IUnknown:AddRef (This=0x5224a60) returned 0x3 [0177.399] IUnknown:QueryInterface (in: This=0x5224a60, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.399] IUnknown:QueryInterface (in: This=0x5224a60, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.399] IUnknown:QueryInterface (in: This=0x5224a60, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x5224a64) returned 0x0 [0177.399] IMarshal:GetUnmarshalClass (in: This=0x5224a64, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.399] IUnknown:Release (This=0x5224a64) returned 0x3 [0177.399] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.399] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.399] IUnknown:QueryInterface (in: This=0x5224a60, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.399] IUnknown:Release (This=0x5224a60) returned 0x2 [0177.399] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.399] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.399] IUnknown:QueryInterface (in: This=0x5224a60, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5224a60) returned 0x0 [0177.399] IUnknown:AddRef (This=0x5224a60) returned 0x4 [0177.400] IUnknown:Release (This=0x5224a60) returned 0x3 [0177.400] IUnknown:Release (This=0x5224a60) returned 0x2 [0177.400] CoTaskMemFree (pv=0x51de588) [0177.400] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.400] IUnknown:AddRef (This=0x5224a60) returned 0x3 [0177.400] IWbemClassObject:Get (in: This=0x5224a60, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.400] IWbemClassObject:Get (in: This=0x5224a60, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3544\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.400] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3544\"") returned 0x5e [0177.400] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3544\"") returned 0x5e [0177.400] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7d0 [0177.400] SetEvent (hEvent=0x638) returned 1 [0177.400] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x7d0, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.402] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.402] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.402] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226df0, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5226df0) returned 0x0 [0177.402] WbemDefPath:IUnknown:AddRef (This=0x5226df0) returned 0x3 [0177.402] WbemDefPath:IUnknown:Release (This=0x5226df0) returned 0x2 [0177.402] WbemDefPath:IWbemPath:SetText (This=0x5226df0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3544\"") returned 0x0 [0177.402] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.402] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.402] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.403] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.403] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.403] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.403] IWbemClassObject:Get (in: This=0x5224a60, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2956f04*=0, plFlavor=0x2956f08*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="filezilla.exe", varVal2=0x0), pType=0x2956f04*=8, plFlavor=0x2956f08*=0) returned 0x0 [0177.403] SysStringByteLen (bstr="filezilla.exe") returned 0x1a [0177.403] SysStringByteLen (bstr="filezilla.exe") returned 0x1a [0177.403] IWbemClassObject:Get (in: This=0x5224a60, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2956f04*=8, plFlavor=0x2956f08*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="filezilla.exe", varVal2=0x0), pType=0x2956f04*=8, plFlavor=0x2956f08*=0) returned 0x0 [0177.403] SysStringByteLen (bstr="filezilla.exe") returned 0x1a [0177.403] SysStringByteLen (bstr="filezilla.exe") returned 0x1a [0177.403] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.403] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x5224bf8, puReturned=0x2945c70*=0x1) returned 0x0 [0177.404] IUnknown:QueryInterface (in: This=0x5224bf8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5224bf8) returned 0x0 [0177.404] IUnknown:QueryInterface (in: This=0x5224bf8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.404] IUnknown:QueryInterface (in: This=0x5224bf8, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.404] IUnknown:QueryInterface (in: This=0x5224bf8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.404] IUnknown:AddRef (This=0x5224bf8) returned 0x3 [0177.404] IUnknown:QueryInterface (in: This=0x5224bf8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.404] IUnknown:QueryInterface (in: This=0x5224bf8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.404] IUnknown:QueryInterface (in: This=0x5224bf8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x5224bfc) returned 0x0 [0177.405] IMarshal:GetUnmarshalClass (in: This=0x5224bfc, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.405] IUnknown:Release (This=0x5224bfc) returned 0x3 [0177.405] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.405] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.405] IUnknown:QueryInterface (in: This=0x5224bf8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.405] IUnknown:Release (This=0x5224bf8) returned 0x2 [0177.405] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.405] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.405] IUnknown:QueryInterface (in: This=0x5224bf8, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5224bf8) returned 0x0 [0177.405] IUnknown:AddRef (This=0x5224bf8) returned 0x4 [0177.405] IUnknown:Release (This=0x5224bf8) returned 0x3 [0177.405] IUnknown:Release (This=0x5224bf8) returned 0x2 [0177.405] CoTaskMemFree (pv=0x51de588) [0177.405] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.405] IUnknown:AddRef (This=0x5224bf8) returned 0x3 [0177.405] IWbemClassObject:Get (in: This=0x5224bf8, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.405] IWbemClassObject:Get (in: This=0x5224bf8, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3552\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.405] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3552\"") returned 0x5e [0177.405] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3552\"") returned 0x5e [0177.405] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7d4 [0177.406] SetEvent (hEvent=0x638) returned 1 [0177.406] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x7d4, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.408] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.408] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.408] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226e60, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5226e60) returned 0x0 [0177.408] WbemDefPath:IUnknown:AddRef (This=0x5226e60) returned 0x3 [0177.408] WbemDefPath:IUnknown:Release (This=0x5226e60) returned 0x2 [0177.408] WbemDefPath:IWbemPath:SetText (This=0x5226e60, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3552\"") returned 0x0 [0177.409] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.409] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.409] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.409] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.409] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.409] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.409] IWbemClassObject:Get (in: This=0x5224bf8, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29577dc*=0, plFlavor=0x29577e0*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="far.exe", varVal2=0x0), pType=0x29577dc*=8, plFlavor=0x29577e0*=0) returned 0x0 [0177.409] SysStringByteLen (bstr="far.exe") returned 0xe [0177.409] SysStringByteLen (bstr="far.exe") returned 0xe [0177.409] IWbemClassObject:Get (in: This=0x5224bf8, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29577dc*=8, plFlavor=0x29577e0*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="far.exe", varVal2=0x0), pType=0x29577dc*=8, plFlavor=0x29577e0*=0) returned 0x0 [0177.409] SysStringByteLen (bstr="far.exe") returned 0xe [0177.409] SysStringByteLen (bstr="far.exe") returned 0xe [0177.409] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.409] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x5224d90, puReturned=0x2945c70*=0x1) returned 0x0 [0177.411] IUnknown:QueryInterface (in: This=0x5224d90, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5224d90) returned 0x0 [0177.411] IUnknown:QueryInterface (in: This=0x5224d90, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.411] IUnknown:QueryInterface (in: This=0x5224d90, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.411] IUnknown:QueryInterface (in: This=0x5224d90, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.411] IUnknown:AddRef (This=0x5224d90) returned 0x3 [0177.411] IUnknown:QueryInterface (in: This=0x5224d90, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.411] IUnknown:QueryInterface (in: This=0x5224d90, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.411] IUnknown:QueryInterface (in: This=0x5224d90, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x5224d94) returned 0x0 [0177.411] IMarshal:GetUnmarshalClass (in: This=0x5224d94, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.411] IUnknown:Release (This=0x5224d94) returned 0x3 [0177.411] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.411] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.411] IUnknown:QueryInterface (in: This=0x5224d90, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.411] IUnknown:Release (This=0x5224d90) returned 0x2 [0177.411] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.411] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.411] IUnknown:QueryInterface (in: This=0x5224d90, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5224d90) returned 0x0 [0177.411] IUnknown:AddRef (This=0x5224d90) returned 0x4 [0177.412] IUnknown:Release (This=0x5224d90) returned 0x3 [0177.412] IUnknown:Release (This=0x5224d90) returned 0x2 [0177.412] CoTaskMemFree (pv=0x51de588) [0177.412] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.412] IUnknown:AddRef (This=0x5224d90) returned 0x3 [0177.412] IWbemClassObject:Get (in: This=0x5224d90, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.412] IWbemClassObject:Get (in: This=0x5224d90, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3560\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.412] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3560\"") returned 0x5e [0177.412] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3560\"") returned 0x5e [0177.412] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7d8 [0177.412] SetEvent (hEvent=0x638) returned 1 [0177.412] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x7d8, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.414] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.414] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.414] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226ed0, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5226ed0) returned 0x0 [0177.414] WbemDefPath:IUnknown:AddRef (This=0x5226ed0) returned 0x3 [0177.414] WbemDefPath:IUnknown:Release (This=0x5226ed0) returned 0x2 [0177.414] WbemDefPath:IWbemPath:SetText (This=0x5226ed0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3560\"") returned 0x0 [0177.414] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.415] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.415] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.415] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.415] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.415] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.415] IWbemClassObject:Get (in: This=0x5224d90, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295809c*=0, plFlavor=0x29580a0*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="coreftp.exe", varVal2=0x0), pType=0x295809c*=8, plFlavor=0x29580a0*=0) returned 0x0 [0177.415] SysStringByteLen (bstr="coreftp.exe") returned 0x16 [0177.415] SysStringByteLen (bstr="coreftp.exe") returned 0x16 [0177.415] IWbemClassObject:Get (in: This=0x5224d90, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295809c*=8, plFlavor=0x29580a0*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="coreftp.exe", varVal2=0x0), pType=0x295809c*=8, plFlavor=0x29580a0*=0) returned 0x0 [0177.415] SysStringByteLen (bstr="coreftp.exe") returned 0x16 [0177.415] SysStringByteLen (bstr="coreftp.exe") returned 0x16 [0177.415] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.415] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x5224f28, puReturned=0x2945c70*=0x1) returned 0x0 [0177.416] IUnknown:QueryInterface (in: This=0x5224f28, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5224f28) returned 0x0 [0177.416] IUnknown:QueryInterface (in: This=0x5224f28, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.416] IUnknown:QueryInterface (in: This=0x5224f28, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.416] IUnknown:QueryInterface (in: This=0x5224f28, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.416] IUnknown:AddRef (This=0x5224f28) returned 0x3 [0177.416] IUnknown:QueryInterface (in: This=0x5224f28, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.416] IUnknown:QueryInterface (in: This=0x5224f28, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.417] IUnknown:QueryInterface (in: This=0x5224f28, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x5224f2c) returned 0x0 [0177.417] IMarshal:GetUnmarshalClass (in: This=0x5224f2c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.417] IUnknown:Release (This=0x5224f2c) returned 0x3 [0177.417] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.417] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.417] IUnknown:QueryInterface (in: This=0x5224f28, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.417] IUnknown:Release (This=0x5224f28) returned 0x2 [0177.417] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.417] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.417] IUnknown:QueryInterface (in: This=0x5224f28, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5224f28) returned 0x0 [0177.427] IUnknown:AddRef (This=0x5224f28) returned 0x4 [0177.427] IUnknown:Release (This=0x5224f28) returned 0x3 [0177.427] IUnknown:Release (This=0x5224f28) returned 0x2 [0177.427] CoTaskMemFree (pv=0x51de588) [0177.427] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.427] IUnknown:AddRef (This=0x5224f28) returned 0x3 [0177.427] IWbemClassObject:Get (in: This=0x5224f28, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.427] IWbemClassObject:Get (in: This=0x5224f28, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3568\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.428] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3568\"") returned 0x5e [0177.428] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3568\"") returned 0x5e [0177.428] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7dc [0177.428] SetEvent (hEvent=0x638) returned 1 [0177.430] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x7dc, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.433] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.433] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227870, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5227870) returned 0x0 [0177.433] WbemDefPath:IUnknown:AddRef (This=0x5227870) returned 0x3 [0177.433] WbemDefPath:IUnknown:Release (This=0x5227870) returned 0x2 [0177.433] WbemDefPath:IWbemPath:SetText (This=0x5227870, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3568\"") returned 0x0 [0177.433] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.433] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.433] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.433] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.433] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.433] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.433] IWbemClassObject:Get (in: This=0x5224f28, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295896c*=0, plFlavor=0x2958970*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="bitkinex.exe", varVal2=0x0), pType=0x295896c*=8, plFlavor=0x2958970*=0) returned 0x0 [0177.433] SysStringByteLen (bstr="bitkinex.exe") returned 0x18 [0177.433] SysStringByteLen (bstr="bitkinex.exe") returned 0x18 [0177.433] IWbemClassObject:Get (in: This=0x5224f28, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295896c*=8, plFlavor=0x2958970*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="bitkinex.exe", varVal2=0x0), pType=0x295896c*=8, plFlavor=0x2958970*=0) returned 0x0 [0177.433] SysStringByteLen (bstr="bitkinex.exe") returned 0x18 [0177.433] SysStringByteLen (bstr="bitkinex.exe") returned 0x18 [0177.434] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.434] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x52250c0, puReturned=0x2945c70*=0x1) returned 0x0 [0177.435] IUnknown:QueryInterface (in: This=0x52250c0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x52250c0) returned 0x0 [0177.435] IUnknown:QueryInterface (in: This=0x52250c0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.435] IUnknown:QueryInterface (in: This=0x52250c0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.435] IUnknown:QueryInterface (in: This=0x52250c0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.435] IUnknown:AddRef (This=0x52250c0) returned 0x3 [0177.435] IUnknown:QueryInterface (in: This=0x52250c0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.435] IUnknown:QueryInterface (in: This=0x52250c0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.435] IUnknown:QueryInterface (in: This=0x52250c0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x52250c4) returned 0x0 [0177.435] IMarshal:GetUnmarshalClass (in: This=0x52250c4, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.435] IUnknown:Release (This=0x52250c4) returned 0x3 [0177.435] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.435] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.435] IUnknown:QueryInterface (in: This=0x52250c0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.436] IUnknown:Release (This=0x52250c0) returned 0x2 [0177.436] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.436] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.436] IUnknown:QueryInterface (in: This=0x52250c0, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x52250c0) returned 0x0 [0177.436] IUnknown:AddRef (This=0x52250c0) returned 0x4 [0177.436] IUnknown:Release (This=0x52250c0) returned 0x3 [0177.436] IUnknown:Release (This=0x52250c0) returned 0x2 [0177.436] CoTaskMemFree (pv=0x51de588) [0177.436] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.436] IUnknown:AddRef (This=0x52250c0) returned 0x3 [0177.436] IWbemClassObject:Get (in: This=0x52250c0, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.436] IWbemClassObject:Get (in: This=0x52250c0, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3576\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.436] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3576\"") returned 0x5e [0177.436] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3576\"") returned 0x5e [0177.436] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7e0 [0177.436] SetEvent (hEvent=0x638) returned 1 [0177.436] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x7e0, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.439] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.439] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.439] WbemDefPath:IUnknown:QueryInterface (in: This=0x52278e0, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x52278e0) returned 0x0 [0177.439] WbemDefPath:IUnknown:AddRef (This=0x52278e0) returned 0x3 [0177.439] WbemDefPath:IUnknown:Release (This=0x52278e0) returned 0x2 [0177.439] WbemDefPath:IWbemPath:SetText (This=0x52278e0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3576\"") returned 0x0 [0177.439] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.439] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.439] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.439] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.439] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.439] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.439] IWbemClassObject:Get (in: This=0x52250c0, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2959244*=0, plFlavor=0x2959248*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="barca.exe", varVal2=0x0), pType=0x2959244*=8, plFlavor=0x2959248*=0) returned 0x0 [0177.439] SysStringByteLen (bstr="barca.exe") returned 0x12 [0177.439] SysStringByteLen (bstr="barca.exe") returned 0x12 [0177.439] IWbemClassObject:Get (in: This=0x52250c0, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2959244*=8, plFlavor=0x2959248*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="barca.exe", varVal2=0x0), pType=0x2959244*=8, plFlavor=0x2959248*=0) returned 0x0 [0177.439] SysStringByteLen (bstr="barca.exe") returned 0x12 [0177.439] SysStringByteLen (bstr="barca.exe") returned 0x12 [0177.439] CoTaskMemAlloc (cb=0x4) returned 0x51de638 [0177.439] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de638, puReturned=0x2945c70 | out: apObjects=0x51de638*=0x5230af8, puReturned=0x2945c70*=0x1) returned 0x0 [0177.442] IUnknown:QueryInterface (in: This=0x5230af8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5230af8) returned 0x0 [0177.442] IUnknown:QueryInterface (in: This=0x5230af8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.442] IUnknown:QueryInterface (in: This=0x5230af8, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.442] IUnknown:QueryInterface (in: This=0x5230af8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.442] IUnknown:AddRef (This=0x5230af8) returned 0x3 [0177.442] IUnknown:QueryInterface (in: This=0x5230af8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.442] IUnknown:QueryInterface (in: This=0x5230af8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.442] IUnknown:QueryInterface (in: This=0x5230af8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x5230afc) returned 0x0 [0177.442] IMarshal:GetUnmarshalClass (in: This=0x5230afc, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.443] IUnknown:Release (This=0x5230afc) returned 0x3 [0177.443] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.443] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.443] IUnknown:QueryInterface (in: This=0x5230af8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.443] IUnknown:Release (This=0x5230af8) returned 0x2 [0177.443] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.443] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.443] IUnknown:QueryInterface (in: This=0x5230af8, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5230af8) returned 0x0 [0177.443] IUnknown:AddRef (This=0x5230af8) returned 0x4 [0177.443] IUnknown:Release (This=0x5230af8) returned 0x3 [0177.443] IUnknown:Release (This=0x5230af8) returned 0x2 [0177.443] CoTaskMemFree (pv=0x51de638) [0177.443] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.443] IUnknown:AddRef (This=0x5230af8) returned 0x3 [0177.443] IWbemClassObject:Get (in: This=0x5230af8, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.443] IWbemClassObject:Get (in: This=0x5230af8, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3584\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.443] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3584\"") returned 0x5e [0177.443] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3584\"") returned 0x5e [0177.443] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7e4 [0177.444] SetEvent (hEvent=0x638) returned 1 [0177.444] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x7e4, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.446] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.446] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.446] WbemDefPath:IUnknown:QueryInterface (in: This=0x52272c0, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x52272c0) returned 0x0 [0177.446] WbemDefPath:IUnknown:AddRef (This=0x52272c0) returned 0x3 [0177.446] WbemDefPath:IUnknown:Release (This=0x52272c0) returned 0x2 [0177.446] WbemDefPath:IWbemPath:SetText (This=0x52272c0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3584\"") returned 0x0 [0177.446] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.446] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.446] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.446] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.446] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.446] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.446] IWbemClassObject:Get (in: This=0x5230af8, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2959b0c*=0, plFlavor=0x2959b10*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="alftp.exe", varVal2=0x0), pType=0x2959b0c*=8, plFlavor=0x2959b10*=0) returned 0x0 [0177.446] SysStringByteLen (bstr="alftp.exe") returned 0x12 [0177.446] SysStringByteLen (bstr="alftp.exe") returned 0x12 [0177.446] IWbemClassObject:Get (in: This=0x5230af8, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2959b0c*=8, plFlavor=0x2959b10*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="alftp.exe", varVal2=0x0), pType=0x2959b0c*=8, plFlavor=0x2959b10*=0) returned 0x0 [0177.447] SysStringByteLen (bstr="alftp.exe") returned 0x12 [0177.447] SysStringByteLen (bstr="alftp.exe") returned 0x12 [0177.447] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.447] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x52317b8, puReturned=0x2945c70*=0x1) returned 0x0 [0177.449] IUnknown:QueryInterface (in: This=0x52317b8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x52317b8) returned 0x0 [0177.449] IUnknown:QueryInterface (in: This=0x52317b8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.449] IUnknown:QueryInterface (in: This=0x52317b8, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.449] IUnknown:QueryInterface (in: This=0x52317b8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.449] IUnknown:AddRef (This=0x52317b8) returned 0x3 [0177.449] IUnknown:QueryInterface (in: This=0x52317b8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.449] IUnknown:QueryInterface (in: This=0x52317b8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.449] IUnknown:QueryInterface (in: This=0x52317b8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x52317bc) returned 0x0 [0177.449] IMarshal:GetUnmarshalClass (in: This=0x52317bc, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.449] IUnknown:Release (This=0x52317bc) returned 0x3 [0177.449] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.449] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.449] IUnknown:QueryInterface (in: This=0x52317b8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.449] IUnknown:Release (This=0x52317b8) returned 0x2 [0177.449] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.449] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.449] IUnknown:QueryInterface (in: This=0x52317b8, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x52317b8) returned 0x0 [0177.449] IUnknown:AddRef (This=0x52317b8) returned 0x4 [0177.449] IUnknown:Release (This=0x52317b8) returned 0x3 [0177.449] IUnknown:Release (This=0x52317b8) returned 0x2 [0177.449] CoTaskMemFree (pv=0x51de588) [0177.450] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.450] IUnknown:AddRef (This=0x52317b8) returned 0x3 [0177.450] IWbemClassObject:Get (in: This=0x52317b8, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.450] IWbemClassObject:Get (in: This=0x52317b8, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3592\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.450] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3592\"") returned 0x5e [0177.450] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3592\"") returned 0x5e [0177.450] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7e8 [0177.450] SetEvent (hEvent=0x638) returned 1 [0177.450] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x7e8, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.454] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.454] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.454] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227330, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5227330) returned 0x0 [0177.454] WbemDefPath:IUnknown:AddRef (This=0x5227330) returned 0x3 [0177.454] WbemDefPath:IUnknown:Release (This=0x5227330) returned 0x2 [0177.455] WbemDefPath:IWbemPath:SetText (This=0x5227330, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3592\"") returned 0x0 [0177.455] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.455] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.455] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.455] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.455] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.455] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.455] IWbemClassObject:Get (in: This=0x52317b8, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295a3d4*=0, plFlavor=0x295a3d8*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="absolutetelnet.exe", varVal2=0x0), pType=0x295a3d4*=8, plFlavor=0x295a3d8*=0) returned 0x0 [0177.455] SysStringByteLen (bstr="absolutetelnet.exe") returned 0x24 [0177.455] SysStringByteLen (bstr="absolutetelnet.exe") returned 0x24 [0177.455] IWbemClassObject:Get (in: This=0x52317b8, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295a3d4*=8, plFlavor=0x295a3d8*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="absolutetelnet.exe", varVal2=0x0), pType=0x295a3d4*=8, plFlavor=0x295a3d8*=0) returned 0x0 [0177.455] SysStringByteLen (bstr="absolutetelnet.exe") returned 0x24 [0177.455] SysStringByteLen (bstr="absolutetelnet.exe") returned 0x24 [0177.455] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.455] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x52312f0, puReturned=0x2945c70*=0x1) returned 0x0 [0177.458] IUnknown:QueryInterface (in: This=0x52312f0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x52312f0) returned 0x0 [0177.458] IUnknown:QueryInterface (in: This=0x52312f0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.458] IUnknown:QueryInterface (in: This=0x52312f0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.458] IUnknown:QueryInterface (in: This=0x52312f0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.458] IUnknown:AddRef (This=0x52312f0) returned 0x3 [0177.459] IUnknown:QueryInterface (in: This=0x52312f0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.459] IUnknown:QueryInterface (in: This=0x52312f0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.459] IUnknown:QueryInterface (in: This=0x52312f0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x52312f4) returned 0x0 [0177.459] IMarshal:GetUnmarshalClass (in: This=0x52312f4, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.459] IUnknown:Release (This=0x52312f4) returned 0x3 [0177.459] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.459] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.459] IUnknown:QueryInterface (in: This=0x52312f0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.459] IUnknown:Release (This=0x52312f0) returned 0x2 [0177.459] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.459] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.459] IUnknown:QueryInterface (in: This=0x52312f0, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x52312f0) returned 0x0 [0177.459] IUnknown:AddRef (This=0x52312f0) returned 0x4 [0177.459] IUnknown:Release (This=0x52312f0) returned 0x3 [0177.459] IUnknown:Release (This=0x52312f0) returned 0x2 [0177.459] CoTaskMemFree (pv=0x51de588) [0177.459] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.459] IUnknown:AddRef (This=0x52312f0) returned 0x3 [0177.459] IWbemClassObject:Get (in: This=0x52312f0, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.459] IWbemClassObject:Get (in: This=0x52312f0, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3600\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.459] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3600\"") returned 0x5e [0177.460] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3600\"") returned 0x5e [0177.460] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7ec [0177.460] SetEvent (hEvent=0x638) returned 1 [0177.460] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x7ec, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.464] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.464] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.464] WbemDefPath:IUnknown:QueryInterface (in: This=0x52273a0, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x52273a0) returned 0x0 [0177.464] WbemDefPath:IUnknown:AddRef (This=0x52273a0) returned 0x3 [0177.464] WbemDefPath:IUnknown:Release (This=0x52273a0) returned 0x2 [0177.464] WbemDefPath:IWbemPath:SetText (This=0x52273a0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3600\"") returned 0x0 [0177.464] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.464] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.464] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.464] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.464] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.464] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.464] IWbemClassObject:Get (in: This=0x52312f0, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295acc4*=0, plFlavor=0x295acc8*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="3dftp.exe", varVal2=0x0), pType=0x295acc4*=8, plFlavor=0x295acc8*=0) returned 0x0 [0177.464] SysStringByteLen (bstr="3dftp.exe") returned 0x12 [0177.464] SysStringByteLen (bstr="3dftp.exe") returned 0x12 [0177.464] IWbemClassObject:Get (in: This=0x52312f0, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295acc4*=8, plFlavor=0x295acc8*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="3dftp.exe", varVal2=0x0), pType=0x295acc4*=8, plFlavor=0x295acc8*=0) returned 0x0 [0177.464] SysStringByteLen (bstr="3dftp.exe") returned 0x12 [0177.465] SysStringByteLen (bstr="3dftp.exe") returned 0x12 [0177.465] CoTaskMemAlloc (cb=0x4) returned 0x51de638 [0177.465] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de638, puReturned=0x2945c70 | out: apObjects=0x51de638*=0x5232610, puReturned=0x2945c70*=0x1) returned 0x0 [0177.466] IUnknown:QueryInterface (in: This=0x5232610, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5232610) returned 0x0 [0177.467] IUnknown:QueryInterface (in: This=0x5232610, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.467] IUnknown:QueryInterface (in: This=0x5232610, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.467] IUnknown:QueryInterface (in: This=0x5232610, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.467] IUnknown:AddRef (This=0x5232610) returned 0x3 [0177.467] IUnknown:QueryInterface (in: This=0x5232610, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.467] IUnknown:QueryInterface (in: This=0x5232610, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.467] IUnknown:QueryInterface (in: This=0x5232610, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x5232614) returned 0x0 [0177.467] IMarshal:GetUnmarshalClass (in: This=0x5232614, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.467] IUnknown:Release (This=0x5232614) returned 0x3 [0177.467] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.467] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.467] IUnknown:QueryInterface (in: This=0x5232610, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.467] IUnknown:Release (This=0x5232610) returned 0x2 [0177.467] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.467] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.467] IUnknown:QueryInterface (in: This=0x5232610, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5232610) returned 0x0 [0177.467] IUnknown:AddRef (This=0x5232610) returned 0x4 [0177.467] IUnknown:Release (This=0x5232610) returned 0x3 [0177.467] IUnknown:Release (This=0x5232610) returned 0x2 [0177.467] CoTaskMemFree (pv=0x51de638) [0177.467] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.467] IUnknown:AddRef (This=0x5232610) returned 0x3 [0177.467] IWbemClassObject:Get (in: This=0x5232610, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.468] IWbemClassObject:Get (in: This=0x5232610, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3608\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.468] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3608\"") returned 0x5e [0177.468] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3608\"") returned 0x5e [0177.468] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7f0 [0177.468] SetEvent (hEvent=0x638) returned 1 [0177.468] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x7f0, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.470] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.470] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.470] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227410, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5227410) returned 0x0 [0177.470] WbemDefPath:IUnknown:AddRef (This=0x5227410) returned 0x3 [0177.470] WbemDefPath:IUnknown:Release (This=0x5227410) returned 0x2 [0177.470] WbemDefPath:IWbemPath:SetText (This=0x5227410, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3608\"") returned 0x0 [0177.470] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.470] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.470] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.470] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.470] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.470] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.470] IWbemClassObject:Get (in: This=0x5232610, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295b58c*=0, plFlavor=0x295b590*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="gmailnotifierpro.exe", varVal2=0x0), pType=0x295b58c*=8, plFlavor=0x295b590*=0) returned 0x0 [0177.470] SysStringByteLen (bstr="gmailnotifierpro.exe") returned 0x28 [0177.471] SysStringByteLen (bstr="gmailnotifierpro.exe") returned 0x28 [0177.471] IWbemClassObject:Get (in: This=0x5232610, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295b58c*=8, plFlavor=0x295b590*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="gmailnotifierpro.exe", varVal2=0x0), pType=0x295b58c*=8, plFlavor=0x295b590*=0) returned 0x0 [0177.471] SysStringByteLen (bstr="gmailnotifierpro.exe") returned 0x28 [0177.471] SysStringByteLen (bstr="gmailnotifierpro.exe") returned 0x28 [0177.471] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.471] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x5230e28, puReturned=0x2945c70*=0x1) returned 0x0 [0177.472] IUnknown:QueryInterface (in: This=0x5230e28, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5230e28) returned 0x0 [0177.472] IUnknown:QueryInterface (in: This=0x5230e28, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.472] IUnknown:QueryInterface (in: This=0x5230e28, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.472] IUnknown:QueryInterface (in: This=0x5230e28, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.472] IUnknown:AddRef (This=0x5230e28) returned 0x3 [0177.472] IUnknown:QueryInterface (in: This=0x5230e28, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.472] IUnknown:QueryInterface (in: This=0x5230e28, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.472] IUnknown:QueryInterface (in: This=0x5230e28, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x5230e2c) returned 0x0 [0177.473] IMarshal:GetUnmarshalClass (in: This=0x5230e2c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.473] IUnknown:Release (This=0x5230e2c) returned 0x3 [0177.473] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.473] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.473] IUnknown:QueryInterface (in: This=0x5230e28, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.473] IUnknown:Release (This=0x5230e28) returned 0x2 [0177.473] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.473] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.473] IUnknown:QueryInterface (in: This=0x5230e28, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5230e28) returned 0x0 [0177.473] IUnknown:AddRef (This=0x5230e28) returned 0x4 [0177.473] IUnknown:Release (This=0x5230e28) returned 0x3 [0177.473] IUnknown:Release (This=0x5230e28) returned 0x2 [0177.475] CoTaskMemFree (pv=0x51de588) [0177.475] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.475] IUnknown:AddRef (This=0x5230e28) returned 0x3 [0177.475] IWbemClassObject:Get (in: This=0x5230e28, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.475] IWbemClassObject:Get (in: This=0x5230e28, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3616\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.475] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3616\"") returned 0x5e [0177.475] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3616\"") returned 0x5e [0177.475] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7f4 [0177.475] SetEvent (hEvent=0x638) returned 1 [0177.475] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x7f4, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.478] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.478] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x52275d0, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x52275d0) returned 0x0 [0177.478] WbemDefPath:IUnknown:AddRef (This=0x52275d0) returned 0x3 [0177.478] WbemDefPath:IUnknown:Release (This=0x52275d0) returned 0x2 [0177.478] WbemDefPath:IWbemPath:SetText (This=0x52275d0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3616\"") returned 0x0 [0177.478] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.478] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.478] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.478] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.478] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.478] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.478] IWbemClassObject:Get (in: This=0x5230e28, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295be84*=0, plFlavor=0x295be88*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="icq.exe", varVal2=0x0), pType=0x295be84*=8, plFlavor=0x295be88*=0) returned 0x0 [0177.478] SysStringByteLen (bstr="icq.exe") returned 0xe [0177.478] SysStringByteLen (bstr="icq.exe") returned 0xe [0177.478] IWbemClassObject:Get (in: This=0x5230e28, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295be84*=8, plFlavor=0x295be88*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="icq.exe", varVal2=0x0), pType=0x295be84*=8, plFlavor=0x295be88*=0) returned 0x0 [0177.478] SysStringByteLen (bstr="icq.exe") returned 0xe [0177.478] SysStringByteLen (bstr="icq.exe") returned 0xe [0177.479] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.479] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x5231ae8, puReturned=0x2945c70*=0x1) returned 0x0 [0177.480] IUnknown:QueryInterface (in: This=0x5231ae8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5231ae8) returned 0x0 [0177.480] IUnknown:QueryInterface (in: This=0x5231ae8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.480] IUnknown:QueryInterface (in: This=0x5231ae8, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.480] IUnknown:QueryInterface (in: This=0x5231ae8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.480] IUnknown:AddRef (This=0x5231ae8) returned 0x3 [0177.480] IUnknown:QueryInterface (in: This=0x5231ae8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.480] IUnknown:QueryInterface (in: This=0x5231ae8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.480] IUnknown:QueryInterface (in: This=0x5231ae8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x5231aec) returned 0x0 [0177.480] IMarshal:GetUnmarshalClass (in: This=0x5231aec, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.480] IUnknown:Release (This=0x5231aec) returned 0x3 [0177.480] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.480] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.480] IUnknown:QueryInterface (in: This=0x5231ae8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.480] IUnknown:Release (This=0x5231ae8) returned 0x2 [0177.480] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.480] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.480] IUnknown:QueryInterface (in: This=0x5231ae8, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5231ae8) returned 0x0 [0177.480] IUnknown:AddRef (This=0x5231ae8) returned 0x4 [0177.480] IUnknown:Release (This=0x5231ae8) returned 0x3 [0177.481] IUnknown:Release (This=0x5231ae8) returned 0x2 [0177.481] CoTaskMemFree (pv=0x51de588) [0177.481] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.481] IUnknown:AddRef (This=0x5231ae8) returned 0x3 [0177.481] IWbemClassObject:Get (in: This=0x5231ae8, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.481] IWbemClassObject:Get (in: This=0x5231ae8, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3624\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.481] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3624\"") returned 0x5e [0177.481] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3624\"") returned 0x5e [0177.481] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7f8 [0177.481] SetEvent (hEvent=0x638) returned 1 [0177.481] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x7f8, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.483] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.483] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.483] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227950, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5227950) returned 0x0 [0177.483] WbemDefPath:IUnknown:AddRef (This=0x5227950) returned 0x3 [0177.483] WbemDefPath:IUnknown:Release (This=0x5227950) returned 0x2 [0177.483] WbemDefPath:IWbemPath:SetText (This=0x5227950, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3624\"") returned 0x0 [0177.483] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.483] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.484] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.484] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.484] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.484] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.484] IWbemClassObject:Get (in: This=0x5231ae8, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295c744*=0, plFlavor=0x295c748*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="leechftp.exe", varVal2=0x0), pType=0x295c744*=8, plFlavor=0x295c748*=0) returned 0x0 [0177.484] SysStringByteLen (bstr="leechftp.exe") returned 0x18 [0177.484] SysStringByteLen (bstr="leechftp.exe") returned 0x18 [0177.484] IWbemClassObject:Get (in: This=0x5231ae8, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295c744*=8, plFlavor=0x295c748*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="leechftp.exe", varVal2=0x0), pType=0x295c744*=8, plFlavor=0x295c748*=0) returned 0x0 [0177.484] SysStringByteLen (bstr="leechftp.exe") returned 0x18 [0177.484] SysStringByteLen (bstr="leechftp.exe") returned 0x18 [0177.484] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.484] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x52307c8, puReturned=0x2945c70*=0x1) returned 0x0 [0177.487] IUnknown:QueryInterface (in: This=0x52307c8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x52307c8) returned 0x0 [0177.487] IUnknown:QueryInterface (in: This=0x52307c8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.487] IUnknown:QueryInterface (in: This=0x52307c8, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.487] IUnknown:QueryInterface (in: This=0x52307c8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.487] IUnknown:AddRef (This=0x52307c8) returned 0x3 [0177.487] IUnknown:QueryInterface (in: This=0x52307c8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.487] IUnknown:QueryInterface (in: This=0x52307c8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.488] IUnknown:QueryInterface (in: This=0x52307c8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x52307cc) returned 0x0 [0177.488] IMarshal:GetUnmarshalClass (in: This=0x52307cc, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.488] IUnknown:Release (This=0x52307cc) returned 0x3 [0177.488] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.488] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.488] IUnknown:QueryInterface (in: This=0x52307c8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.488] IUnknown:Release (This=0x52307c8) returned 0x2 [0177.488] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.488] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.488] IUnknown:QueryInterface (in: This=0x52307c8, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x52307c8) returned 0x0 [0177.488] IUnknown:AddRef (This=0x52307c8) returned 0x4 [0177.488] IUnknown:Release (This=0x52307c8) returned 0x3 [0177.489] IUnknown:Release (This=0x52307c8) returned 0x2 [0177.489] CoTaskMemFree (pv=0x51de588) [0177.489] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.489] IUnknown:AddRef (This=0x52307c8) returned 0x3 [0177.489] IWbemClassObject:Get (in: This=0x52307c8, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.489] IWbemClassObject:Get (in: This=0x52307c8, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3632\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.489] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3632\"") returned 0x5e [0177.489] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3632\"") returned 0x5e [0177.489] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7fc [0177.489] SetEvent (hEvent=0x638) returned 1 [0177.489] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x7fc, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.492] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.492] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.492] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227090, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5227090) returned 0x0 [0177.492] WbemDefPath:IUnknown:AddRef (This=0x5227090) returned 0x3 [0177.492] WbemDefPath:IUnknown:Release (This=0x5227090) returned 0x2 [0177.492] WbemDefPath:IWbemPath:SetText (This=0x5227090, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3632\"") returned 0x0 [0177.492] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.492] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.492] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.492] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.492] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.492] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.492] IWbemClassObject:Get (in: This=0x52307c8, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295d01c*=0, plFlavor=0x295d020*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ncftp.exe", varVal2=0x0), pType=0x295d01c*=8, plFlavor=0x295d020*=0) returned 0x0 [0177.492] SysStringByteLen (bstr="ncftp.exe") returned 0x12 [0177.492] SysStringByteLen (bstr="ncftp.exe") returned 0x12 [0177.492] IWbemClassObject:Get (in: This=0x52307c8, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295d01c*=8, plFlavor=0x295d020*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ncftp.exe", varVal2=0x0), pType=0x295d01c*=8, plFlavor=0x295d020*=0) returned 0x0 [0177.492] SysStringByteLen (bstr="ncftp.exe") returned 0x12 [0177.492] SysStringByteLen (bstr="ncftp.exe") returned 0x12 [0177.492] CoTaskMemAlloc (cb=0x4) returned 0x51de638 [0177.493] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de638, puReturned=0x2945c70 | out: apObjects=0x51de638*=0x52322e0, puReturned=0x2945c70*=0x1) returned 0x0 [0177.494] IUnknown:QueryInterface (in: This=0x52322e0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x52322e0) returned 0x0 [0177.494] IUnknown:QueryInterface (in: This=0x52322e0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.494] IUnknown:QueryInterface (in: This=0x52322e0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.494] IUnknown:QueryInterface (in: This=0x52322e0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.494] IUnknown:AddRef (This=0x52322e0) returned 0x3 [0177.494] IUnknown:QueryInterface (in: This=0x52322e0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.494] IUnknown:QueryInterface (in: This=0x52322e0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.494] IUnknown:QueryInterface (in: This=0x52322e0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x52322e4) returned 0x0 [0177.494] IMarshal:GetUnmarshalClass (in: This=0x52322e4, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.494] IUnknown:Release (This=0x52322e4) returned 0x3 [0177.494] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.494] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.494] IUnknown:QueryInterface (in: This=0x52322e0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.494] IUnknown:Release (This=0x52322e0) returned 0x2 [0177.494] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.494] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.494] IUnknown:QueryInterface (in: This=0x52322e0, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x52322e0) returned 0x0 [0177.495] IUnknown:AddRef (This=0x52322e0) returned 0x4 [0177.495] IUnknown:Release (This=0x52322e0) returned 0x3 [0177.495] IUnknown:Release (This=0x52322e0) returned 0x2 [0177.495] CoTaskMemFree (pv=0x51de638) [0177.495] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.495] IUnknown:AddRef (This=0x52322e0) returned 0x3 [0177.495] IWbemClassObject:Get (in: This=0x52322e0, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.495] IWbemClassObject:Get (in: This=0x52322e0, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3640\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.495] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3640\"") returned 0x5e [0177.495] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3640\"") returned 0x5e [0177.495] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x804 [0177.495] SetEvent (hEvent=0x638) returned 1 [0177.495] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x804, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.504] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.504] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.504] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226f40, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5226f40) returned 0x0 [0177.505] WbemDefPath:IUnknown:AddRef (This=0x5226f40) returned 0x3 [0177.505] WbemDefPath:IUnknown:Release (This=0x5226f40) returned 0x2 [0177.505] WbemDefPath:IWbemPath:SetText (This=0x5226f40, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3640\"") returned 0x0 [0177.505] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.505] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.506] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.506] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.507] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.507] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.507] IWbemClassObject:Get (in: This=0x52322e0, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295d8e4*=0, plFlavor=0x295d8e8*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="notepad.exe", varVal2=0x0), pType=0x295d8e4*=8, plFlavor=0x295d8e8*=0) returned 0x0 [0177.507] SysStringByteLen (bstr="notepad.exe") returned 0x16 [0177.507] SysStringByteLen (bstr="notepad.exe") returned 0x16 [0177.507] IWbemClassObject:Get (in: This=0x52322e0, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295d8e4*=8, plFlavor=0x295d8e8*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="notepad.exe", varVal2=0x0), pType=0x295d8e4*=8, plFlavor=0x295d8e8*=0) returned 0x0 [0177.507] SysStringByteLen (bstr="notepad.exe") returned 0x16 [0177.507] SysStringByteLen (bstr="notepad.exe") returned 0x16 [0177.507] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.507] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x5232478, puReturned=0x2945c70*=0x1) returned 0x0 [0177.511] IUnknown:QueryInterface (in: This=0x5232478, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5232478) returned 0x0 [0177.511] IUnknown:QueryInterface (in: This=0x5232478, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.511] IUnknown:QueryInterface (in: This=0x5232478, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.511] IUnknown:QueryInterface (in: This=0x5232478, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.512] IUnknown:AddRef (This=0x5232478) returned 0x3 [0177.512] IUnknown:QueryInterface (in: This=0x5232478, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.512] IUnknown:QueryInterface (in: This=0x5232478, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.512] IUnknown:QueryInterface (in: This=0x5232478, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x523247c) returned 0x0 [0177.512] IMarshal:GetUnmarshalClass (in: This=0x523247c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.512] IUnknown:Release (This=0x523247c) returned 0x3 [0177.512] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.512] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.512] IUnknown:QueryInterface (in: This=0x5232478, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.512] IUnknown:Release (This=0x5232478) returned 0x2 [0177.512] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.512] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.512] IUnknown:QueryInterface (in: This=0x5232478, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5232478) returned 0x0 [0177.512] IUnknown:AddRef (This=0x5232478) returned 0x4 [0177.512] IUnknown:Release (This=0x5232478) returned 0x3 [0177.512] IUnknown:Release (This=0x5232478) returned 0x2 [0177.513] CoTaskMemFree (pv=0x51de588) [0177.513] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.513] IUnknown:AddRef (This=0x5232478) returned 0x3 [0177.513] IWbemClassObject:Get (in: This=0x5232478, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.513] IWbemClassObject:Get (in: This=0x5232478, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3648\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.513] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3648\"") returned 0x5e [0177.513] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3648\"") returned 0x5e [0177.513] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x808 [0177.513] SetEvent (hEvent=0x638) returned 1 [0177.513] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x808, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.517] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.517] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.517] WbemDefPath:IUnknown:QueryInterface (in: This=0x52279c0, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x52279c0) returned 0x0 [0177.517] WbemDefPath:IUnknown:AddRef (This=0x52279c0) returned 0x3 [0177.517] WbemDefPath:IUnknown:Release (This=0x52279c0) returned 0x2 [0177.517] WbemDefPath:IWbemPath:SetText (This=0x52279c0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3648\"") returned 0x0 [0177.517] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.517] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.517] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.517] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.517] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.517] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.517] IWbemClassObject:Get (in: This=0x5232478, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295e1b4*=0, plFlavor=0x295e1b8*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="operamail.exe", varVal2=0x0), pType=0x295e1b4*=8, plFlavor=0x295e1b8*=0) returned 0x0 [0177.517] SysStringByteLen (bstr="operamail.exe") returned 0x1a [0177.517] SysStringByteLen (bstr="operamail.exe") returned 0x1a [0177.517] IWbemClassObject:Get (in: This=0x5232478, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295e1b4*=8, plFlavor=0x295e1b8*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="operamail.exe", varVal2=0x0), pType=0x295e1b4*=8, plFlavor=0x295e1b8*=0) returned 0x0 [0177.517] SysStringByteLen (bstr="operamail.exe") returned 0x1a [0177.517] SysStringByteLen (bstr="operamail.exe") returned 0x1a [0177.518] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.518] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x5230c90, puReturned=0x2945c70*=0x1) returned 0x0 [0177.522] IUnknown:QueryInterface (in: This=0x5230c90, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5230c90) returned 0x0 [0177.522] IUnknown:QueryInterface (in: This=0x5230c90, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.522] IUnknown:QueryInterface (in: This=0x5230c90, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.522] IUnknown:QueryInterface (in: This=0x5230c90, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.523] IUnknown:AddRef (This=0x5230c90) returned 0x3 [0177.523] IUnknown:QueryInterface (in: This=0x5230c90, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.523] IUnknown:QueryInterface (in: This=0x5230c90, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.523] IUnknown:QueryInterface (in: This=0x5230c90, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x5230c94) returned 0x0 [0177.523] IMarshal:GetUnmarshalClass (in: This=0x5230c94, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.523] IUnknown:Release (This=0x5230c94) returned 0x3 [0177.523] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.523] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.523] IUnknown:QueryInterface (in: This=0x5230c90, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.523] IUnknown:Release (This=0x5230c90) returned 0x2 [0177.523] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.523] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.523] IUnknown:QueryInterface (in: This=0x5230c90, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5230c90) returned 0x0 [0177.523] IUnknown:AddRef (This=0x5230c90) returned 0x4 [0177.523] IUnknown:Release (This=0x5230c90) returned 0x3 [0177.523] IUnknown:Release (This=0x5230c90) returned 0x2 [0177.523] CoTaskMemFree (pv=0x51de588) [0177.524] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.524] IUnknown:AddRef (This=0x5230c90) returned 0x3 [0177.524] IWbemClassObject:Get (in: This=0x5230c90, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.524] IWbemClassObject:Get (in: This=0x5230c90, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3656\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.524] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3656\"") returned 0x5e [0177.524] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3656\"") returned 0x5e [0177.524] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x80c [0177.524] SetEvent (hEvent=0x638) returned 1 [0177.524] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x80c, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.528] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.528] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227800, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5227800) returned 0x0 [0177.528] WbemDefPath:IUnknown:AddRef (This=0x5227800) returned 0x3 [0177.528] WbemDefPath:IUnknown:Release (This=0x5227800) returned 0x2 [0177.528] WbemDefPath:IWbemPath:SetText (This=0x5227800, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3656\"") returned 0x0 [0177.528] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.528] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.528] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.528] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.528] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.528] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.528] IWbemClassObject:Get (in: This=0x5230c90, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295ea8c*=0, plFlavor=0x295ea90*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="outlook.exe", varVal2=0x0), pType=0x295ea8c*=8, plFlavor=0x295ea90*=0) returned 0x0 [0177.528] SysStringByteLen (bstr="outlook.exe") returned 0x16 [0177.528] SysStringByteLen (bstr="outlook.exe") returned 0x16 [0177.528] IWbemClassObject:Get (in: This=0x5230c90, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295ea8c*=8, plFlavor=0x295ea90*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="outlook.exe", varVal2=0x0), pType=0x295ea8c*=8, plFlavor=0x295ea90*=0) returned 0x0 [0177.529] SysStringByteLen (bstr="outlook.exe") returned 0x16 [0177.529] SysStringByteLen (bstr="outlook.exe") returned 0x16 [0177.529] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.529] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x5231c80, puReturned=0x2945c70*=0x1) returned 0x0 [0177.533] IUnknown:QueryInterface (in: This=0x5231c80, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5231c80) returned 0x0 [0177.533] IUnknown:QueryInterface (in: This=0x5231c80, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.533] IUnknown:QueryInterface (in: This=0x5231c80, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.533] IUnknown:QueryInterface (in: This=0x5231c80, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.533] IUnknown:AddRef (This=0x5231c80) returned 0x3 [0177.533] IUnknown:QueryInterface (in: This=0x5231c80, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.533] IUnknown:QueryInterface (in: This=0x5231c80, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.533] IUnknown:QueryInterface (in: This=0x5231c80, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x5231c84) returned 0x0 [0177.533] IMarshal:GetUnmarshalClass (in: This=0x5231c84, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.533] IUnknown:Release (This=0x5231c84) returned 0x3 [0177.533] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.533] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.533] IUnknown:QueryInterface (in: This=0x5231c80, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.533] IUnknown:Release (This=0x5231c80) returned 0x2 [0177.533] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.533] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.533] IUnknown:QueryInterface (in: This=0x5231c80, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5231c80) returned 0x0 [0177.533] IUnknown:AddRef (This=0x5231c80) returned 0x4 [0177.533] IUnknown:Release (This=0x5231c80) returned 0x3 [0177.533] IUnknown:Release (This=0x5231c80) returned 0x2 [0177.533] CoTaskMemFree (pv=0x51de588) [0177.534] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.534] IUnknown:AddRef (This=0x5231c80) returned 0x3 [0177.534] IWbemClassObject:Get (in: This=0x5231c80, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.534] IWbemClassObject:Get (in: This=0x5231c80, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3664\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.534] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3664\"") returned 0x5e [0177.534] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3664\"") returned 0x5e [0177.534] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x810 [0177.534] SetEvent (hEvent=0x638) returned 1 [0177.534] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x810, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.536] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.536] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.537] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227a30, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5227a30) returned 0x0 [0177.537] WbemDefPath:IUnknown:AddRef (This=0x5227a30) returned 0x3 [0177.537] WbemDefPath:IUnknown:Release (This=0x5227a30) returned 0x2 [0177.537] WbemDefPath:IWbemPath:SetText (This=0x5227a30, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3664\"") returned 0x0 [0177.537] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.537] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.537] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.537] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.537] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.537] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.537] IWbemClassObject:Get (in: This=0x5231c80, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295f35c*=0, plFlavor=0x295f360*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="pidgin.exe", varVal2=0x0), pType=0x295f35c*=8, plFlavor=0x295f360*=0) returned 0x0 [0177.537] SysStringByteLen (bstr="pidgin.exe") returned 0x14 [0177.537] SysStringByteLen (bstr="pidgin.exe") returned 0x14 [0177.537] IWbemClassObject:Get (in: This=0x5231c80, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295f35c*=8, plFlavor=0x295f360*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="pidgin.exe", varVal2=0x0), pType=0x295f35c*=8, plFlavor=0x295f360*=0) returned 0x0 [0177.537] SysStringByteLen (bstr="pidgin.exe") returned 0x14 [0177.537] SysStringByteLen (bstr="pidgin.exe") returned 0x14 [0177.537] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.537] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x5231158, puReturned=0x2945c70*=0x1) returned 0x0 [0177.539] IUnknown:QueryInterface (in: This=0x5231158, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5231158) returned 0x0 [0177.539] IUnknown:QueryInterface (in: This=0x5231158, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.539] IUnknown:QueryInterface (in: This=0x5231158, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.539] IUnknown:QueryInterface (in: This=0x5231158, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.539] IUnknown:AddRef (This=0x5231158) returned 0x3 [0177.540] IUnknown:QueryInterface (in: This=0x5231158, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.540] IUnknown:QueryInterface (in: This=0x5231158, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.540] IUnknown:QueryInterface (in: This=0x5231158, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x523115c) returned 0x0 [0177.540] IMarshal:GetUnmarshalClass (in: This=0x523115c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.540] IUnknown:Release (This=0x523115c) returned 0x3 [0177.540] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.540] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.540] IUnknown:QueryInterface (in: This=0x5231158, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.540] IUnknown:Release (This=0x5231158) returned 0x2 [0177.540] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.540] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.540] IUnknown:QueryInterface (in: This=0x5231158, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5231158) returned 0x0 [0177.540] IUnknown:AddRef (This=0x5231158) returned 0x4 [0177.540] IUnknown:Release (This=0x5231158) returned 0x3 [0177.540] IUnknown:Release (This=0x5231158) returned 0x2 [0177.540] CoTaskMemFree (pv=0x51de588) [0177.540] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.540] IUnknown:AddRef (This=0x5231158) returned 0x3 [0177.540] IWbemClassObject:Get (in: This=0x5231158, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.540] IWbemClassObject:Get (in: This=0x5231158, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3672\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.540] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3672\"") returned 0x5e [0177.540] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3672\"") returned 0x5e [0177.541] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x814 [0177.541] SetEvent (hEvent=0x638) returned 1 [0177.541] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x814, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.543] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.543] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.543] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226fb0, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5226fb0) returned 0x0 [0177.543] WbemDefPath:IUnknown:AddRef (This=0x5226fb0) returned 0x3 [0177.543] WbemDefPath:IUnknown:Release (This=0x5226fb0) returned 0x2 [0177.543] WbemDefPath:IWbemPath:SetText (This=0x5226fb0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3672\"") returned 0x0 [0177.543] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.543] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.543] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.543] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.543] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.543] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.543] IWbemClassObject:Get (in: This=0x5231158, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295fc2c*=0, plFlavor=0x295fc30*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="scriptftp.exe", varVal2=0x0), pType=0x295fc2c*=8, plFlavor=0x295fc30*=0) returned 0x0 [0177.543] SysStringByteLen (bstr="scriptftp.exe") returned 0x1a [0177.543] SysStringByteLen (bstr="scriptftp.exe") returned 0x1a [0177.543] IWbemClassObject:Get (in: This=0x5231158, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295fc2c*=8, plFlavor=0x295fc30*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="scriptftp.exe", varVal2=0x0), pType=0x295fc2c*=8, plFlavor=0x295fc30*=0) returned 0x0 [0177.543] SysStringByteLen (bstr="scriptftp.exe") returned 0x1a [0177.543] SysStringByteLen (bstr="scriptftp.exe") returned 0x1a [0177.543] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.544] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x5230960, puReturned=0x2945c70*=0x1) returned 0x0 [0177.545] IUnknown:QueryInterface (in: This=0x5230960, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5230960) returned 0x0 [0177.545] IUnknown:QueryInterface (in: This=0x5230960, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.545] IUnknown:QueryInterface (in: This=0x5230960, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.545] IUnknown:QueryInterface (in: This=0x5230960, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.545] IUnknown:AddRef (This=0x5230960) returned 0x3 [0177.545] IUnknown:QueryInterface (in: This=0x5230960, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.545] IUnknown:QueryInterface (in: This=0x5230960, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.545] IUnknown:QueryInterface (in: This=0x5230960, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x5230964) returned 0x0 [0177.546] IMarshal:GetUnmarshalClass (in: This=0x5230964, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.546] IUnknown:Release (This=0x5230964) returned 0x3 [0177.546] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.546] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.546] IUnknown:QueryInterface (in: This=0x5230960, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.546] IUnknown:Release (This=0x5230960) returned 0x2 [0177.546] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.546] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.546] IUnknown:QueryInterface (in: This=0x5230960, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5230960) returned 0x0 [0177.546] IUnknown:AddRef (This=0x5230960) returned 0x4 [0177.546] IUnknown:Release (This=0x5230960) returned 0x3 [0177.546] IUnknown:Release (This=0x5230960) returned 0x2 [0177.546] CoTaskMemFree (pv=0x51de588) [0177.546] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.546] IUnknown:AddRef (This=0x5230960) returned 0x3 [0177.546] IWbemClassObject:Get (in: This=0x5230960, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.546] IWbemClassObject:Get (in: This=0x5230960, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3680\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.546] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3680\"") returned 0x5e [0177.546] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3680\"") returned 0x5e [0177.546] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x818 [0177.546] SetEvent (hEvent=0x638) returned 1 [0177.547] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x818, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.549] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.549] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.549] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227020, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5227020) returned 0x0 [0177.549] WbemDefPath:IUnknown:AddRef (This=0x5227020) returned 0x3 [0177.549] WbemDefPath:IUnknown:Release (This=0x5227020) returned 0x2 [0177.549] WbemDefPath:IWbemPath:SetText (This=0x5227020, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3680\"") returned 0x0 [0177.549] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.549] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.549] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.549] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.549] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.550] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.550] IWbemClassObject:Get (in: This=0x5230960, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2960504*=0, plFlavor=0x2960508*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="skype.exe", varVal2=0x0), pType=0x2960504*=8, plFlavor=0x2960508*=0) returned 0x0 [0177.550] SysStringByteLen (bstr="skype.exe") returned 0x12 [0177.550] SysStringByteLen (bstr="skype.exe") returned 0x12 [0177.550] IWbemClassObject:Get (in: This=0x5230960, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2960504*=8, plFlavor=0x2960508*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="skype.exe", varVal2=0x0), pType=0x2960504*=8, plFlavor=0x2960508*=0) returned 0x0 [0177.550] SysStringByteLen (bstr="skype.exe") returned 0x12 [0177.550] SysStringByteLen (bstr="skype.exe") returned 0x12 [0177.550] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.550] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x5231e18, puReturned=0x2945c70*=0x1) returned 0x0 [0177.554] IUnknown:QueryInterface (in: This=0x5231e18, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5231e18) returned 0x0 [0177.554] IUnknown:QueryInterface (in: This=0x5231e18, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.554] IUnknown:QueryInterface (in: This=0x5231e18, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.554] IUnknown:QueryInterface (in: This=0x5231e18, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.554] IUnknown:AddRef (This=0x5231e18) returned 0x3 [0177.554] IUnknown:QueryInterface (in: This=0x5231e18, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.554] IUnknown:QueryInterface (in: This=0x5231e18, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.554] IUnknown:QueryInterface (in: This=0x5231e18, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x5231e1c) returned 0x0 [0177.554] IMarshal:GetUnmarshalClass (in: This=0x5231e1c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.554] IUnknown:Release (This=0x5231e1c) returned 0x3 [0177.554] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.554] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.554] IUnknown:QueryInterface (in: This=0x5231e18, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.554] IUnknown:Release (This=0x5231e18) returned 0x2 [0177.554] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.555] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.555] IUnknown:QueryInterface (in: This=0x5231e18, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5231e18) returned 0x0 [0177.555] IUnknown:AddRef (This=0x5231e18) returned 0x4 [0177.555] IUnknown:Release (This=0x5231e18) returned 0x3 [0177.555] IUnknown:Release (This=0x5231e18) returned 0x2 [0177.555] CoTaskMemFree (pv=0x51de588) [0177.555] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.555] IUnknown:AddRef (This=0x5231e18) returned 0x3 [0177.555] IWbemClassObject:Get (in: This=0x5231e18, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.555] IWbemClassObject:Get (in: This=0x5231e18, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3688\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.555] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3688\"") returned 0x5e [0177.555] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3688\"") returned 0x5e [0177.555] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x81c [0177.555] SetEvent (hEvent=0x638) returned 1 [0177.555] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x81c, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.557] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.557] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.557] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227560, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5227560) returned 0x0 [0177.557] WbemDefPath:IUnknown:AddRef (This=0x5227560) returned 0x3 [0177.557] WbemDefPath:IUnknown:Release (This=0x5227560) returned 0x2 [0177.557] WbemDefPath:IWbemPath:SetText (This=0x5227560, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3688\"") returned 0x0 [0177.557] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.557] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.558] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.558] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.558] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.558] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.558] IWbemClassObject:Get (in: This=0x5231e18, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2960dcc*=0, plFlavor=0x2960dd0*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="smartftp.exe", varVal2=0x0), pType=0x2960dcc*=8, plFlavor=0x2960dd0*=0) returned 0x0 [0177.558] SysStringByteLen (bstr="smartftp.exe") returned 0x18 [0177.558] SysStringByteLen (bstr="smartftp.exe") returned 0x18 [0177.558] IWbemClassObject:Get (in: This=0x5231e18, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2960dcc*=8, plFlavor=0x2960dd0*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="smartftp.exe", varVal2=0x0), pType=0x2960dcc*=8, plFlavor=0x2960dd0*=0) returned 0x0 [0177.558] SysStringByteLen (bstr="smartftp.exe") returned 0x18 [0177.558] SysStringByteLen (bstr="smartftp.exe") returned 0x18 [0177.558] CoTaskMemAlloc (cb=0x4) returned 0x51de638 [0177.558] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de638, puReturned=0x2945c70 | out: apObjects=0x51de638*=0x5231620, puReturned=0x2945c70*=0x1) returned 0x0 [0177.559] IUnknown:QueryInterface (in: This=0x5231620, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5231620) returned 0x0 [0177.559] IUnknown:QueryInterface (in: This=0x5231620, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.559] IUnknown:QueryInterface (in: This=0x5231620, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.559] IUnknown:QueryInterface (in: This=0x5231620, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.559] IUnknown:AddRef (This=0x5231620) returned 0x3 [0177.559] IUnknown:QueryInterface (in: This=0x5231620, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.559] IUnknown:QueryInterface (in: This=0x5231620, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.559] IUnknown:QueryInterface (in: This=0x5231620, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x5231624) returned 0x0 [0177.559] IMarshal:GetUnmarshalClass (in: This=0x5231624, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.560] IUnknown:Release (This=0x5231624) returned 0x3 [0177.560] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.560] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.560] IUnknown:QueryInterface (in: This=0x5231620, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.560] IUnknown:Release (This=0x5231620) returned 0x2 [0177.560] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.560] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.560] IUnknown:QueryInterface (in: This=0x5231620, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5231620) returned 0x0 [0177.560] IUnknown:AddRef (This=0x5231620) returned 0x4 [0177.560] IUnknown:Release (This=0x5231620) returned 0x3 [0177.560] IUnknown:Release (This=0x5231620) returned 0x2 [0177.560] CoTaskMemFree (pv=0x51de638) [0177.560] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.560] IUnknown:AddRef (This=0x5231620) returned 0x3 [0177.560] IWbemClassObject:Get (in: This=0x5231620, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.560] IWbemClassObject:Get (in: This=0x5231620, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3696\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.560] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3696\"") returned 0x5e [0177.560] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3696\"") returned 0x5e [0177.560] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x820 [0177.560] SetEvent (hEvent=0x638) returned 1 [0177.561] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x820, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.567] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.567] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.567] WbemDefPath:IUnknown:QueryInterface (in: This=0x52276b0, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x52276b0) returned 0x0 [0177.567] WbemDefPath:IUnknown:AddRef (This=0x52276b0) returned 0x3 [0177.567] WbemDefPath:IUnknown:Release (This=0x52276b0) returned 0x2 [0177.567] WbemDefPath:IWbemPath:SetText (This=0x52276b0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3696\"") returned 0x0 [0177.567] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.567] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.567] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.567] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.567] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.567] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.568] IWbemClassObject:Get (in: This=0x5231620, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29616a4*=0, plFlavor=0x29616a8*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="thunderbird.exe", varVal2=0x0), pType=0x29616a4*=8, plFlavor=0x29616a8*=0) returned 0x0 [0177.568] SysStringByteLen (bstr="thunderbird.exe") returned 0x1e [0177.568] SysStringByteLen (bstr="thunderbird.exe") returned 0x1e [0177.568] IWbemClassObject:Get (in: This=0x5231620, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29616a4*=8, plFlavor=0x29616a8*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="thunderbird.exe", varVal2=0x0), pType=0x29616a4*=8, plFlavor=0x29616a8*=0) returned 0x0 [0177.568] SysStringByteLen (bstr="thunderbird.exe") returned 0x1e [0177.568] SysStringByteLen (bstr="thunderbird.exe") returned 0x1e [0177.568] CoTaskMemAlloc (cb=0x4) returned 0x51de638 [0177.568] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de638, puReturned=0x2945c70 | out: apObjects=0x51de638*=0x5231488, puReturned=0x2945c70*=0x1) returned 0x0 [0177.570] IUnknown:QueryInterface (in: This=0x5231488, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5231488) returned 0x0 [0177.571] IUnknown:QueryInterface (in: This=0x5231488, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.571] IUnknown:QueryInterface (in: This=0x5231488, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.571] IUnknown:QueryInterface (in: This=0x5231488, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.571] IUnknown:AddRef (This=0x5231488) returned 0x3 [0177.571] IUnknown:QueryInterface (in: This=0x5231488, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.571] IUnknown:QueryInterface (in: This=0x5231488, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.571] IUnknown:QueryInterface (in: This=0x5231488, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x523148c) returned 0x0 [0177.571] IMarshal:GetUnmarshalClass (in: This=0x523148c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.571] IUnknown:Release (This=0x523148c) returned 0x3 [0177.571] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.571] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.571] IUnknown:QueryInterface (in: This=0x5231488, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.572] IUnknown:Release (This=0x5231488) returned 0x2 [0177.572] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.572] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.572] IUnknown:QueryInterface (in: This=0x5231488, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5231488) returned 0x0 [0177.572] IUnknown:AddRef (This=0x5231488) returned 0x4 [0177.572] IUnknown:Release (This=0x5231488) returned 0x3 [0177.572] IUnknown:Release (This=0x5231488) returned 0x2 [0177.572] CoTaskMemFree (pv=0x51de638) [0177.572] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.572] IUnknown:AddRef (This=0x5231488) returned 0x3 [0177.572] IWbemClassObject:Get (in: This=0x5231488, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.572] IWbemClassObject:Get (in: This=0x5231488, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3704\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.573] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3704\"") returned 0x5e [0177.573] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3704\"") returned 0x5e [0177.573] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x824 [0177.573] SetEvent (hEvent=0x638) returned 1 [0177.573] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x824, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.576] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.576] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.576] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227720, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5227720) returned 0x0 [0177.576] WbemDefPath:IUnknown:AddRef (This=0x5227720) returned 0x3 [0177.576] WbemDefPath:IUnknown:Release (This=0x5227720) returned 0x2 [0177.576] WbemDefPath:IWbemPath:SetText (This=0x5227720, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3704\"") returned 0x0 [0177.577] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.577] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.577] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.577] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.577] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.577] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.577] IWbemClassObject:Get (in: This=0x5231488, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2961f84*=0, plFlavor=0x2961f88*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="trillian.exe", varVal2=0x0), pType=0x2961f84*=8, plFlavor=0x2961f88*=0) returned 0x0 [0177.578] SysStringByteLen (bstr="trillian.exe") returned 0x18 [0177.578] SysStringByteLen (bstr="trillian.exe") returned 0x18 [0177.578] IWbemClassObject:Get (in: This=0x5231488, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2961f84*=8, plFlavor=0x2961f88*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="trillian.exe", varVal2=0x0), pType=0x2961f84*=8, plFlavor=0x2961f88*=0) returned 0x0 [0177.578] SysStringByteLen (bstr="trillian.exe") returned 0x18 [0177.578] SysStringByteLen (bstr="trillian.exe") returned 0x18 [0177.578] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.578] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x5231fb0, puReturned=0x2945c70*=0x1) returned 0x0 [0177.579] IUnknown:QueryInterface (in: This=0x5231fb0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5231fb0) returned 0x0 [0177.579] IUnknown:QueryInterface (in: This=0x5231fb0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.579] IUnknown:QueryInterface (in: This=0x5231fb0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.579] IUnknown:QueryInterface (in: This=0x5231fb0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.579] IUnknown:AddRef (This=0x5231fb0) returned 0x3 [0177.579] IUnknown:QueryInterface (in: This=0x5231fb0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.579] IUnknown:QueryInterface (in: This=0x5231fb0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.579] IUnknown:QueryInterface (in: This=0x5231fb0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x5231fb4) returned 0x0 [0177.579] IMarshal:GetUnmarshalClass (in: This=0x5231fb4, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.579] IUnknown:Release (This=0x5231fb4) returned 0x3 [0177.579] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.579] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.579] IUnknown:QueryInterface (in: This=0x5231fb0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.580] IUnknown:Release (This=0x5231fb0) returned 0x2 [0177.580] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.580] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.580] IUnknown:QueryInterface (in: This=0x5231fb0, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5231fb0) returned 0x0 [0177.580] IUnknown:AddRef (This=0x5231fb0) returned 0x4 [0177.580] IUnknown:Release (This=0x5231fb0) returned 0x3 [0177.580] IUnknown:Release (This=0x5231fb0) returned 0x2 [0177.580] CoTaskMemFree (pv=0x51de588) [0177.580] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.580] IUnknown:AddRef (This=0x5231fb0) returned 0x3 [0177.580] IWbemClassObject:Get (in: This=0x5231fb0, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.580] IWbemClassObject:Get (in: This=0x5231fb0, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3712\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.580] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3712\"") returned 0x5e [0177.580] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3712\"") returned 0x5e [0177.580] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x828 [0177.580] SetEvent (hEvent=0x638) returned 1 [0177.580] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x828, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.583] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.583] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.583] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227c60, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5227c60) returned 0x0 [0177.583] WbemDefPath:IUnknown:AddRef (This=0x5227c60) returned 0x3 [0177.583] WbemDefPath:IUnknown:Release (This=0x5227c60) returned 0x2 [0177.584] WbemDefPath:IWbemPath:SetText (This=0x5227c60, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3712\"") returned 0x0 [0177.584] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.584] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.584] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.584] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.584] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.584] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.584] IWbemClassObject:Get (in: This=0x5231fb0, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x296285c*=0, plFlavor=0x2962860*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="webdrive.exe", varVal2=0x0), pType=0x296285c*=8, plFlavor=0x2962860*=0) returned 0x0 [0177.584] SysStringByteLen (bstr="webdrive.exe") returned 0x18 [0177.584] SysStringByteLen (bstr="webdrive.exe") returned 0x18 [0177.584] IWbemClassObject:Get (in: This=0x5231fb0, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x296285c*=8, plFlavor=0x2962860*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="webdrive.exe", varVal2=0x0), pType=0x296285c*=8, plFlavor=0x2962860*=0) returned 0x0 [0177.584] SysStringByteLen (bstr="webdrive.exe") returned 0x18 [0177.584] SysStringByteLen (bstr="webdrive.exe") returned 0x18 [0177.584] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.584] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x5232148, puReturned=0x2945c70*=0x1) returned 0x0 [0177.589] IUnknown:QueryInterface (in: This=0x5232148, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5232148) returned 0x0 [0177.590] IUnknown:QueryInterface (in: This=0x5232148, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.590] IUnknown:QueryInterface (in: This=0x5232148, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.590] IUnknown:QueryInterface (in: This=0x5232148, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.590] IUnknown:AddRef (This=0x5232148) returned 0x3 [0177.590] IUnknown:QueryInterface (in: This=0x5232148, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.590] IUnknown:QueryInterface (in: This=0x5232148, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.590] IUnknown:QueryInterface (in: This=0x5232148, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x523214c) returned 0x0 [0177.590] IMarshal:GetUnmarshalClass (in: This=0x523214c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.590] IUnknown:Release (This=0x523214c) returned 0x3 [0177.590] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.590] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.591] IUnknown:QueryInterface (in: This=0x5232148, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.591] IUnknown:Release (This=0x5232148) returned 0x2 [0177.591] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.591] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.591] IUnknown:QueryInterface (in: This=0x5232148, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5232148) returned 0x0 [0177.591] IUnknown:AddRef (This=0x5232148) returned 0x4 [0177.591] IUnknown:Release (This=0x5232148) returned 0x3 [0177.591] IUnknown:Release (This=0x5232148) returned 0x2 [0177.591] CoTaskMemFree (pv=0x51de588) [0177.591] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.591] IUnknown:AddRef (This=0x5232148) returned 0x3 [0177.591] IWbemClassObject:Get (in: This=0x5232148, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.591] IWbemClassObject:Get (in: This=0x5232148, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3720\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.591] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3720\"") returned 0x5e [0177.591] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3720\"") returned 0x5e [0177.592] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x82c [0177.592] SetEvent (hEvent=0x638) returned 1 [0177.592] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x82c, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.595] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.595] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.595] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227b80, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5227b80) returned 0x0 [0177.595] WbemDefPath:IUnknown:AddRef (This=0x5227b80) returned 0x3 [0177.595] WbemDefPath:IUnknown:Release (This=0x5227b80) returned 0x2 [0177.595] WbemDefPath:IWbemPath:SetText (This=0x5227b80, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3720\"") returned 0x0 [0177.595] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.595] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.595] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.595] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.596] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.596] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.596] IWbemClassObject:Get (in: This=0x5232148, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2963134*=0, plFlavor=0x2963138*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="whatsapp.exe", varVal2=0x0), pType=0x2963134*=8, plFlavor=0x2963138*=0) returned 0x0 [0177.596] SysStringByteLen (bstr="whatsapp.exe") returned 0x18 [0177.596] SysStringByteLen (bstr="whatsapp.exe") returned 0x18 [0177.596] IWbemClassObject:Get (in: This=0x5232148, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2963134*=8, plFlavor=0x2963138*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="whatsapp.exe", varVal2=0x0), pType=0x2963134*=8, plFlavor=0x2963138*=0) returned 0x0 [0177.596] SysStringByteLen (bstr="whatsapp.exe") returned 0x18 [0177.596] SysStringByteLen (bstr="whatsapp.exe") returned 0x18 [0177.596] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.596] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x5230fc0, puReturned=0x2945c70*=0x1) returned 0x0 [0177.601] IUnknown:QueryInterface (in: This=0x5230fc0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5230fc0) returned 0x0 [0177.601] IUnknown:QueryInterface (in: This=0x5230fc0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.601] IUnknown:QueryInterface (in: This=0x5230fc0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.601] IUnknown:QueryInterface (in: This=0x5230fc0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.601] IUnknown:AddRef (This=0x5230fc0) returned 0x3 [0177.601] IUnknown:QueryInterface (in: This=0x5230fc0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.601] IUnknown:QueryInterface (in: This=0x5230fc0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.601] IUnknown:QueryInterface (in: This=0x5230fc0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x5230fc4) returned 0x0 [0177.601] IMarshal:GetUnmarshalClass (in: This=0x5230fc4, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.602] IUnknown:Release (This=0x5230fc4) returned 0x3 [0177.602] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.602] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.602] IUnknown:QueryInterface (in: This=0x5230fc0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.602] IUnknown:Release (This=0x5230fc0) returned 0x2 [0177.602] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.602] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.602] IUnknown:QueryInterface (in: This=0x5230fc0, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5230fc0) returned 0x0 [0177.602] IUnknown:AddRef (This=0x5230fc0) returned 0x4 [0177.602] IUnknown:Release (This=0x5230fc0) returned 0x3 [0177.602] IUnknown:Release (This=0x5230fc0) returned 0x2 [0177.602] CoTaskMemFree (pv=0x51de588) [0177.602] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.602] IUnknown:AddRef (This=0x5230fc0) returned 0x3 [0177.602] IWbemClassObject:Get (in: This=0x5230fc0, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.602] IWbemClassObject:Get (in: This=0x5230fc0, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3728\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.602] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3728\"") returned 0x5e [0177.602] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3728\"") returned 0x5e [0177.603] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x830 [0177.603] SetEvent (hEvent=0x638) returned 1 [0177.603] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x830, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.605] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.605] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227b10, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5227b10) returned 0x0 [0177.606] WbemDefPath:IUnknown:AddRef (This=0x5227b10) returned 0x3 [0177.606] WbemDefPath:IUnknown:Release (This=0x5227b10) returned 0x2 [0177.606] WbemDefPath:IWbemPath:SetText (This=0x5227b10, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3728\"") returned 0x0 [0177.606] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.606] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.606] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.606] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.606] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.606] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.606] IWbemClassObject:Get (in: This=0x5230fc0, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2963a0c*=0, plFlavor=0x2963a10*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="winscp.exe", varVal2=0x0), pType=0x2963a0c*=8, plFlavor=0x2963a10*=0) returned 0x0 [0177.606] SysStringByteLen (bstr="winscp.exe") returned 0x14 [0177.606] SysStringByteLen (bstr="winscp.exe") returned 0x14 [0177.606] IWbemClassObject:Get (in: This=0x5230fc0, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2963a0c*=8, plFlavor=0x2963a10*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="winscp.exe", varVal2=0x0), pType=0x2963a0c*=8, plFlavor=0x2963a10*=0) returned 0x0 [0177.606] SysStringByteLen (bstr="winscp.exe") returned 0x14 [0177.606] SysStringByteLen (bstr="winscp.exe") returned 0x14 [0177.606] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.606] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x5231950, puReturned=0x2945c70*=0x1) returned 0x0 [0177.608] IUnknown:QueryInterface (in: This=0x5231950, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x5231950) returned 0x0 [0177.608] IUnknown:QueryInterface (in: This=0x5231950, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.608] IUnknown:QueryInterface (in: This=0x5231950, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.608] IUnknown:QueryInterface (in: This=0x5231950, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.608] IUnknown:AddRef (This=0x5231950) returned 0x3 [0177.608] IUnknown:QueryInterface (in: This=0x5231950, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.608] IUnknown:QueryInterface (in: This=0x5231950, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.608] IUnknown:QueryInterface (in: This=0x5231950, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x5231954) returned 0x0 [0177.608] IMarshal:GetUnmarshalClass (in: This=0x5231954, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.608] IUnknown:Release (This=0x5231954) returned 0x3 [0177.609] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.611] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.611] IUnknown:QueryInterface (in: This=0x5231950, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.611] IUnknown:Release (This=0x5231950) returned 0x2 [0177.611] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.611] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.611] IUnknown:QueryInterface (in: This=0x5231950, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x5231950) returned 0x0 [0177.611] IUnknown:AddRef (This=0x5231950) returned 0x4 [0177.611] IUnknown:Release (This=0x5231950) returned 0x3 [0177.611] IUnknown:Release (This=0x5231950) returned 0x2 [0177.611] CoTaskMemFree (pv=0x51de588) [0177.611] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.611] IUnknown:AddRef (This=0x5231950) returned 0x3 [0177.611] IWbemClassObject:Get (in: This=0x5231950, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.612] IWbemClassObject:Get (in: This=0x5231950, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3736\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.612] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3736\"") returned 0x5e [0177.612] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3736\"") returned 0x5e [0177.612] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x834 [0177.612] SetEvent (hEvent=0x638) returned 1 [0177.612] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x834, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.615] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.615] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227bf0, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5227bf0) returned 0x0 [0177.615] WbemDefPath:IUnknown:AddRef (This=0x5227bf0) returned 0x3 [0177.615] WbemDefPath:IUnknown:Release (This=0x5227bf0) returned 0x2 [0177.615] WbemDefPath:IWbemPath:SetText (This=0x5227bf0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3736\"") returned 0x0 [0177.616] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.616] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.616] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.616] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.616] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.616] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.616] IWbemClassObject:Get (in: This=0x5231950, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29642dc*=0, plFlavor=0x29642e0*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="yahoomessenger.exe", varVal2=0x0), pType=0x29642dc*=8, plFlavor=0x29642e0*=0) returned 0x0 [0177.616] SysStringByteLen (bstr="yahoomessenger.exe") returned 0x24 [0177.616] SysStringByteLen (bstr="yahoomessenger.exe") returned 0x24 [0177.616] IWbemClassObject:Get (in: This=0x5231950, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29642dc*=8, plFlavor=0x29642e0*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="yahoomessenger.exe", varVal2=0x0), pType=0x29642dc*=8, plFlavor=0x29642e0*=0) returned 0x0 [0177.616] SysStringByteLen (bstr="yahoomessenger.exe") returned 0x24 [0177.616] SysStringByteLen (bstr="yahoomessenger.exe") returned 0x24 [0177.616] CoTaskMemAlloc (cb=0x4) returned 0x51de638 [0177.616] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de638, puReturned=0x2945c70 | out: apObjects=0x51de638*=0x523e630, puReturned=0x2945c70*=0x1) returned 0x0 [0177.618] IUnknown:QueryInterface (in: This=0x523e630, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x523e630) returned 0x0 [0177.618] IUnknown:QueryInterface (in: This=0x523e630, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.618] IUnknown:QueryInterface (in: This=0x523e630, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.618] IUnknown:QueryInterface (in: This=0x523e630, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.618] IUnknown:AddRef (This=0x523e630) returned 0x3 [0177.618] IUnknown:QueryInterface (in: This=0x523e630, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.618] IUnknown:QueryInterface (in: This=0x523e630, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.618] IUnknown:QueryInterface (in: This=0x523e630, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x523e634) returned 0x0 [0177.618] IMarshal:GetUnmarshalClass (in: This=0x523e634, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.618] IUnknown:Release (This=0x523e634) returned 0x3 [0177.618] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.618] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.618] IUnknown:QueryInterface (in: This=0x523e630, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.618] IUnknown:Release (This=0x523e630) returned 0x2 [0177.619] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.619] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.619] IUnknown:QueryInterface (in: This=0x523e630, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x523e630) returned 0x0 [0177.619] IUnknown:AddRef (This=0x523e630) returned 0x4 [0177.619] IUnknown:Release (This=0x523e630) returned 0x3 [0177.619] IUnknown:Release (This=0x523e630) returned 0x2 [0177.619] CoTaskMemFree (pv=0x51de638) [0177.619] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.619] IUnknown:AddRef (This=0x523e630) returned 0x3 [0177.619] IWbemClassObject:Get (in: This=0x523e630, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.619] IWbemClassObject:Get (in: This=0x523e630, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3744\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.619] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3744\"") returned 0x5e [0177.619] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3744\"") returned 0x5e [0177.619] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x838 [0177.619] SetEvent (hEvent=0x638) returned 1 [0177.619] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x838, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.623] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.623] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.623] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240068, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5240068) returned 0x0 [0177.624] WbemDefPath:IUnknown:AddRef (This=0x5240068) returned 0x3 [0177.624] WbemDefPath:IUnknown:Release (This=0x5240068) returned 0x2 [0177.624] WbemDefPath:IWbemPath:SetText (This=0x5240068, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3744\"") returned 0x0 [0177.624] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.624] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.624] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.624] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.624] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.624] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.624] IWbemClassObject:Get (in: This=0x523e630, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2964bcc*=0, plFlavor=0x2964bd0*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="active-charge.exe", varVal2=0x0), pType=0x2964bcc*=8, plFlavor=0x2964bd0*=0) returned 0x0 [0177.624] SysStringByteLen (bstr="active-charge.exe") returned 0x22 [0177.624] SysStringByteLen (bstr="active-charge.exe") returned 0x22 [0177.624] IWbemClassObject:Get (in: This=0x523e630, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2964bcc*=8, plFlavor=0x2964bd0*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="active-charge.exe", varVal2=0x0), pType=0x2964bcc*=8, plFlavor=0x2964bd0*=0) returned 0x0 [0177.624] SysStringByteLen (bstr="active-charge.exe") returned 0x22 [0177.624] SysStringByteLen (bstr="active-charge.exe") returned 0x22 [0177.624] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.624] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x523eaf8, puReturned=0x2945c70*=0x1) returned 0x0 [0177.625] IUnknown:QueryInterface (in: This=0x523eaf8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x523eaf8) returned 0x0 [0177.625] IUnknown:QueryInterface (in: This=0x523eaf8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.625] IUnknown:QueryInterface (in: This=0x523eaf8, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.625] IUnknown:QueryInterface (in: This=0x523eaf8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.626] IUnknown:AddRef (This=0x523eaf8) returned 0x3 [0177.626] IUnknown:QueryInterface (in: This=0x523eaf8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.626] IUnknown:QueryInterface (in: This=0x523eaf8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.626] IUnknown:QueryInterface (in: This=0x523eaf8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x523eafc) returned 0x0 [0177.626] IMarshal:GetUnmarshalClass (in: This=0x523eafc, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.626] IUnknown:Release (This=0x523eafc) returned 0x3 [0177.626] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.626] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.626] IUnknown:QueryInterface (in: This=0x523eaf8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.626] IUnknown:Release (This=0x523eaf8) returned 0x2 [0177.626] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.626] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.626] IUnknown:QueryInterface (in: This=0x523eaf8, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x523eaf8) returned 0x0 [0177.626] IUnknown:AddRef (This=0x523eaf8) returned 0x4 [0177.626] IUnknown:Release (This=0x523eaf8) returned 0x3 [0177.626] IUnknown:Release (This=0x523eaf8) returned 0x2 [0177.626] CoTaskMemFree (pv=0x51de588) [0177.626] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.626] IUnknown:AddRef (This=0x523eaf8) returned 0x3 [0177.626] IWbemClassObject:Get (in: This=0x523eaf8, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.626] IWbemClassObject:Get (in: This=0x523eaf8, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3972\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.627] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3972\"") returned 0x5e [0177.627] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3972\"") returned 0x5e [0177.627] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x83c [0177.627] SetEvent (hEvent=0x638) returned 1 [0177.627] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x83c, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.630] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.630] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.630] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f7a8, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x523f7a8) returned 0x0 [0177.630] WbemDefPath:IUnknown:AddRef (This=0x523f7a8) returned 0x3 [0177.630] WbemDefPath:IUnknown:Release (This=0x523f7a8) returned 0x2 [0177.630] WbemDefPath:IWbemPath:SetText (This=0x523f7a8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3972\"") returned 0x0 [0177.630] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.630] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.630] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.630] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.630] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.630] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.630] IWbemClassObject:Get (in: This=0x523eaf8, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29654b4*=0, plFlavor=0x29654b8*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="accupos.exe", varVal2=0x0), pType=0x29654b4*=8, plFlavor=0x29654b8*=0) returned 0x0 [0177.630] SysStringByteLen (bstr="accupos.exe") returned 0x16 [0177.630] SysStringByteLen (bstr="accupos.exe") returned 0x16 [0177.630] IWbemClassObject:Get (in: This=0x523eaf8, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29654b4*=8, plFlavor=0x29654b8*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="accupos.exe", varVal2=0x0), pType=0x29654b4*=8, plFlavor=0x29654b8*=0) returned 0x0 [0177.630] SysStringByteLen (bstr="accupos.exe") returned 0x16 [0177.631] SysStringByteLen (bstr="accupos.exe") returned 0x16 [0177.631] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.631] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x523ee28, puReturned=0x2945c70*=0x1) returned 0x0 [0177.632] IUnknown:QueryInterface (in: This=0x523ee28, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x523ee28) returned 0x0 [0177.632] IUnknown:QueryInterface (in: This=0x523ee28, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.632] IUnknown:QueryInterface (in: This=0x523ee28, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.632] IUnknown:QueryInterface (in: This=0x523ee28, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.632] IUnknown:AddRef (This=0x523ee28) returned 0x3 [0177.632] IUnknown:QueryInterface (in: This=0x523ee28, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.632] IUnknown:QueryInterface (in: This=0x523ee28, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.632] IUnknown:QueryInterface (in: This=0x523ee28, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x523ee2c) returned 0x0 [0177.632] IMarshal:GetUnmarshalClass (in: This=0x523ee2c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.632] IUnknown:Release (This=0x523ee2c) returned 0x3 [0177.632] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.632] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.632] IUnknown:QueryInterface (in: This=0x523ee28, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.632] IUnknown:Release (This=0x523ee28) returned 0x2 [0177.633] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.633] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.633] IUnknown:QueryInterface (in: This=0x523ee28, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x523ee28) returned 0x0 [0177.633] IUnknown:AddRef (This=0x523ee28) returned 0x4 [0177.633] IUnknown:Release (This=0x523ee28) returned 0x3 [0177.633] IUnknown:Release (This=0x523ee28) returned 0x2 [0177.633] CoTaskMemFree (pv=0x51de588) [0177.633] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.633] IUnknown:AddRef (This=0x523ee28) returned 0x3 [0177.633] IWbemClassObject:Get (in: This=0x523ee28, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.633] IWbemClassObject:Get (in: This=0x523ee28, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3984\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.633] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3984\"") returned 0x5e [0177.633] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3984\"") returned 0x5e [0177.633] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x840 [0177.633] SetEvent (hEvent=0x638) returned 1 [0177.633] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x840, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.635] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.635] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.635] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f968, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x523f968) returned 0x0 [0177.635] WbemDefPath:IUnknown:AddRef (This=0x523f968) returned 0x3 [0177.635] WbemDefPath:IUnknown:Release (This=0x523f968) returned 0x2 [0177.635] WbemDefPath:IWbemPath:SetText (This=0x523f968, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3984\"") returned 0x0 [0177.635] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.636] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.636] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.636] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.636] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.636] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.636] IWbemClassObject:Get (in: This=0x523ee28, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2965d84*=0, plFlavor=0x2965d88*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="afr38.exe", varVal2=0x0), pType=0x2965d84*=8, plFlavor=0x2965d88*=0) returned 0x0 [0177.636] SysStringByteLen (bstr="afr38.exe") returned 0x12 [0177.636] SysStringByteLen (bstr="afr38.exe") returned 0x12 [0177.636] IWbemClassObject:Get (in: This=0x523ee28, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2965d84*=8, plFlavor=0x2965d88*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="afr38.exe", varVal2=0x0), pType=0x2965d84*=8, plFlavor=0x2965d88*=0) returned 0x0 [0177.636] SysStringByteLen (bstr="afr38.exe") returned 0x12 [0177.636] SysStringByteLen (bstr="afr38.exe") returned 0x12 [0177.636] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.636] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x523efc0, puReturned=0x2945c70*=0x1) returned 0x0 [0177.637] IUnknown:QueryInterface (in: This=0x523efc0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x523efc0) returned 0x0 [0177.637] IUnknown:QueryInterface (in: This=0x523efc0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.637] IUnknown:QueryInterface (in: This=0x523efc0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.637] IUnknown:QueryInterface (in: This=0x523efc0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.637] IUnknown:AddRef (This=0x523efc0) returned 0x3 [0177.638] IUnknown:QueryInterface (in: This=0x523efc0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.638] IUnknown:QueryInterface (in: This=0x523efc0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.638] IUnknown:QueryInterface (in: This=0x523efc0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x523efc4) returned 0x0 [0177.638] IMarshal:GetUnmarshalClass (in: This=0x523efc4, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.638] IUnknown:Release (This=0x523efc4) returned 0x3 [0177.638] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.638] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.638] IUnknown:QueryInterface (in: This=0x523efc0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.638] IUnknown:Release (This=0x523efc0) returned 0x2 [0177.638] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.638] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.638] IUnknown:QueryInterface (in: This=0x523efc0, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x523efc0) returned 0x0 [0177.638] IUnknown:AddRef (This=0x523efc0) returned 0x4 [0177.638] IUnknown:Release (This=0x523efc0) returned 0x3 [0177.638] IUnknown:Release (This=0x523efc0) returned 0x2 [0177.638] CoTaskMemFree (pv=0x51de588) [0177.638] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.638] IUnknown:AddRef (This=0x523efc0) returned 0x3 [0177.638] IWbemClassObject:Get (in: This=0x523efc0, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.638] IWbemClassObject:Get (in: This=0x523efc0, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4000\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.638] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4000\"") returned 0x5e [0177.638] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4000\"") returned 0x5e [0177.639] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x844 [0177.639] SetEvent (hEvent=0x638) returned 1 [0177.639] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x844, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.643] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.643] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.644] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240298, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5240298) returned 0x0 [0177.644] WbemDefPath:IUnknown:AddRef (This=0x5240298) returned 0x3 [0177.644] WbemDefPath:IUnknown:Release (This=0x5240298) returned 0x2 [0177.644] WbemDefPath:IWbemPath:SetText (This=0x5240298, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4000\"") returned 0x0 [0177.644] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.644] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.644] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.644] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.644] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.644] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.645] IWbemClassObject:Get (in: This=0x523efc0, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x296664c*=0, plFlavor=0x2966650*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="aldelo.exe", varVal2=0x0), pType=0x296664c*=8, plFlavor=0x2966650*=0) returned 0x0 [0177.645] SysStringByteLen (bstr="aldelo.exe") returned 0x14 [0177.645] SysStringByteLen (bstr="aldelo.exe") returned 0x14 [0177.645] IWbemClassObject:Get (in: This=0x523efc0, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x296664c*=8, plFlavor=0x2966650*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="aldelo.exe", varVal2=0x0), pType=0x296664c*=8, plFlavor=0x2966650*=0) returned 0x0 [0177.645] SysStringByteLen (bstr="aldelo.exe") returned 0x14 [0177.645] SysStringByteLen (bstr="aldelo.exe") returned 0x14 [0177.645] CoTaskMemAlloc (cb=0x4) returned 0x51de598 [0177.645] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de598, puReturned=0x2945c70 | out: apObjects=0x51de598*=0x523dfd0, puReturned=0x2945c70*=0x1) returned 0x0 [0177.647] IUnknown:QueryInterface (in: This=0x523dfd0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x523dfd0) returned 0x0 [0177.647] IUnknown:QueryInterface (in: This=0x523dfd0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.647] IUnknown:QueryInterface (in: This=0x523dfd0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.647] IUnknown:QueryInterface (in: This=0x523dfd0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.647] IUnknown:AddRef (This=0x523dfd0) returned 0x3 [0177.647] IUnknown:QueryInterface (in: This=0x523dfd0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.647] IUnknown:QueryInterface (in: This=0x523dfd0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.647] IUnknown:QueryInterface (in: This=0x523dfd0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x523dfd4) returned 0x0 [0177.647] IMarshal:GetUnmarshalClass (in: This=0x523dfd4, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.647] IUnknown:Release (This=0x523dfd4) returned 0x3 [0177.647] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.648] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.648] IUnknown:QueryInterface (in: This=0x523dfd0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.648] IUnknown:Release (This=0x523dfd0) returned 0x2 [0177.648] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.648] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.648] IUnknown:QueryInterface (in: This=0x523dfd0, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x523dfd0) returned 0x0 [0177.648] IUnknown:AddRef (This=0x523dfd0) returned 0x4 [0177.648] IUnknown:Release (This=0x523dfd0) returned 0x3 [0177.648] IUnknown:Release (This=0x523dfd0) returned 0x2 [0177.648] CoTaskMemFree (pv=0x51de598) [0177.648] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.648] IUnknown:AddRef (This=0x523dfd0) returned 0x3 [0177.648] IWbemClassObject:Get (in: This=0x523dfd0, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.648] IWbemClassObject:Get (in: This=0x523dfd0, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4008\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.648] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4008\"") returned 0x5e [0177.648] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4008\"") returned 0x5e [0177.648] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x848 [0177.648] SetEvent (hEvent=0x638) returned 1 [0177.648] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x848, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.651] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.651] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.651] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240148, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5240148) returned 0x0 [0177.651] WbemDefPath:IUnknown:AddRef (This=0x5240148) returned 0x3 [0177.651] WbemDefPath:IUnknown:Release (This=0x5240148) returned 0x2 [0177.651] WbemDefPath:IWbemPath:SetText (This=0x5240148, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4008\"") returned 0x0 [0177.651] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.652] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.652] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.652] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.652] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.652] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.652] IWbemClassObject:Get (in: This=0x523dfd0, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2966f1c*=0, plFlavor=0x2966f20*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ccv_server.exe", varVal2=0x0), pType=0x2966f1c*=8, plFlavor=0x2966f20*=0) returned 0x0 [0177.652] SysStringByteLen (bstr="ccv_server.exe") returned 0x1c [0177.652] SysStringByteLen (bstr="ccv_server.exe") returned 0x1c [0177.652] IWbemClassObject:Get (in: This=0x523dfd0, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2966f1c*=8, plFlavor=0x2966f20*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ccv_server.exe", varVal2=0x0), pType=0x2966f1c*=8, plFlavor=0x2966f20*=0) returned 0x0 [0177.652] SysStringByteLen (bstr="ccv_server.exe") returned 0x1c [0177.652] SysStringByteLen (bstr="ccv_server.exe") returned 0x1c [0177.652] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.652] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x523e498, puReturned=0x2945c70*=0x1) returned 0x0 [0177.655] IUnknown:QueryInterface (in: This=0x523e498, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x523e498) returned 0x0 [0177.655] IUnknown:QueryInterface (in: This=0x523e498, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.655] IUnknown:QueryInterface (in: This=0x523e498, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.656] IUnknown:QueryInterface (in: This=0x523e498, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.656] IUnknown:AddRef (This=0x523e498) returned 0x3 [0177.656] IUnknown:QueryInterface (in: This=0x523e498, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.656] IUnknown:QueryInterface (in: This=0x523e498, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.656] IUnknown:QueryInterface (in: This=0x523e498, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x523e49c) returned 0x0 [0177.656] IMarshal:GetUnmarshalClass (in: This=0x523e49c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.656] IUnknown:Release (This=0x523e49c) returned 0x3 [0177.656] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.656] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.656] IUnknown:QueryInterface (in: This=0x523e498, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.656] IUnknown:Release (This=0x523e498) returned 0x2 [0177.656] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.656] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.656] IUnknown:QueryInterface (in: This=0x523e498, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x523e498) returned 0x0 [0177.656] IUnknown:AddRef (This=0x523e498) returned 0x4 [0177.656] IUnknown:Release (This=0x523e498) returned 0x3 [0177.656] IUnknown:Release (This=0x523e498) returned 0x2 [0177.656] CoTaskMemFree (pv=0x51de588) [0177.656] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.656] IUnknown:AddRef (This=0x523e498) returned 0x3 [0177.656] IWbemClassObject:Get (in: This=0x523e498, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.657] IWbemClassObject:Get (in: This=0x523e498, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4028\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.657] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4028\"") returned 0x5e [0177.657] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4028\"") returned 0x5e [0177.657] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x84c [0177.657] SetEvent (hEvent=0x638) returned 1 [0177.657] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x84c, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.660] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.660] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.660] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240378, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5240378) returned 0x0 [0177.660] WbemDefPath:IUnknown:AddRef (This=0x5240378) returned 0x3 [0177.660] WbemDefPath:IUnknown:Release (This=0x5240378) returned 0x2 [0177.660] WbemDefPath:IWbemPath:SetText (This=0x5240378, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4028\"") returned 0x0 [0177.660] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.660] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.660] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.660] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.660] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.660] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.660] IWbemClassObject:Get (in: This=0x523e498, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29677fc*=0, plFlavor=0x2967800*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="centralcreditcard.exe", varVal2=0x0), pType=0x29677fc*=8, plFlavor=0x2967800*=0) returned 0x0 [0177.660] SysStringByteLen (bstr="centralcreditcard.exe") returned 0x2a [0177.660] SysStringByteLen (bstr="centralcreditcard.exe") returned 0x2a [0177.660] IWbemClassObject:Get (in: This=0x523e498, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29677fc*=8, plFlavor=0x2967800*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="centralcreditcard.exe", varVal2=0x0), pType=0x29677fc*=8, plFlavor=0x2967800*=0) returned 0x0 [0177.660] SysStringByteLen (bstr="centralcreditcard.exe") returned 0x2a [0177.660] SysStringByteLen (bstr="centralcreditcard.exe") returned 0x2a [0177.660] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.660] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x523db08, puReturned=0x2945c70*=0x1) returned 0x0 [0177.662] IUnknown:QueryInterface (in: This=0x523db08, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x523db08) returned 0x0 [0177.662] IUnknown:QueryInterface (in: This=0x523db08, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.662] IUnknown:QueryInterface (in: This=0x523db08, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.662] IUnknown:QueryInterface (in: This=0x523db08, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.662] IUnknown:AddRef (This=0x523db08) returned 0x3 [0177.662] IUnknown:QueryInterface (in: This=0x523db08, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.662] IUnknown:QueryInterface (in: This=0x523db08, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.662] IUnknown:QueryInterface (in: This=0x523db08, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x523db0c) returned 0x0 [0177.662] IMarshal:GetUnmarshalClass (in: This=0x523db0c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.662] IUnknown:Release (This=0x523db0c) returned 0x3 [0177.662] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.663] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.663] IUnknown:QueryInterface (in: This=0x523db08, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.663] IUnknown:Release (This=0x523db08) returned 0x2 [0177.663] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.663] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.663] IUnknown:QueryInterface (in: This=0x523db08, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x523db08) returned 0x0 [0177.663] IUnknown:AddRef (This=0x523db08) returned 0x4 [0177.663] IUnknown:Release (This=0x523db08) returned 0x3 [0177.663] IUnknown:Release (This=0x523db08) returned 0x2 [0177.663] CoTaskMemFree (pv=0x51de588) [0177.663] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.663] IUnknown:AddRef (This=0x523db08) returned 0x3 [0177.663] IWbemClassObject:Get (in: This=0x523db08, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.663] IWbemClassObject:Get (in: This=0x523db08, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4036\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.663] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4036\"") returned 0x5e [0177.663] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4036\"") returned 0x5e [0177.663] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x850 [0177.664] SetEvent (hEvent=0x638) returned 1 [0177.664] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x850, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.669] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.669] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.669] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fb28, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x523fb28) returned 0x0 [0177.669] WbemDefPath:IUnknown:AddRef (This=0x523fb28) returned 0x3 [0177.669] WbemDefPath:IUnknown:Release (This=0x523fb28) returned 0x2 [0177.669] WbemDefPath:IWbemPath:SetText (This=0x523fb28, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4036\"") returned 0x0 [0177.669] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.669] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.669] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.669] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.669] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.669] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.669] IWbemClassObject:Get (in: This=0x523db08, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29680f4*=0, plFlavor=0x29680f8*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="creditservice.exe", varVal2=0x0), pType=0x29680f4*=8, plFlavor=0x29680f8*=0) returned 0x0 [0177.669] SysStringByteLen (bstr="creditservice.exe") returned 0x22 [0177.669] SysStringByteLen (bstr="creditservice.exe") returned 0x22 [0177.670] IWbemClassObject:Get (in: This=0x523db08, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29680f4*=8, plFlavor=0x29680f8*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="creditservice.exe", varVal2=0x0), pType=0x29680f4*=8, plFlavor=0x29680f8*=0) returned 0x0 [0177.670] SysStringByteLen (bstr="creditservice.exe") returned 0x22 [0177.670] SysStringByteLen (bstr="creditservice.exe") returned 0x22 [0177.670] CoTaskMemAlloc (cb=0x4) returned 0x51de638 [0177.670] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de638, puReturned=0x2945c70 | out: apObjects=0x51de638*=0x523ec90, puReturned=0x2945c70*=0x1) returned 0x0 [0177.671] IUnknown:QueryInterface (in: This=0x523ec90, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x523ec90) returned 0x0 [0177.671] IUnknown:QueryInterface (in: This=0x523ec90, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.671] IUnknown:QueryInterface (in: This=0x523ec90, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.671] IUnknown:QueryInterface (in: This=0x523ec90, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.671] IUnknown:AddRef (This=0x523ec90) returned 0x3 [0177.671] IUnknown:QueryInterface (in: This=0x523ec90, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.671] IUnknown:QueryInterface (in: This=0x523ec90, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.672] IUnknown:QueryInterface (in: This=0x523ec90, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x523ec94) returned 0x0 [0177.672] IMarshal:GetUnmarshalClass (in: This=0x523ec94, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.672] IUnknown:Release (This=0x523ec94) returned 0x3 [0177.672] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.672] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.672] IUnknown:QueryInterface (in: This=0x523ec90, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.672] IUnknown:Release (This=0x523ec90) returned 0x2 [0177.672] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.672] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.672] IUnknown:QueryInterface (in: This=0x523ec90, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x523ec90) returned 0x0 [0177.672] IUnknown:AddRef (This=0x523ec90) returned 0x4 [0177.672] IUnknown:Release (This=0x523ec90) returned 0x3 [0177.672] IUnknown:Release (This=0x523ec90) returned 0x2 [0177.672] CoTaskMemFree (pv=0x51de638) [0177.672] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.672] IUnknown:AddRef (This=0x523ec90) returned 0x3 [0177.672] IWbemClassObject:Get (in: This=0x523ec90, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.673] IWbemClassObject:Get (in: This=0x523ec90, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4044\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.673] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4044\"") returned 0x5e [0177.673] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4044\"") returned 0x5e [0177.673] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x854 [0177.673] SetEvent (hEvent=0x638) returned 1 [0177.673] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x854, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.676] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.676] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.676] WbemDefPath:IUnknown:QueryInterface (in: This=0x52401b8, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x52401b8) returned 0x0 [0177.676] WbemDefPath:IUnknown:AddRef (This=0x52401b8) returned 0x3 [0177.676] WbemDefPath:IUnknown:Release (This=0x52401b8) returned 0x2 [0177.676] WbemDefPath:IWbemPath:SetText (This=0x52401b8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4044\"") returned 0x0 [0177.676] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.676] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.676] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.676] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.676] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.676] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.677] IWbemClassObject:Get (in: This=0x523ec90, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29689dc*=0, plFlavor=0x29689e0*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="mxslipstream.exe", varVal2=0x0), pType=0x29689dc*=8, plFlavor=0x29689e0*=0) returned 0x0 [0177.677] SysStringByteLen (bstr="mxslipstream.exe") returned 0x20 [0177.677] SysStringByteLen (bstr="mxslipstream.exe") returned 0x20 [0177.677] IWbemClassObject:Get (in: This=0x523ec90, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29689dc*=8, plFlavor=0x29689e0*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="mxslipstream.exe", varVal2=0x0), pType=0x29689dc*=8, plFlavor=0x29689e0*=0) returned 0x0 [0177.677] SysStringByteLen (bstr="mxslipstream.exe") returned 0x20 [0177.677] SysStringByteLen (bstr="mxslipstream.exe") returned 0x20 [0177.677] CoTaskMemAlloc (cb=0x4) returned 0x51de638 [0177.677] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de638, puReturned=0x2945c70 | out: apObjects=0x51de638*=0x523e300, puReturned=0x2945c70*=0x1) returned 0x0 [0177.678] IUnknown:QueryInterface (in: This=0x523e300, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x523e300) returned 0x0 [0177.678] IUnknown:QueryInterface (in: This=0x523e300, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.679] IUnknown:QueryInterface (in: This=0x523e300, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.679] IUnknown:QueryInterface (in: This=0x523e300, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.679] IUnknown:AddRef (This=0x523e300) returned 0x3 [0177.679] IUnknown:QueryInterface (in: This=0x523e300, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.679] IUnknown:QueryInterface (in: This=0x523e300, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.679] IUnknown:QueryInterface (in: This=0x523e300, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x523e304) returned 0x0 [0177.679] IMarshal:GetUnmarshalClass (in: This=0x523e304, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.679] IUnknown:Release (This=0x523e304) returned 0x3 [0177.679] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.679] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.679] IUnknown:QueryInterface (in: This=0x523e300, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.679] IUnknown:Release (This=0x523e300) returned 0x2 [0177.679] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.679] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.679] IUnknown:QueryInterface (in: This=0x523e300, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x523e300) returned 0x0 [0177.679] IUnknown:AddRef (This=0x523e300) returned 0x4 [0177.679] IUnknown:Release (This=0x523e300) returned 0x3 [0177.680] IUnknown:Release (This=0x523e300) returned 0x2 [0177.680] CoTaskMemFree (pv=0x51de638) [0177.680] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.680] IUnknown:AddRef (This=0x523e300) returned 0x3 [0177.680] IWbemClassObject:Get (in: This=0x523e300, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.680] IWbemClassObject:Get (in: This=0x523e300, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4052\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.680] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4052\"") returned 0x5e [0177.680] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4052\"") returned 0x5e [0177.680] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x858 [0177.680] SetEvent (hEvent=0x638) returned 1 [0177.680] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x858, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.683] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.683] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.683] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f9d8, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x523f9d8) returned 0x0 [0177.683] WbemDefPath:IUnknown:AddRef (This=0x523f9d8) returned 0x3 [0177.683] WbemDefPath:IUnknown:Release (This=0x523f9d8) returned 0x2 [0177.683] WbemDefPath:IWbemPath:SetText (This=0x523f9d8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4052\"") returned 0x0 [0177.683] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.683] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.683] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.683] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.683] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.683] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.683] IWbemClassObject:Get (in: This=0x523e300, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29692c4*=0, plFlavor=0x29692c8*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fpos.exe", varVal2=0x0), pType=0x29692c4*=8, plFlavor=0x29692c8*=0) returned 0x0 [0177.684] SysStringByteLen (bstr="fpos.exe") returned 0x10 [0177.684] SysStringByteLen (bstr="fpos.exe") returned 0x10 [0177.684] IWbemClassObject:Get (in: This=0x523e300, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29692c4*=8, plFlavor=0x29692c8*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fpos.exe", varVal2=0x0), pType=0x29692c4*=8, plFlavor=0x29692c8*=0) returned 0x0 [0177.684] SysStringByteLen (bstr="fpos.exe") returned 0x10 [0177.684] SysStringByteLen (bstr="fpos.exe") returned 0x10 [0177.684] CoTaskMemAlloc (cb=0x4) returned 0x51de638 [0177.684] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de638, puReturned=0x2945c70 | out: apObjects=0x51de638*=0x523e7c8, puReturned=0x2945c70*=0x1) returned 0x0 [0177.685] IUnknown:QueryInterface (in: This=0x523e7c8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x523e7c8) returned 0x0 [0177.685] IUnknown:QueryInterface (in: This=0x523e7c8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.685] IUnknown:QueryInterface (in: This=0x523e7c8, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.685] IUnknown:QueryInterface (in: This=0x523e7c8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.686] IUnknown:AddRef (This=0x523e7c8) returned 0x3 [0177.686] IUnknown:QueryInterface (in: This=0x523e7c8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.686] IUnknown:QueryInterface (in: This=0x523e7c8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.686] IUnknown:QueryInterface (in: This=0x523e7c8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x523e7cc) returned 0x0 [0177.686] IMarshal:GetUnmarshalClass (in: This=0x523e7cc, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.686] IUnknown:Release (This=0x523e7cc) returned 0x3 [0177.686] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.686] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.686] IUnknown:QueryInterface (in: This=0x523e7c8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.686] IUnknown:Release (This=0x523e7c8) returned 0x2 [0177.686] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.686] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.686] IUnknown:QueryInterface (in: This=0x523e7c8, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x523e7c8) returned 0x0 [0177.686] IUnknown:AddRef (This=0x523e7c8) returned 0x4 [0177.686] IUnknown:Release (This=0x523e7c8) returned 0x3 [0177.686] IUnknown:Release (This=0x523e7c8) returned 0x2 [0177.686] CoTaskMemFree (pv=0x51de638) [0177.686] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.686] IUnknown:AddRef (This=0x523e7c8) returned 0x3 [0177.687] IWbemClassObject:Get (in: This=0x523e7c8, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.687] IWbemClassObject:Get (in: This=0x523e7c8, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4060\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.687] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4060\"") returned 0x5e [0177.687] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4060\"") returned 0x5e [0177.687] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x85c [0177.687] SetEvent (hEvent=0x638) returned 1 [0177.687] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x85c, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.692] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.692] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.692] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fa48, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x523fa48) returned 0x0 [0177.692] WbemDefPath:IUnknown:AddRef (This=0x523fa48) returned 0x3 [0177.693] WbemDefPath:IUnknown:Release (This=0x523fa48) returned 0x2 [0177.693] WbemDefPath:IWbemPath:SetText (This=0x523fa48, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4060\"") returned 0x0 [0177.693] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.693] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.693] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.693] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.693] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.693] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.693] IWbemClassObject:Get (in: This=0x523e7c8, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2969b8c*=0, plFlavor=0x2969b90*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="edcsvr.exe", varVal2=0x0), pType=0x2969b8c*=8, plFlavor=0x2969b90*=0) returned 0x0 [0177.693] SysStringByteLen (bstr="edcsvr.exe") returned 0x14 [0177.693] SysStringByteLen (bstr="edcsvr.exe") returned 0x14 [0177.693] IWbemClassObject:Get (in: This=0x523e7c8, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2969b8c*=8, plFlavor=0x2969b90*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="edcsvr.exe", varVal2=0x0), pType=0x2969b8c*=8, plFlavor=0x2969b90*=0) returned 0x0 [0177.693] SysStringByteLen (bstr="edcsvr.exe") returned 0x14 [0177.693] SysStringByteLen (bstr="edcsvr.exe") returned 0x14 [0177.693] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.693] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x523f158, puReturned=0x2945c70*=0x1) returned 0x0 [0177.695] IUnknown:QueryInterface (in: This=0x523f158, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x523f158) returned 0x0 [0177.696] IUnknown:QueryInterface (in: This=0x523f158, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.696] IUnknown:QueryInterface (in: This=0x523f158, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.696] IUnknown:QueryInterface (in: This=0x523f158, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.696] IUnknown:AddRef (This=0x523f158) returned 0x3 [0177.696] IUnknown:QueryInterface (in: This=0x523f158, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.696] IUnknown:QueryInterface (in: This=0x523f158, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.696] IUnknown:QueryInterface (in: This=0x523f158, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x523f15c) returned 0x0 [0177.696] IMarshal:GetUnmarshalClass (in: This=0x523f15c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.696] IUnknown:Release (This=0x523f15c) returned 0x3 [0177.696] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.696] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.696] IUnknown:QueryInterface (in: This=0x523f158, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.696] IUnknown:Release (This=0x523f158) returned 0x2 [0177.696] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.696] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.696] IUnknown:QueryInterface (in: This=0x523f158, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x523f158) returned 0x0 [0177.697] IUnknown:AddRef (This=0x523f158) returned 0x4 [0177.697] IUnknown:Release (This=0x523f158) returned 0x3 [0177.697] IUnknown:Release (This=0x523f158) returned 0x2 [0177.697] CoTaskMemFree (pv=0x51de588) [0177.697] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.697] IUnknown:AddRef (This=0x523f158) returned 0x3 [0177.697] IWbemClassObject:Get (in: This=0x523f158, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.697] IWbemClassObject:Get (in: This=0x523f158, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4076\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.697] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4076\"") returned 0x5e [0177.697] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4076\"") returned 0x5e [0177.697] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x860 [0177.697] SetEvent (hEvent=0x638) returned 1 [0177.697] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x860, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.700] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.700] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f5e8, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x523f5e8) returned 0x0 [0177.700] WbemDefPath:IUnknown:AddRef (This=0x523f5e8) returned 0x3 [0177.700] WbemDefPath:IUnknown:Release (This=0x523f5e8) returned 0x2 [0177.700] WbemDefPath:IWbemPath:SetText (This=0x523f5e8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4076\"") returned 0x0 [0177.700] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.700] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.700] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.700] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.700] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.700] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.701] IWbemClassObject:Get (in: This=0x523f158, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x296a45c*=0, plFlavor=0x296a460*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="isspos.exe", varVal2=0x0), pType=0x296a45c*=8, plFlavor=0x296a460*=0) returned 0x0 [0177.701] SysStringByteLen (bstr="isspos.exe") returned 0x14 [0177.701] SysStringByteLen (bstr="isspos.exe") returned 0x14 [0177.701] IWbemClassObject:Get (in: This=0x523f158, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x296a45c*=8, plFlavor=0x296a460*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="isspos.exe", varVal2=0x0), pType=0x296a45c*=8, plFlavor=0x296a460*=0) returned 0x0 [0177.701] SysStringByteLen (bstr="isspos.exe") returned 0x14 [0177.701] SysStringByteLen (bstr="isspos.exe") returned 0x14 [0177.703] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.703] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x523e960, puReturned=0x2945c70*=0x1) returned 0x0 [0177.705] IUnknown:QueryInterface (in: This=0x523e960, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x523e960) returned 0x0 [0177.705] IUnknown:QueryInterface (in: This=0x523e960, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.705] IUnknown:QueryInterface (in: This=0x523e960, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.705] IUnknown:QueryInterface (in: This=0x523e960, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.705] IUnknown:AddRef (This=0x523e960) returned 0x3 [0177.705] IUnknown:QueryInterface (in: This=0x523e960, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.705] IUnknown:QueryInterface (in: This=0x523e960, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.705] IUnknown:QueryInterface (in: This=0x523e960, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x523e964) returned 0x0 [0177.705] IMarshal:GetUnmarshalClass (in: This=0x523e964, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.705] IUnknown:Release (This=0x523e964) returned 0x3 [0177.705] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.705] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.706] IUnknown:QueryInterface (in: This=0x523e960, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.706] IUnknown:Release (This=0x523e960) returned 0x2 [0177.706] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.706] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.706] IUnknown:QueryInterface (in: This=0x523e960, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x523e960) returned 0x0 [0177.706] IUnknown:AddRef (This=0x523e960) returned 0x4 [0177.706] IUnknown:Release (This=0x523e960) returned 0x3 [0177.706] IUnknown:Release (This=0x523e960) returned 0x2 [0177.706] CoTaskMemFree (pv=0x51de588) [0177.706] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.706] IUnknown:AddRef (This=0x523e960) returned 0x3 [0177.706] IWbemClassObject:Get (in: This=0x523e960, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.707] IWbemClassObject:Get (in: This=0x523e960, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1828\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.707] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1828\"") returned 0x5e [0177.707] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1828\"") returned 0x5e [0177.707] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x864 [0177.707] SetEvent (hEvent=0x638) returned 1 [0177.707] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x864, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.710] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.710] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.710] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fe38, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x523fe38) returned 0x0 [0177.710] WbemDefPath:IUnknown:AddRef (This=0x523fe38) returned 0x3 [0177.710] WbemDefPath:IUnknown:Release (This=0x523fe38) returned 0x2 [0177.710] WbemDefPath:IWbemPath:SetText (This=0x523fe38, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1828\"") returned 0x0 [0177.710] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.710] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.710] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.710] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.710] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.710] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.710] IWbemClassObject:Get (in: This=0x523e960, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x296ad2c*=0, plFlavor=0x296ad30*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="omnipos.exe", varVal2=0x0), pType=0x296ad2c*=8, plFlavor=0x296ad30*=0) returned 0x0 [0177.711] SysStringByteLen (bstr="omnipos.exe") returned 0x16 [0177.711] SysStringByteLen (bstr="omnipos.exe") returned 0x16 [0177.711] IWbemClassObject:Get (in: This=0x523e960, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x296ad2c*=8, plFlavor=0x296ad30*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="omnipos.exe", varVal2=0x0), pType=0x296ad2c*=8, plFlavor=0x296ad30*=0) returned 0x0 [0177.711] SysStringByteLen (bstr="omnipos.exe") returned 0x16 [0177.711] SysStringByteLen (bstr="omnipos.exe") returned 0x16 [0177.711] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.711] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x523d310, puReturned=0x2945c70*=0x1) returned 0x0 [0177.716] IUnknown:QueryInterface (in: This=0x523d310, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x523d310) returned 0x0 [0177.716] IUnknown:QueryInterface (in: This=0x523d310, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.716] IUnknown:QueryInterface (in: This=0x523d310, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.716] IUnknown:QueryInterface (in: This=0x523d310, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.716] IUnknown:AddRef (This=0x523d310) returned 0x3 [0177.716] IUnknown:QueryInterface (in: This=0x523d310, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.716] IUnknown:QueryInterface (in: This=0x523d310, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.716] IUnknown:QueryInterface (in: This=0x523d310, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x523d314) returned 0x0 [0177.716] IMarshal:GetUnmarshalClass (in: This=0x523d314, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.716] IUnknown:Release (This=0x523d314) returned 0x3 [0177.717] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.717] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.717] IUnknown:QueryInterface (in: This=0x523d310, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.717] IUnknown:Release (This=0x523d310) returned 0x2 [0177.717] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.717] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.717] IUnknown:QueryInterface (in: This=0x523d310, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x523d310) returned 0x0 [0177.717] IUnknown:AddRef (This=0x523d310) returned 0x4 [0177.717] IUnknown:Release (This=0x523d310) returned 0x3 [0177.717] IUnknown:Release (This=0x523d310) returned 0x2 [0177.717] CoTaskMemFree (pv=0x51de588) [0177.717] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.717] IUnknown:AddRef (This=0x523d310) returned 0x3 [0177.717] IWbemClassObject:Get (in: This=0x523d310, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.717] IWbemClassObject:Get (in: This=0x523d310, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1564\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.717] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1564\"") returned 0x5e [0177.717] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1564\"") returned 0x5e [0177.718] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x868 [0177.718] SetEvent (hEvent=0x638) returned 1 [0177.718] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x868, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.720] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.720] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.720] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fea8, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x523fea8) returned 0x0 [0177.721] WbemDefPath:IUnknown:AddRef (This=0x523fea8) returned 0x3 [0177.721] WbemDefPath:IUnknown:Release (This=0x523fea8) returned 0x2 [0177.721] WbemDefPath:IWbemPath:SetText (This=0x523fea8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1564\"") returned 0x0 [0177.721] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.721] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.721] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.721] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.721] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.721] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.721] IWbemClassObject:Get (in: This=0x523d310, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x296b5fc*=0, plFlavor=0x296b600*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spcwin.exe", varVal2=0x0), pType=0x296b5fc*=8, plFlavor=0x296b600*=0) returned 0x0 [0177.721] SysStringByteLen (bstr="spcwin.exe") returned 0x14 [0177.721] SysStringByteLen (bstr="spcwin.exe") returned 0x14 [0177.721] IWbemClassObject:Get (in: This=0x523d310, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x296b5fc*=8, plFlavor=0x296b600*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spcwin.exe", varVal2=0x0), pType=0x296b5fc*=8, plFlavor=0x296b600*=0) returned 0x0 [0177.721] SysStringByteLen (bstr="spcwin.exe") returned 0x14 [0177.721] SysStringByteLen (bstr="spcwin.exe") returned 0x14 [0177.721] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.721] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x523d7d8, puReturned=0x2945c70*=0x1) returned 0x0 [0177.804] IUnknown:QueryInterface (in: This=0x523d7d8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x523d7d8) returned 0x0 [0177.805] IUnknown:QueryInterface (in: This=0x523d7d8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.805] IUnknown:QueryInterface (in: This=0x523d7d8, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.805] IUnknown:QueryInterface (in: This=0x523d7d8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.805] IUnknown:AddRef (This=0x523d7d8) returned 0x3 [0177.805] IUnknown:QueryInterface (in: This=0x523d7d8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.805] IUnknown:QueryInterface (in: This=0x523d7d8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.805] IUnknown:QueryInterface (in: This=0x523d7d8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x523d7dc) returned 0x0 [0177.805] IMarshal:GetUnmarshalClass (in: This=0x523d7dc, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.805] IUnknown:Release (This=0x523d7dc) returned 0x3 [0177.805] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.805] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.805] IUnknown:QueryInterface (in: This=0x523d7d8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.806] IUnknown:Release (This=0x523d7d8) returned 0x2 [0177.806] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.806] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.806] IUnknown:QueryInterface (in: This=0x523d7d8, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x523d7d8) returned 0x0 [0177.806] IUnknown:AddRef (This=0x523d7d8) returned 0x4 [0177.806] IUnknown:Release (This=0x523d7d8) returned 0x3 [0177.806] IUnknown:Release (This=0x523d7d8) returned 0x2 [0177.806] CoTaskMemFree (pv=0x51de588) [0177.806] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.806] IUnknown:AddRef (This=0x523d7d8) returned 0x3 [0177.806] IWbemClassObject:Get (in: This=0x523d7d8, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.806] IWbemClassObject:Get (in: This=0x523d7d8, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1668\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.806] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1668\"") returned 0x5e [0177.806] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1668\"") returned 0x5e [0177.806] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x86c [0177.807] SetEvent (hEvent=0x638) returned 1 [0177.807] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x86c, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.812] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.812] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.812] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240228, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5240228) returned 0x0 [0177.812] WbemDefPath:IUnknown:AddRef (This=0x5240228) returned 0x3 [0177.812] WbemDefPath:IUnknown:Release (This=0x5240228) returned 0x2 [0177.812] WbemDefPath:IWbemPath:SetText (This=0x5240228, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1668\"") returned 0x0 [0177.812] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.812] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.812] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.812] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.812] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.812] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.812] IWbemClassObject:Get (in: This=0x523d7d8, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x296becc*=0, plFlavor=0x296bed0*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spgagentservice.exe", varVal2=0x0), pType=0x296becc*=8, plFlavor=0x296bed0*=0) returned 0x0 [0177.812] SysStringByteLen (bstr="spgagentservice.exe") returned 0x26 [0177.812] SysStringByteLen (bstr="spgagentservice.exe") returned 0x26 [0177.812] IWbemClassObject:Get (in: This=0x523d7d8, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x296becc*=8, plFlavor=0x296bed0*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spgagentservice.exe", varVal2=0x0), pType=0x296becc*=8, plFlavor=0x296bed0*=0) returned 0x0 [0177.813] SysStringByteLen (bstr="spgagentservice.exe") returned 0x26 [0177.813] SysStringByteLen (bstr="spgagentservice.exe") returned 0x26 [0177.813] CoTaskMemAlloc (cb=0x4) returned 0x51de588 [0177.813] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de588, puReturned=0x2945c70 | out: apObjects=0x51de588*=0x523e168, puReturned=0x2945c70*=0x1) returned 0x0 [0177.814] IUnknown:QueryInterface (in: This=0x523e168, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x523e168) returned 0x0 [0177.814] IUnknown:QueryInterface (in: This=0x523e168, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.814] IUnknown:QueryInterface (in: This=0x523e168, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.814] IUnknown:QueryInterface (in: This=0x523e168, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.814] IUnknown:AddRef (This=0x523e168) returned 0x3 [0177.814] IUnknown:QueryInterface (in: This=0x523e168, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.814] IUnknown:QueryInterface (in: This=0x523e168, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.814] IUnknown:QueryInterface (in: This=0x523e168, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x523e16c) returned 0x0 [0177.814] IMarshal:GetUnmarshalClass (in: This=0x523e16c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.815] IUnknown:Release (This=0x523e16c) returned 0x3 [0177.815] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.815] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.815] IUnknown:QueryInterface (in: This=0x523e168, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.815] IUnknown:Release (This=0x523e168) returned 0x2 [0177.815] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.815] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.815] IUnknown:QueryInterface (in: This=0x523e168, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x523e168) returned 0x0 [0177.815] IUnknown:AddRef (This=0x523e168) returned 0x4 [0177.815] IUnknown:Release (This=0x523e168) returned 0x3 [0177.815] IUnknown:Release (This=0x523e168) returned 0x2 [0177.815] CoTaskMemFree (pv=0x51de588) [0177.815] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.815] IUnknown:AddRef (This=0x523e168) returned 0x3 [0177.815] IWbemClassObject:Get (in: This=0x523e168, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.815] IWbemClassObject:Get (in: This=0x523e168, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"936\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.815] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"936\"") returned 0x5c [0177.815] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"936\"") returned 0x5c [0177.815] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x870 [0177.816] SetEvent (hEvent=0x638) returned 1 [0177.818] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x870, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.818] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.818] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.818] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fab8, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x523fab8) returned 0x0 [0177.818] WbemDefPath:IUnknown:AddRef (This=0x523fab8) returned 0x3 [0177.818] WbemDefPath:IUnknown:Release (This=0x523fab8) returned 0x2 [0177.818] WbemDefPath:IWbemPath:SetText (This=0x523fab8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"936\"") returned 0x0 [0177.819] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.819] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.819] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.819] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.819] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.819] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.819] IWbemClassObject:Get (in: This=0x523e168, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x296c7bc*=0, plFlavor=0x296c7c0*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="utg2.exe", varVal2=0x0), pType=0x296c7bc*=8, plFlavor=0x296c7c0*=0) returned 0x0 [0177.819] SysStringByteLen (bstr="utg2.exe") returned 0x10 [0177.819] SysStringByteLen (bstr="utg2.exe") returned 0x10 [0177.819] IWbemClassObject:Get (in: This=0x523e168, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x296c7bc*=8, plFlavor=0x296c7c0*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="utg2.exe", varVal2=0x0), pType=0x296c7bc*=8, plFlavor=0x296c7c0*=0) returned 0x0 [0177.819] SysStringByteLen (bstr="utg2.exe") returned 0x10 [0177.819] SysStringByteLen (bstr="utg2.exe") returned 0x10 [0177.819] CoTaskMemAlloc (cb=0x4) returned 0x51de638 [0177.819] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de638, puReturned=0x2945c70 | out: apObjects=0x51de638*=0x523d4a8, puReturned=0x2945c70*=0x1) returned 0x0 [0177.820] IUnknown:QueryInterface (in: This=0x523d4a8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x523d4a8) returned 0x0 [0177.820] IUnknown:QueryInterface (in: This=0x523d4a8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.820] IUnknown:QueryInterface (in: This=0x523d4a8, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.820] IUnknown:QueryInterface (in: This=0x523d4a8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.821] IUnknown:AddRef (This=0x523d4a8) returned 0x3 [0177.821] IUnknown:QueryInterface (in: This=0x523d4a8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.821] IUnknown:QueryInterface (in: This=0x523d4a8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.821] IUnknown:QueryInterface (in: This=0x523d4a8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x523d4ac) returned 0x0 [0177.821] IMarshal:GetUnmarshalClass (in: This=0x523d4ac, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.821] IUnknown:Release (This=0x523d4ac) returned 0x3 [0177.821] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.821] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.821] IUnknown:QueryInterface (in: This=0x523d4a8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.821] IUnknown:Release (This=0x523d4a8) returned 0x2 [0177.821] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.821] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.821] IUnknown:QueryInterface (in: This=0x523d4a8, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x523d4a8) returned 0x0 [0177.821] IUnknown:AddRef (This=0x523d4a8) returned 0x4 [0177.821] IUnknown:Release (This=0x523d4a8) returned 0x3 [0177.821] IUnknown:Release (This=0x523d4a8) returned 0x2 [0177.821] CoTaskMemFree (pv=0x51de638) [0177.821] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.821] IUnknown:AddRef (This=0x523d4a8) returned 0x3 [0177.821] IWbemClassObject:Get (in: This=0x523d4a8, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.822] IWbemClassObject:Get (in: This=0x523d4a8, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3292\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.822] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3292\"") returned 0x5e [0177.822] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3292\"") returned 0x5e [0177.822] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x874 [0177.822] SetEvent (hEvent=0x638) returned 1 [0177.822] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x874, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.824] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.824] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.824] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f658, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x523f658) returned 0x0 [0177.824] WbemDefPath:IUnknown:AddRef (This=0x523f658) returned 0x3 [0177.824] WbemDefPath:IUnknown:Release (This=0x523f658) returned 0x2 [0177.824] WbemDefPath:IWbemPath:SetText (This=0x523f658, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3292\"") returned 0x0 [0177.824] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.824] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.824] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.824] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.824] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.824] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.825] IWbemClassObject:Get (in: This=0x523d4a8, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x296d084*=0, plFlavor=0x296d088*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="gun.exe", varVal2=0x0), pType=0x296d084*=8, plFlavor=0x296d088*=0) returned 0x0 [0177.825] SysStringByteLen (bstr="gun.exe") returned 0xe [0177.825] SysStringByteLen (bstr="gun.exe") returned 0xe [0177.825] IWbemClassObject:Get (in: This=0x523d4a8, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x296d084*=8, plFlavor=0x296d088*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="gun.exe", varVal2=0x0), pType=0x296d084*=8, plFlavor=0x296d088*=0) returned 0x0 [0177.825] SysStringByteLen (bstr="gun.exe") returned 0xe [0177.825] SysStringByteLen (bstr="gun.exe") returned 0xe [0177.825] CoTaskMemAlloc (cb=0x4) returned 0x51de598 [0177.825] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de598, puReturned=0x2945c70 | out: apObjects=0x51de598*=0x523d640, puReturned=0x2945c70*=0x1) returned 0x0 [0177.827] IUnknown:QueryInterface (in: This=0x523d640, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x523d640) returned 0x0 [0177.827] IUnknown:QueryInterface (in: This=0x523d640, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.827] IUnknown:QueryInterface (in: This=0x523d640, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.827] IUnknown:QueryInterface (in: This=0x523d640, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.827] IUnknown:AddRef (This=0x523d640) returned 0x3 [0177.827] IUnknown:QueryInterface (in: This=0x523d640, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.827] IUnknown:QueryInterface (in: This=0x523d640, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.827] IUnknown:QueryInterface (in: This=0x523d640, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x523d644) returned 0x0 [0177.827] IMarshal:GetUnmarshalClass (in: This=0x523d644, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.827] IUnknown:Release (This=0x523d644) returned 0x3 [0177.827] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.827] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.827] IUnknown:QueryInterface (in: This=0x523d640, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.828] IUnknown:Release (This=0x523d640) returned 0x2 [0177.828] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.828] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.828] IUnknown:QueryInterface (in: This=0x523d640, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x523d640) returned 0x0 [0177.828] IUnknown:AddRef (This=0x523d640) returned 0x4 [0177.828] IUnknown:Release (This=0x523d640) returned 0x3 [0177.828] IUnknown:Release (This=0x523d640) returned 0x2 [0177.828] CoTaskMemFree (pv=0x51de598) [0177.828] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.828] IUnknown:AddRef (This=0x523d640) returned 0x3 [0177.828] IWbemClassObject:Get (in: This=0x523d640, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.828] IWbemClassObject:Get (in: This=0x523d640, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4132\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.828] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4132\"") returned 0x5e [0177.828] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4132\"") returned 0x5e [0177.828] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x878 [0177.828] SetEvent (hEvent=0x638) returned 1 [0177.829] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x878, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.831] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.831] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.831] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240308, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x5240308) returned 0x0 [0177.831] WbemDefPath:IUnknown:AddRef (This=0x5240308) returned 0x3 [0177.831] WbemDefPath:IUnknown:Release (This=0x5240308) returned 0x2 [0177.831] WbemDefPath:IWbemPath:SetText (This=0x5240308, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4132\"") returned 0x0 [0177.831] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.831] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.831] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.831] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.831] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.831] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.831] IWbemClassObject:Get (in: This=0x523d640, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x296d944*=0, plFlavor=0x296d948*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="backgroundTaskHost.exe", varVal2=0x0), pType=0x296d944*=8, plFlavor=0x296d948*=0) returned 0x0 [0177.832] SysStringByteLen (bstr="backgroundTaskHost.exe") returned 0x2c [0177.832] SysStringByteLen (bstr="backgroundTaskHost.exe") returned 0x2c [0177.832] IWbemClassObject:Get (in: This=0x523d640, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x296d944*=8, plFlavor=0x296d948*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="backgroundTaskHost.exe", varVal2=0x0), pType=0x296d944*=8, plFlavor=0x296d948*=0) returned 0x0 [0177.832] SysStringByteLen (bstr="backgroundTaskHost.exe") returned 0x2c [0177.832] SysStringByteLen (bstr="backgroundTaskHost.exe") returned 0x2c [0177.832] CoTaskMemAlloc (cb=0x4) returned 0x51de598 [0177.832] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de598, puReturned=0x2945c70 | out: apObjects=0x51de598*=0x523d970, puReturned=0x2945c70*=0x1) returned 0x0 [0177.833] IUnknown:QueryInterface (in: This=0x523d970, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x523d970) returned 0x0 [0177.833] IUnknown:QueryInterface (in: This=0x523d970, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.833] IUnknown:QueryInterface (in: This=0x523d970, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.833] IUnknown:QueryInterface (in: This=0x523d970, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.834] IUnknown:AddRef (This=0x523d970) returned 0x3 [0177.834] IUnknown:QueryInterface (in: This=0x523d970, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.834] IUnknown:QueryInterface (in: This=0x523d970, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.834] IUnknown:QueryInterface (in: This=0x523d970, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x523d974) returned 0x0 [0177.834] IMarshal:GetUnmarshalClass (in: This=0x523d974, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.834] IUnknown:Release (This=0x523d974) returned 0x3 [0177.834] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.834] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.834] IUnknown:QueryInterface (in: This=0x523d970, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.834] IUnknown:Release (This=0x523d970) returned 0x2 [0177.834] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.834] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.834] IUnknown:QueryInterface (in: This=0x523d970, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x523d970) returned 0x0 [0177.834] IUnknown:AddRef (This=0x523d970) returned 0x4 [0177.834] IUnknown:Release (This=0x523d970) returned 0x3 [0177.834] IUnknown:Release (This=0x523d970) returned 0x2 [0177.834] CoTaskMemFree (pv=0x51de598) [0177.834] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.834] IUnknown:AddRef (This=0x523d970) returned 0x3 [0177.834] IWbemClassObject:Get (in: This=0x523d970, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.835] IWbemClassObject:Get (in: This=0x523d970, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4208\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.835] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4208\"") returned 0x5e [0177.835] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4208\"") returned 0x5e [0177.835] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x87c [0177.835] SetEvent (hEvent=0x638) returned 1 [0177.835] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x87c, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.837] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.837] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.837] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fd58, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x523fd58) returned 0x0 [0177.837] WbemDefPath:IUnknown:AddRef (This=0x523fd58) returned 0x3 [0177.837] WbemDefPath:IUnknown:Release (This=0x523fd58) returned 0x2 [0177.837] WbemDefPath:IWbemPath:SetText (This=0x523fd58, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4208\"") returned 0x0 [0177.837] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.837] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.837] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.837] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.837] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.837] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.837] IWbemClassObject:Get (in: This=0x523d970, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x296e244*=0, plFlavor=0x296e248*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="backgroundTaskHost.exe", varVal2=0x0), pType=0x296e244*=8, plFlavor=0x296e248*=0) returned 0x0 [0177.837] SysStringByteLen (bstr="backgroundTaskHost.exe") returned 0x2c [0177.837] SysStringByteLen (bstr="backgroundTaskHost.exe") returned 0x2c [0177.838] IWbemClassObject:Get (in: This=0x523d970, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x296e244*=8, plFlavor=0x296e248*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="backgroundTaskHost.exe", varVal2=0x0), pType=0x296e244*=8, plFlavor=0x296e248*=0) returned 0x0 [0177.838] SysStringByteLen (bstr="backgroundTaskHost.exe") returned 0x2c [0177.838] SysStringByteLen (bstr="backgroundTaskHost.exe") returned 0x2c [0177.838] CoTaskMemAlloc (cb=0x4) returned 0x51de598 [0177.838] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de598, puReturned=0x2945c70 | out: apObjects=0x51de598*=0x523dca0, puReturned=0x2945c70*=0x1) returned 0x0 [0177.839] IUnknown:QueryInterface (in: This=0x523dca0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b320 | out: ppvObject=0x19b320*=0x523dca0) returned 0x0 [0177.840] IUnknown:QueryInterface (in: This=0x523dca0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b2dc | out: ppvObject=0x19b2dc*=0x0) returned 0x80004002 [0177.840] IUnknown:QueryInterface (in: This=0x523dca0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b0fc | out: ppvObject=0x19b0fc*=0x0) returned 0x80004002 [0177.840] IUnknown:QueryInterface (in: This=0x523dca0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19aed4 | out: ppvObject=0x19aed4*=0x0) returned 0x80004002 [0177.840] IUnknown:AddRef (This=0x523dca0) returned 0x3 [0177.840] IUnknown:QueryInterface (in: This=0x523dca0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac34 | out: ppvObject=0x19ac34*=0x0) returned 0x80004002 [0177.840] IUnknown:QueryInterface (in: This=0x523dca0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19abe4 | out: ppvObject=0x19abe4*=0x0) returned 0x80004002 [0177.840] IUnknown:QueryInterface (in: This=0x523dca0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19abf0 | out: ppvObject=0x19abf0*=0x523dca4) returned 0x0 [0177.840] IMarshal:GetUnmarshalClass (in: This=0x523dca4, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19abf8 | out: pCid=0x19abf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0177.840] IUnknown:Release (This=0x523dca4) returned 0x3 [0177.840] CoGetContextToken (in: pToken=0x19ac50 | out: pToken=0x19ac50) returned 0x0 [0177.840] CoGetContextToken (in: pToken=0x19b058 | out: pToken=0x19b058) returned 0x0 [0177.840] IUnknown:QueryInterface (in: This=0x523dca0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0e4 | out: ppvObject=0x19b0e4*=0x0) returned 0x80004002 [0177.840] IUnknown:Release (This=0x523dca0) returned 0x2 [0177.840] CoGetContextToken (in: pToken=0x19b630 | out: pToken=0x19b630) returned 0x0 [0177.840] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0177.840] IUnknown:QueryInterface (in: This=0x523dca0, riid=0x19b660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b65c | out: ppvObject=0x19b65c*=0x523dca0) returned 0x0 [0177.840] IUnknown:AddRef (This=0x523dca0) returned 0x4 [0177.840] IUnknown:Release (This=0x523dca0) returned 0x3 [0177.840] IUnknown:Release (This=0x523dca0) returned 0x2 [0177.840] CoTaskMemFree (pv=0x51de598) [0177.840] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0177.841] IUnknown:AddRef (This=0x523dca0) returned 0x3 [0177.841] IWbemClassObject:Get (in: This=0x523dca0, wszName="__GENUS", lFlags=0, pVal=0x19bcb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd38*=0, plFlavor=0x19bd34*=0 | out: pVal=0x19bcb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd38*=3, plFlavor=0x19bd34*=64) returned 0x0 [0177.841] IWbemClassObject:Get (in: This=0x523dca0, wszName="__PATH", lFlags=0, pVal=0x19bc9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd20*=0, plFlavor=0x19bd1c*=0 | out: pVal=0x19bc9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4532\"", varVal2=0x0), pType=0x19bd20*=8, plFlavor=0x19bd1c*=64) returned 0x0 [0177.841] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4532\"") returned 0x5e [0177.841] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4532\"") returned 0x5e [0177.841] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x880 [0177.841] SetEvent (hEvent=0x638) returned 1 [0177.841] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc74*=0x880, lpdwindex=0x19ba94 | out: lpdwindex=0x19ba94) returned 0x0 [0177.843] CoGetContextToken (in: pToken=0x19bb40 | out: pToken=0x19bb40) returned 0x0 [0177.843] CoGetContextToken (in: pToken=0x19baa0 | out: pToken=0x19baa0) returned 0x0 [0177.843] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fdc8, riid=0x19bb70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bb6c | out: ppvObject=0x19bb6c*=0x523fdc8) returned 0x0 [0177.843] WbemDefPath:IUnknown:AddRef (This=0x523fdc8) returned 0x3 [0177.843] WbemDefPath:IUnknown:Release (This=0x523fdc8) returned 0x2 [0177.843] WbemDefPath:IWbemPath:SetText (This=0x523fdc8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4532\"") returned 0x0 [0177.843] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcf4 | out: puCount=0x19bcf4*=0x2) returned 0x0 [0177.843] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0x0, pszText=0x0 | out: puBuffLength=0x19bcf0*=0xf, pszText=0x0) returned 0x0 [0177.844] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.844] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bcc0 | out: puCount=0x19bcc0*=0x2) returned 0x0 [0177.844] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcbc*=0xf, pszText=0x0) returned 0x0 [0177.844] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0177.844] IWbemClassObject:Get (in: This=0x523dca0, wszName="Name", lFlags=0, pVal=0x19bcbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x296eb44*=0, plFlavor=0x296eb48*=0 | out: pVal=0x19bcbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe", varVal2=0x0), pType=0x296eb44*=8, plFlavor=0x296eb48*=0) returned 0x0 [0177.844] SysStringByteLen (bstr="a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe") returned 0x88 [0177.844] SysStringByteLen (bstr="a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe") returned 0x88 [0177.844] IWbemClassObject:Get (in: This=0x523dca0, wszName="Name", lFlags=0, pVal=0x19bcc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x296eb44*=8, plFlavor=0x296eb48*=0 | out: pVal=0x19bcc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe", varVal2=0x0), pType=0x296eb44*=8, plFlavor=0x296eb48*=0) returned 0x0 [0177.844] SysStringByteLen (bstr="a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe") returned 0x88 [0177.844] SysStringByteLen (bstr="a4bac13abfd454b26ddd32a25d87080e7e4bf8b6a9e85e7e91736b3f944565c3.exe") returned 0x88 [0177.844] CoTaskMemAlloc (cb=0x4) returned 0x51de638 [0177.844] IEnumWbemClassObject:Next (in: This=0x6d2010, lTimeout=-1, uCount=0x1, apObjects=0x51de638, puReturned=0x2945c70 | out: apObjects=0x51de638*=0x0, puReturned=0x2945c70*=0x0) returned 0x1 [0177.845] CoTaskMemFree (pv=0x51de638) [0177.845] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0177.845] WbemLocator:IUnknown:Release (This=0x520cde0) returned 0x1 [0177.845] IUnknown:Release (This=0x6d2010) returned 0x0 [0177.847] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0177.847] WbemLocator:IUnknown:Release (This=0x520b6e0) returned 0x1 [0177.847] IUnknown:Release (This=0x6d2a38) returned 0x0 [0177.854] CoTaskMemAlloc (cb=0x20c) returned 0x51e97c8 [0177.854] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x51e97c8 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0177.854] CoTaskMemFree (pv=0x51e97c8) [0177.854] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19b798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0177.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd4c) returned 1 [0177.857] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\tdata", nBufferLength=0x105, lpBuffer=0x19b80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\tdata", lpFilePart=0x0) returned 0x3c [0177.857] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\tdata\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telegram desktop\\tdata\\*"), lpFindFileData=0x19ba74 | out: lpFindFileData=0x19ba74*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0177.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bd10) returned 1 [0177.859] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\tdata", nBufferLength=0x105, lpBuffer=0x19b88c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\tdata", lpFilePart=0x0) returned 0x3c [0177.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bda0) returned 1 [0177.859] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\tdata", nBufferLength=0x105, lpBuffer=0x19b860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\tdata", lpFilePart=0x0) returned 0x3c [0177.859] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\tdata\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telegram desktop\\tdata\\*"), lpFindFileData=0x19bac8 | out: lpFindFileData=0x19bac8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0177.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bd64) returned 1 [0177.879] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\WOW6432Node\\Clients\\StartMenuInternet", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bdac | out: phkResult=0x19bdac*=0x884) returned 0x0 [0177.879] RegQueryInfoKeyW (in: hKey=0x884, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x19bdd4, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x19bdd0, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x19bdd4*=0x1, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x19bdd0*=0x1, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0177.879] RegEnumKeyExW (in: hKey=0x884, dwIndex=0x0, lpName=0x297070c, lpcchName=0x19bdf0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IEXPLORE.EXE", lpcchName=0x19bdf0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0177.879] CoTaskMemFree (pv=0x0) [0177.882] RegOpenKeyExW (in: hKey=0x884, lpSubKey="IEXPLORE.EXE", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bdac | out: phkResult=0x19bdac*=0x888) returned 0x0 [0177.882] RegQueryValueExW (in: hKey=0x888, lpValueName=0x0, lpReserved=0x0, lpType=0x19bdcc, lpData=0x0, lpcbData=0x19bdc8*=0x0 | out: lpType=0x19bdcc*=0x1, lpData=0x0, lpcbData=0x19bdc8*=0x24) returned 0x0 [0177.882] RegQueryValueExW (in: hKey=0x888, lpValueName=0x0, lpReserved=0x0, lpType=0x19bdcc, lpData=0x2970a38, lpcbData=0x19bdc8*=0x24 | out: lpType=0x19bdcc*=0x1, lpData="Internet Explorer", lpcbData=0x19bdc8*=0x24) returned 0x0 [0177.884] RegOpenKeyExW (in: hKey=0x888, lpSubKey="shell\\open\\command", ulOptions=0x0, samDesired=0x20019, phkResult=0x19bdac | out: phkResult=0x19bdac*=0x88c) returned 0x0 [0177.884] RegQueryValueExW (in: hKey=0x88c, lpValueName=0x0, lpReserved=0x0, lpType=0x19bdcc, lpData=0x0, lpcbData=0x19bdc8*=0x0 | out: lpType=0x19bdcc*=0x1, lpData=0x0, lpcbData=0x19bdc8*=0x60) returned 0x0 [0177.884] RegQueryValueExW (in: hKey=0x88c, lpValueName=0x0, lpReserved=0x0, lpType=0x19bdcc, lpData=0x2970c20, lpcbData=0x19bdc8*=0x60 | out: lpType=0x19bdcc*=0x1, lpData="C:\\Program Files\\Internet Explorer\\iexplore.exe", lpcbData=0x19bdc8*=0x60) returned 0x0 [0177.891] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Internet Explorer\\iexplore.exe", nBufferLength=0x105, lpBuffer=0x19b860, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Internet Explorer\\iexplore.exe", lpFilePart=0x0) returned 0x2f [0177.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd08) returned 1 [0177.891] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe"), fInfoLevelId=0x0, lpFileInformation=0x19bd84 | out: lpFileInformation=0x19bd84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33517c70, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x33517c70, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x33517c70, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc74c0)) returned 1 [0177.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bd04) returned 1 [0177.891] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Program Files\\Internet Explorer\\iexplore.exe", lpdwHandle=0x19bdf8 | out: lpdwHandle=0x19bdf8) returned 0xba4 [0178.054] GetFileVersionInfoW (in: lptstrFilename="C:\\Program Files\\Internet Explorer\\iexplore.exe", dwHandle=0x0, dwLen=0xba4, lpData=0x2970dd8 | out: lpData=0x2970dd8) returned 1 [0178.059] VerQueryValueW (in: pBlock=0x2970dd8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19bdcc, puLen=0x19bdc8 | out: lplpBuffer=0x19bdcc*=0x29713a4, puLen=0x19bdc8) returned 1 [0178.060] VerQueryValueW (in: pBlock=0x2970dd8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x19bd4c, puLen=0x19bd48 | out: lplpBuffer=0x19bd4c*=0x2970e90, puLen=0x19bd48) returned 1 [0178.060] VerQueryValueW (in: pBlock=0x2970dd8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x19bd4c, puLen=0x19bd48 | out: lplpBuffer=0x19bd4c*=0x2970ee4, puLen=0x19bd48) returned 1 [0178.060] VerQueryValueW (in: pBlock=0x2970dd8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x19bd4c, puLen=0x19bd48 | out: lplpBuffer=0x19bd4c*=0x2970f28, puLen=0x19bd48) returned 1 [0178.060] VerQueryValueW (in: pBlock=0x2970dd8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x19bd4c, puLen=0x19bd48 | out: lplpBuffer=0x19bd4c*=0x2970f98, puLen=0x19bd48) returned 1 [0178.060] VerQueryValueW (in: pBlock=0x2970dd8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x19bd4c, puLen=0x19bd48 | out: lplpBuffer=0x19bd4c*=0x2970fd0, puLen=0x19bd48) returned 1 [0178.060] VerQueryValueW (in: pBlock=0x2970dd8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x19bd4c, puLen=0x19bd48 | out: lplpBuffer=0x19bd4c*=0x2971054, puLen=0x19bd48) returned 1 [0178.060] VerQueryValueW (in: pBlock=0x2970dd8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x19bd4c, puLen=0x19bd48 | out: lplpBuffer=0x19bd4c*=0x2971098, puLen=0x19bd48) returned 1 [0178.060] VerQueryValueW (in: pBlock=0x2970dd8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x19bd4c, puLen=0x19bd48 | out: lplpBuffer=0x19bd4c*=0x29710e0, puLen=0x19bd48) returned 1 [0178.060] VerQueryValueW (in: pBlock=0x2970dd8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x19bd4c, puLen=0x19bd48 | out: lplpBuffer=0x19bd4c*=0x0, puLen=0x19bd48) returned 0 [0178.060] VerQueryValueW (in: pBlock=0x2970dd8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x19bd4c, puLen=0x19bd48 | out: lplpBuffer=0x19bd4c*=0x0, puLen=0x19bd48) returned 0 [0178.060] VerQueryValueW (in: pBlock=0x2970dd8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x19bd4c, puLen=0x19bd48 | out: lplpBuffer=0x19bd4c*=0x0, puLen=0x19bd48) returned 0 [0178.060] VerQueryValueW (in: pBlock=0x2970dd8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x19bd4c, puLen=0x19bd48 | out: lplpBuffer=0x19bd4c*=0x0, puLen=0x19bd48) returned 0 [0178.060] VerQueryValueW (in: pBlock=0x2970dd8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19bd40, puLen=0x19bd3c | out: lplpBuffer=0x19bd40*=0x29713a4, puLen=0x19bd3c) returned 1 [0178.060] VerLanguageNameW (in: wLang=0x409, szLang=0x19bad0, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0178.060] VerQueryValueW (in: pBlock=0x2970dd8, lpSubBlock="\\", lplpBuffer=0x19bd50, puLen=0x19bd4c | out: lplpBuffer=0x19bd50*=0x2970e00, puLen=0x19bd4c) returned 1 [0178.079] CoTaskMemAlloc (cb=0x20c) returned 0x51ea290 [0178.079] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x51ea290 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0178.079] CoTaskMemFree (pv=0x51ea290) [0178.079] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19b80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0178.079] CoTaskMemAlloc (cb=0x20c) returned 0x51ea068 [0178.079] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x51ea068 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0178.079] CoTaskMemFree (pv=0x51ea068) [0178.079] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19b80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0178.080] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FileZilla\\recentservers.xml", nBufferLength=0x105, lpBuffer=0x19b8a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FileZilla\\recentservers.xml", lpFilePart=0x0) returned 0x41 [0178.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd4c) returned 1 [0178.080] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FileZilla\\recentservers.xml" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\filezilla\\recentservers.xml"), fInfoLevelId=0x0, lpFileInformation=0x19bdc8 | out: lpFileInformation=0x19bdc8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0178.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bd48) returned 1 [0178.080] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FileZilla\\sitemanager.xml", nBufferLength=0x105, lpBuffer=0x19b8a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FileZilla\\sitemanager.xml", lpFilePart=0x0) returned 0x3f [0178.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19bd4c) returned 1 [0178.080] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FileZilla\\sitemanager.xml" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\filezilla\\sitemanager.xml"), fInfoLevelId=0x0, lpFileInformation=0x19bdc8 | out: lpFileInformation=0x19bdc8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0178.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19bd48) returned 1 [0178.122] GetKeyboardLayoutList (in: nBuff=0, lpList=0x0 | out: lpList=0x0) returned 1 [0178.123] GetKeyboardLayoutList (in: nBuff=1, lpList=0x29735a8 | out: lpList=0x29735a8) returned 1 [0178.183] GetCurrentProcessId () returned 0x11b4 [0178.184] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x37e9958, Length=0x20000, ResultLength=0x19bdbc | out: SystemInformation=0x37e9958, ResultLength=0x19bdbc*=0x14a48) returned 0x0 [0178.204] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bda4 | out: puCount=0x19bda4*=0x2) returned 0x0 [0178.204] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bda0*=0x0, pszText=0x0 | out: puBuffLength=0x19bda0*=0xf, pszText=0x0) returned 0x0 [0178.204] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bda0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bda0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0178.218] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc4c*=0x8a4, lpdwindex=0x19bafc | out: lpdwindex=0x19bafc) returned 0x0 [0178.256] CoGetContextToken (in: pToken=0x19ba10 | out: pToken=0x19ba10) returned 0x0 [0178.256] CoGetContextToken (in: pToken=0x19b9b8 | out: pToken=0x19b9b8) returned 0x0 [0178.256] IUnknown:QueryInterface (in: This=0x66f9c0, riid=0x6f12da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b994 | out: ppvObject=0x19b994*=0x66f9d0) returned 0x0 [0178.256] CObjectContext::ContextCallback () returned 0x0 [0178.257] IUnknown:Release (This=0x66f9d0) returned 0x1 [0178.258] CoUnmarshalInterface (in: pStm=0x5209ae0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19ba04 | out: ppv=0x19ba04*=0x520cce0) returned 0x0 [0178.258] CoMarshalInterface (pStm=0x5209ae0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x520cce0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0178.258] WbemLocator:IUnknown:QueryInterface (in: This=0x520cce0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b8a4 | out: ppvObject=0x19b8a4*=0x520cce0) returned 0x0 [0178.258] WbemLocator:IUnknown:QueryInterface (in: This=0x520cce0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b860 | out: ppvObject=0x19b860*=0x0) returned 0x80004002 [0178.259] WbemLocator:IUnknown:QueryInterface (in: This=0x520cce0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b67c | out: ppvObject=0x19b67c*=0x0) returned 0x80004002 [0178.259] WbemLocator:IUnknown:QueryInterface (in: This=0x520cce0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b454 | out: ppvObject=0x19b454*=0x0) returned 0x80004002 [0178.260] WbemLocator:IUnknown:AddRef (This=0x520cce0) returned 0x3 [0178.260] WbemLocator:IUnknown:QueryInterface (in: This=0x520cce0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b1b4 | out: ppvObject=0x19b1b4*=0x0) returned 0x80004002 [0178.260] WbemLocator:IUnknown:QueryInterface (in: This=0x520cce0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19b164 | out: ppvObject=0x19b164*=0x0) returned 0x80004002 [0178.260] WbemLocator:IUnknown:QueryInterface (in: This=0x520cce0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b170 | out: ppvObject=0x19b170*=0x520cc3c) returned 0x0 [0178.260] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520cc3c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b178 | out: pCid=0x19b178*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0178.260] WbemLocator:IUnknown:Release (This=0x520cc3c) returned 0x3 [0178.260] CoGetContextToken (in: pToken=0x19b1d0 | out: pToken=0x19b1d0) returned 0x0 [0178.260] CoGetContextToken (in: pToken=0x19b5d8 | out: pToken=0x19b5d8) returned 0x0 [0178.260] WbemLocator:IUnknown:QueryInterface (in: This=0x520cce0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b664 | out: ppvObject=0x19b664*=0x520ccc4) returned 0x0 [0178.261] WbemLocator:IRpcOptions:Query (in: This=0x520ccc4, pPrx=0x520cce0, dwProperty=2, pdwValue=0x19b670 | out: pdwValue=0x19b670) returned 0x0 [0178.261] WbemLocator:IUnknown:Release (This=0x520ccc4) returned 0x3 [0178.261] WbemLocator:IUnknown:Release (This=0x520cce0) returned 0x2 [0178.261] WbemLocator:IUnknown:Release (This=0x520cce0) returned 0x1 [0178.261] CoGetContextToken (in: pToken=0x19b950 | out: pToken=0x19b950) returned 0x0 [0178.261] WbemLocator:IUnknown:AddRef (This=0x520cce0) returned 0x2 [0178.261] WbemLocator:IUnknown:QueryInterface (in: This=0x520cce0, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bc04 | out: ppvObject=0x19bc04*=0x520ccbc) returned 0x0 [0178.261] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x520ccbc, pProxy=0x520cce0, pAuthnSvc=0x19bc54, pAuthzSvc=0x19bc50, pServerPrincName=0x19bc48, pAuthnLevel=0x19bc4c, pImpLevel=0x19bc3c, pAuthInfo=0x19bc40, pCapabilites=0x19bc44 | out: pAuthnSvc=0x19bc54*=0xa, pAuthzSvc=0x19bc50*=0x0, pServerPrincName=0x19bc48, pAuthnLevel=0x19bc4c*=0x6, pImpLevel=0x19bc3c*=0x2, pAuthInfo=0x19bc40, pCapabilites=0x19bc44*=0x1) returned 0x0 [0178.261] WbemLocator:IUnknown:Release (This=0x520ccbc) returned 0x2 [0178.261] WbemLocator:IUnknown:QueryInterface (in: This=0x520cce0, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbf8 | out: ppvObject=0x19bbf8*=0x520cce0) returned 0x0 [0178.261] WbemLocator:IUnknown:QueryInterface (in: This=0x520cce0, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbe4 | out: ppvObject=0x19bbe4*=0x520ccbc) returned 0x0 [0178.261] WbemLocator:IClientSecurity:SetBlanket (This=0x520ccbc, pProxy=0x520cce0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0178.262] WbemLocator:IUnknown:Release (This=0x520ccbc) returned 0x3 [0178.262] WbemLocator:IUnknown:Release (This=0x520cce0) returned 0x2 [0178.262] CoTaskMemFree (pv=0x51f8f78) [0178.262] WbemLocator:IUnknown:Release (This=0x520cce0) returned 0x1 [0178.262] SysStringLen (param_1=0x0) returned 0x0 [0178.262] CoGetContextToken (in: pToken=0x19bbc0 | out: pToken=0x19bbc0) returned 0x0 [0178.262] CoGetContextToken (in: pToken=0x19bb20 | out: pToken=0x19bb20) returned 0x0 [0178.262] WbemLocator:IUnknown:QueryInterface (in: This=0x520cce0, riid=0x19bbf0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19bbec | out: ppvObject=0x19bbec*=0x52483c0) returned 0x0 [0178.263] WbemLocator:IUnknown:AddRef (This=0x52483c0) returned 0x3 [0178.263] WbemLocator:IUnknown:Release (This=0x52483c0) returned 0x2 [0178.263] CoGetContextToken (in: pToken=0x19bb80 | out: pToken=0x19bb80) returned 0x0 [0178.263] WbemLocator:IUnknown:AddRef (This=0x52483c0) returned 0x3 [0178.263] WbemLocator:IUnknown:QueryInterface (in: This=0x52483c0, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bc04 | out: ppvObject=0x19bc04*=0x520ccbc) returned 0x0 [0178.263] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x520ccbc, pProxy=0x52483c0, pAuthnSvc=0x19bc54, pAuthzSvc=0x19bc50, pServerPrincName=0x19bc48, pAuthnLevel=0x19bc4c, pImpLevel=0x19bc3c, pAuthInfo=0x19bc40, pCapabilites=0x19bc44 | out: pAuthnSvc=0x19bc54*=0xa, pAuthzSvc=0x19bc50*=0x0, pServerPrincName=0x19bc48, pAuthnLevel=0x19bc4c*=0x6, pImpLevel=0x19bc3c*=0x2, pAuthInfo=0x19bc40, pCapabilites=0x19bc44*=0x1) returned 0x0 [0178.263] WbemLocator:IUnknown:Release (This=0x520ccbc) returned 0x3 [0178.263] WbemLocator:IUnknown:QueryInterface (in: This=0x52483c0, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbf8 | out: ppvObject=0x19bbf8*=0x520cce0) returned 0x0 [0178.263] WbemLocator:IUnknown:QueryInterface (in: This=0x52483c0, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbe4 | out: ppvObject=0x19bbe4*=0x520ccbc) returned 0x0 [0178.263] WbemLocator:IClientSecurity:SetBlanket (This=0x520ccbc, pProxy=0x52483c0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0178.264] WbemLocator:IUnknown:Release (This=0x520ccbc) returned 0x4 [0178.264] WbemLocator:IUnknown:Release (This=0x520cce0) returned 0x3 [0178.264] CoTaskMemFree (pv=0x51f8f78) [0178.264] WbemLocator:IUnknown:Release (This=0x52483c0) returned 0x2 [0178.264] SysStringLen (param_1=0x0) returned 0x0 [0178.264] CoGetContextToken (in: pToken=0x19bae0 | out: pToken=0x19bae0) returned 0x0 [0178.264] WbemLocator:IUnknown:AddRef (This=0x52483c0) returned 0x3 [0178.264] IWbemServices:ExecQuery (in: This=0x52483c0, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_Process Where SessionId='1'", lFlags=16, pCtx=0x0, ppEnum=0x19bd14 | out: ppEnum=0x19bd14*=0x6d2650) returned 0x0 [0178.360] IUnknown:QueryInterface (in: This=0x6d2650, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb4c | out: ppvObject=0x19bb4c*=0x6d2654) returned 0x0 [0178.360] IClientSecurity:QueryBlanket (in: This=0x6d2654, pProxy=0x6d2650, pAuthnSvc=0x19bb9c, pAuthzSvc=0x19bb98, pServerPrincName=0x19bb90, pAuthnLevel=0x19bb94, pImpLevel=0x19bb84, pAuthInfo=0x19bb88, pCapabilites=0x19bb8c | out: pAuthnSvc=0x19bb9c*=0xa, pAuthzSvc=0x19bb98*=0x0, pServerPrincName=0x19bb90, pAuthnLevel=0x19bb94*=0x6, pImpLevel=0x19bb84*=0x2, pAuthInfo=0x19bb88, pCapabilites=0x19bb8c*=0x1) returned 0x0 [0178.360] IUnknown:Release (This=0x6d2654) returned 0x1 [0178.360] IUnknown:QueryInterface (in: This=0x6d2650, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb40 | out: ppvObject=0x19bb40*=0x520b2e0) returned 0x0 [0178.360] IUnknown:QueryInterface (in: This=0x6d2650, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb2c | out: ppvObject=0x19bb2c*=0x6d2654) returned 0x0 [0178.360] IClientSecurity:SetBlanket (This=0x6d2654, pProxy=0x6d2650, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0178.362] IUnknown:Release (This=0x6d2654) returned 0x2 [0178.362] WbemLocator:IUnknown:Release (This=0x520b2e0) returned 0x1 [0178.362] CoTaskMemFree (pv=0x51f8f78) [0178.363] IUnknown:QueryInterface (in: This=0x6d2650, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b738 | out: ppvObject=0x19b738*=0x520b2e0) returned 0x0 [0178.363] WbemLocator:IUnknown:QueryInterface (in: This=0x520b2e0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b6f4 | out: ppvObject=0x19b6f4*=0x0) returned 0x80004002 [0178.364] WbemLocator:IUnknown:QueryInterface (in: This=0x520b2e0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b514 | out: ppvObject=0x19b514*=0x0) returned 0x80004002 [0178.364] IUnknown:QueryInterface (in: This=0x6d2650, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b2ec | out: ppvObject=0x19b2ec*=0x0) returned 0x80004002 [0178.365] WbemLocator:IUnknown:AddRef (This=0x520b2e0) returned 0x3 [0178.365] WbemLocator:IUnknown:QueryInterface (in: This=0x520b2e0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b04c | out: ppvObject=0x19b04c*=0x0) returned 0x80004002 [0178.365] WbemLocator:IUnknown:QueryInterface (in: This=0x520b2e0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19affc | out: ppvObject=0x19affc*=0x0) returned 0x80004002 [0178.365] WbemLocator:IUnknown:QueryInterface (in: This=0x520b2e0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b008 | out: ppvObject=0x19b008*=0x520b23c) returned 0x0 [0178.365] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520b23c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b010 | out: pCid=0x19b010*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0178.365] WbemLocator:IUnknown:Release (This=0x520b23c) returned 0x3 [0178.365] CoGetContextToken (in: pToken=0x19b068 | out: pToken=0x19b068) returned 0x0 [0178.365] CoGetContextToken (in: pToken=0x19b470 | out: pToken=0x19b470) returned 0x0 [0178.365] WbemLocator:IUnknown:QueryInterface (in: This=0x520b2e0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b4fc | out: ppvObject=0x19b4fc*=0x520b2c4) returned 0x0 [0178.365] WbemLocator:IRpcOptions:Query (in: This=0x520b2c4, pPrx=0x520b2e0, dwProperty=2, pdwValue=0x19b508 | out: pdwValue=0x19b508) returned 0x80004002 [0178.365] WbemLocator:IUnknown:Release (This=0x520b2c4) returned 0x3 [0178.365] WbemLocator:IUnknown:Release (This=0x520b2e0) returned 0x2 [0178.365] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0178.365] CoGetContextToken (in: pToken=0x19b9a8 | out: pToken=0x19b9a8) returned 0x0 [0178.365] WbemLocator:IUnknown:QueryInterface (in: This=0x520b2e0, riid=0x19ba78*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19ba74 | out: ppvObject=0x19ba74*=0x6d2650) returned 0x0 [0178.366] IUnknown:AddRef (This=0x6d2650) returned 0x4 [0178.366] IUnknown:Release (This=0x6d2650) returned 0x3 [0178.366] IUnknown:Release (This=0x6d2650) returned 0x2 [0178.366] WbemLocator:IUnknown:Release (This=0x52483c0) returned 0x2 [0178.366] SysStringLen (param_1=0x0) returned 0x0 [0178.366] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd60 | out: puCount=0x19bd60*=0x2) returned 0x0 [0178.366] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd5c*=0x0, pszText=0x0 | out: puBuffLength=0x19bd5c*=0xf, pszText=0x0) returned 0x0 [0178.366] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd5c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd5c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0178.366] CoGetContextToken (in: pToken=0x19bbb0 | out: pToken=0x19bbb0) returned 0x0 [0178.366] IUnknown:AddRef (This=0x6d2650) returned 0x3 [0178.366] IEnumWbemClassObject:Clone (in: This=0x6d2650, ppEnum=0x19bd6c | out: ppEnum=0x19bd6c*=0x6d24c0) returned 0x0 [0178.367] IUnknown:QueryInterface (in: This=0x6d24c0, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bc28 | out: ppvObject=0x19bc28*=0x6d24c4) returned 0x0 [0178.367] IClientSecurity:QueryBlanket (in: This=0x6d24c4, pProxy=0x6d24c0, pAuthnSvc=0x19bc78, pAuthzSvc=0x19bc74, pServerPrincName=0x19bc6c, pAuthnLevel=0x19bc70, pImpLevel=0x19bc60, pAuthInfo=0x19bc64, pCapabilites=0x19bc68 | out: pAuthnSvc=0x19bc78*=0xa, pAuthzSvc=0x19bc74*=0x0, pServerPrincName=0x19bc6c, pAuthnLevel=0x19bc70*=0x6, pImpLevel=0x19bc60*=0x2, pAuthInfo=0x19bc64, pCapabilites=0x19bc68*=0x1) returned 0x0 [0178.367] IUnknown:Release (This=0x6d24c4) returned 0x1 [0178.368] IUnknown:QueryInterface (in: This=0x6d24c0, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bc1c | out: ppvObject=0x19bc1c*=0x520c3e0) returned 0x0 [0178.368] IUnknown:QueryInterface (in: This=0x6d24c0, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bc08 | out: ppvObject=0x19bc08*=0x6d24c4) returned 0x0 [0178.368] IClientSecurity:SetBlanket (This=0x6d24c4, pProxy=0x6d24c0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0178.369] IUnknown:Release (This=0x6d24c4) returned 0x2 [0178.369] WbemLocator:IUnknown:Release (This=0x520c3e0) returned 0x1 [0178.370] CoTaskMemFree (pv=0x51f8a98) [0178.370] IUnknown:QueryInterface (in: This=0x6d24c0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b804 | out: ppvObject=0x19b804*=0x520c3e0) returned 0x0 [0178.370] WbemLocator:IUnknown:QueryInterface (in: This=0x520c3e0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b7c0 | out: ppvObject=0x19b7c0*=0x0) returned 0x80004002 [0178.410] WbemLocator:IUnknown:QueryInterface (in: This=0x520c3e0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b5dc | out: ppvObject=0x19b5dc*=0x0) returned 0x80004002 [0178.417] IUnknown:QueryInterface (in: This=0x6d24c0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b3b4 | out: ppvObject=0x19b3b4*=0x0) returned 0x80004002 [0178.489] WbemLocator:IUnknown:AddRef (This=0x520c3e0) returned 0x3 [0178.489] WbemLocator:IUnknown:QueryInterface (in: This=0x520c3e0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b114 | out: ppvObject=0x19b114*=0x0) returned 0x80004002 [0178.489] WbemLocator:IUnknown:QueryInterface (in: This=0x520c3e0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19b0c4 | out: ppvObject=0x19b0c4*=0x0) returned 0x80004002 [0178.489] WbemLocator:IUnknown:QueryInterface (in: This=0x520c3e0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b0d0 | out: ppvObject=0x19b0d0*=0x520c33c) returned 0x0 [0178.489] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520c33c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b0d8 | out: pCid=0x19b0d8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0178.489] WbemLocator:IUnknown:Release (This=0x520c33c) returned 0x3 [0178.489] CoGetContextToken (in: pToken=0x19b130 | out: pToken=0x19b130) returned 0x0 [0178.489] CoGetContextToken (in: pToken=0x19b538 | out: pToken=0x19b538) returned 0x0 [0178.489] WbemLocator:IUnknown:QueryInterface (in: This=0x520c3e0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b5c4 | out: ppvObject=0x19b5c4*=0x520c3c4) returned 0x0 [0178.490] WbemLocator:IRpcOptions:Query (in: This=0x520c3c4, pPrx=0x520c3e0, dwProperty=2, pdwValue=0x19b5d0 | out: pdwValue=0x19b5d0) returned 0x80004002 [0178.490] WbemLocator:IUnknown:Release (This=0x520c3c4) returned 0x3 [0178.490] WbemLocator:IUnknown:Release (This=0x520c3e0) returned 0x2 [0178.490] CoGetContextToken (in: pToken=0x19bb18 | out: pToken=0x19bb18) returned 0x0 [0178.490] CoGetContextToken (in: pToken=0x19ba78 | out: pToken=0x19ba78) returned 0x0 [0178.490] WbemLocator:IUnknown:QueryInterface (in: This=0x520c3e0, riid=0x19bb48*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19bb44 | out: ppvObject=0x19bb44*=0x6d24c0) returned 0x0 [0178.490] IUnknown:AddRef (This=0x6d24c0) returned 0x4 [0178.490] IUnknown:Release (This=0x6d24c0) returned 0x3 [0178.490] IUnknown:Release (This=0x6d24c0) returned 0x2 [0178.490] IUnknown:Release (This=0x6d2650) returned 0x2 [0178.490] SysStringLen (param_1=0x0) returned 0x0 [0178.490] IEnumWbemClassObject:Reset (This=0x6d24c0) returned 0x0 [0178.536] CoTaskMemAlloc (cb=0x4) returned 0x71d350 [0178.536] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d350, puReturned=0x2995760 | out: apObjects=0x71d350*=0x523de38, puReturned=0x2995760*=0x1) returned 0x0 [0179.259] IUnknown:QueryInterface (in: This=0x523de38, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x523de38) returned 0x0 [0179.260] IUnknown:QueryInterface (in: This=0x523de38, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0179.260] IUnknown:QueryInterface (in: This=0x523de38, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0179.260] IUnknown:QueryInterface (in: This=0x523de38, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0179.260] IUnknown:AddRef (This=0x523de38) returned 0x3 [0179.260] IUnknown:QueryInterface (in: This=0x523de38, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0179.260] IUnknown:QueryInterface (in: This=0x523de38, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0179.260] IUnknown:QueryInterface (in: This=0x523de38, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x523de3c) returned 0x0 [0179.260] IMarshal:GetUnmarshalClass (in: This=0x523de3c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0179.260] IUnknown:Release (This=0x523de3c) returned 0x3 [0179.260] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0179.260] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0179.260] IUnknown:QueryInterface (in: This=0x523de38, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0179.260] IUnknown:Release (This=0x523de38) returned 0x2 [0179.260] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0179.260] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0179.260] IUnknown:QueryInterface (in: This=0x523de38, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x523de38) returned 0x0 [0179.261] IUnknown:AddRef (This=0x523de38) returned 0x4 [0179.261] IUnknown:Release (This=0x523de38) returned 0x3 [0179.261] IUnknown:Release (This=0x523de38) returned 0x2 [0179.261] CoTaskMemFree (pv=0x71d350) [0179.261] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0179.261] IUnknown:AddRef (This=0x523de38) returned 0x3 [0179.261] IWbemClassObject:Get (in: This=0x523de38, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0179.261] IWbemClassObject:Get (in: This=0x523de38, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"456\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0179.261] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"456\"") returned 0x5c [0179.261] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"456\"") returned 0x5c [0179.261] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x8a8 [0179.261] SetEvent (hEvent=0x638) returned 1 [0179.261] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x8a8, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0179.334] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0179.334] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0179.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fc78, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x523fc78) returned 0x0 [0179.334] WbemDefPath:IUnknown:AddRef (This=0x523fc78) returned 0x3 [0179.334] WbemDefPath:IUnknown:Release (This=0x523fc78) returned 0x2 [0179.334] WbemDefPath:IWbemPath:SetText (This=0x523fc78, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"456\"") returned 0x0 [0179.334] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0179.334] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0179.334] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.334] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0179.334] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0179.334] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.335] IWbemClassObject:Get (in: This=0x523de38, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2996038*=0, plFlavor=0x299603c*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1c8, varVal2=0x0), pType=0x2996038*=19, plFlavor=0x299603c*=0) returned 0x0 [0179.335] IWbemClassObject:Get (in: This=0x523de38, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2996038*=19, plFlavor=0x299603c*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1c8, varVal2=0x0), pType=0x2996038*=19, plFlavor=0x299603c*=0) returned 0x0 [0179.337] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0179.337] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0179.337] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.337] IWbemClassObject:Get (in: This=0x523de38, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2996138*=0, plFlavor=0x299613c*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="csrss.exe", varVal2=0x0), pType=0x2996138*=8, plFlavor=0x299613c*=0) returned 0x0 [0179.338] SysStringByteLen (bstr="csrss.exe") returned 0x12 [0179.338] SysStringByteLen (bstr="csrss.exe") returned 0x12 [0179.338] IWbemClassObject:Get (in: This=0x523de38, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2996138*=8, plFlavor=0x299613c*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="csrss.exe", varVal2=0x0), pType=0x2996138*=8, plFlavor=0x299613c*=0) returned 0x0 [0179.338] SysStringByteLen (bstr="csrss.exe") returned 0x12 [0179.338] SysStringByteLen (bstr="csrss.exe") returned 0x12 [0179.338] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0179.338] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0179.338] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.338] IWbemClassObject:Get (in: This=0x523de38, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299626c*=0, plFlavor=0x2996270*=0 | out: pVal=0x19bd60*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299626c*=8, plFlavor=0x2996270*=32) returned 0x0 [0179.339] IWbemClassObject:Get (in: This=0x523de38, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299626c*=8, plFlavor=0x2996270*=32 | out: pVal=0x19bd68*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299626c*=8, plFlavor=0x2996270*=32) returned 0x0 [0179.339] CoTaskMemAlloc (cb=0x4) returned 0x71d380 [0179.339] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d380, puReturned=0x2995760 | out: apObjects=0x71d380*=0x5251bb0, puReturned=0x2995760*=0x1) returned 0x0 [0179.379] IUnknown:QueryInterface (in: This=0x5251bb0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5251bb0) returned 0x0 [0179.380] IUnknown:QueryInterface (in: This=0x5251bb0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0179.380] IUnknown:QueryInterface (in: This=0x5251bb0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0179.380] IUnknown:QueryInterface (in: This=0x5251bb0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0179.380] IUnknown:AddRef (This=0x5251bb0) returned 0x3 [0179.380] IUnknown:QueryInterface (in: This=0x5251bb0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0179.380] IUnknown:QueryInterface (in: This=0x5251bb0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0179.380] IUnknown:QueryInterface (in: This=0x5251bb0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5251bb4) returned 0x0 [0179.380] IMarshal:GetUnmarshalClass (in: This=0x5251bb4, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0179.380] IUnknown:Release (This=0x5251bb4) returned 0x3 [0179.380] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0179.381] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0179.381] IUnknown:QueryInterface (in: This=0x5251bb0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0179.381] IUnknown:Release (This=0x5251bb0) returned 0x2 [0179.381] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0179.381] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0179.381] IUnknown:QueryInterface (in: This=0x5251bb0, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5251bb0) returned 0x0 [0179.381] IUnknown:AddRef (This=0x5251bb0) returned 0x4 [0179.381] IUnknown:Release (This=0x5251bb0) returned 0x3 [0179.381] IUnknown:Release (This=0x5251bb0) returned 0x2 [0179.381] CoTaskMemFree (pv=0x71d380) [0179.381] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0179.381] IUnknown:AddRef (This=0x5251bb0) returned 0x3 [0179.381] IWbemClassObject:Get (in: This=0x5251bb0, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0179.381] IWbemClassObject:Get (in: This=0x5251bb0, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"508\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0179.381] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"508\"") returned 0x5c [0179.381] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"508\"") returned 0x5c [0179.381] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x8ac [0179.382] SetEvent (hEvent=0x638) returned 1 [0179.382] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x8ac, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0179.436] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0179.436] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0179.436] WbemDefPath:IUnknown:QueryInterface (in: This=0x523ff18, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x523ff18) returned 0x0 [0179.436] WbemDefPath:IUnknown:AddRef (This=0x523ff18) returned 0x3 [0179.436] WbemDefPath:IUnknown:Release (This=0x523ff18) returned 0x2 [0179.436] WbemDefPath:IWbemPath:SetText (This=0x523ff18, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"508\"") returned 0x0 [0179.436] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0179.436] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0179.436] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.436] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0179.436] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0179.436] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.436] IWbemClassObject:Get (in: This=0x5251bb0, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2996bcc*=0, plFlavor=0x2996bd0*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1fc, varVal2=0x0), pType=0x2996bcc*=19, plFlavor=0x2996bd0*=0) returned 0x0 [0179.437] IWbemClassObject:Get (in: This=0x5251bb0, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2996bcc*=19, plFlavor=0x2996bd0*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1fc, varVal2=0x0), pType=0x2996bcc*=19, plFlavor=0x2996bd0*=0) returned 0x0 [0179.437] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0179.437] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0179.437] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.437] IWbemClassObject:Get (in: This=0x5251bb0, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2996ccc*=0, plFlavor=0x2996cd0*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="winlogon.exe", varVal2=0x0), pType=0x2996ccc*=8, plFlavor=0x2996cd0*=0) returned 0x0 [0179.437] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0179.437] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0179.437] IWbemClassObject:Get (in: This=0x5251bb0, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2996ccc*=8, plFlavor=0x2996cd0*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="winlogon.exe", varVal2=0x0), pType=0x2996ccc*=8, plFlavor=0x2996cd0*=0) returned 0x0 [0179.437] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0179.437] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0179.437] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0179.437] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0179.437] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.437] IWbemClassObject:Get (in: This=0x5251bb0, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2996e10*=0, plFlavor=0x2996e14*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="winlogon.exe", varVal2=0x0), pType=0x2996e10*=8, plFlavor=0x2996e14*=0) returned 0x0 [0179.437] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0179.437] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0179.438] IWbemClassObject:Get (in: This=0x5251bb0, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2996e10*=8, plFlavor=0x2996e14*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="winlogon.exe", varVal2=0x0), pType=0x2996e10*=8, plFlavor=0x2996e14*=0) returned 0x0 [0179.438] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0179.438] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0179.438] CoTaskMemAlloc (cb=0x4) returned 0x71d380 [0179.438] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d380, puReturned=0x2995760 | out: apObjects=0x71d380*=0x5251d48, puReturned=0x2995760*=0x1) returned 0x0 [0179.474] IUnknown:QueryInterface (in: This=0x5251d48, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5251d48) returned 0x0 [0179.474] IUnknown:QueryInterface (in: This=0x5251d48, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0179.475] IUnknown:QueryInterface (in: This=0x5251d48, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0179.475] IUnknown:QueryInterface (in: This=0x5251d48, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0179.475] IUnknown:AddRef (This=0x5251d48) returned 0x3 [0179.475] IUnknown:QueryInterface (in: This=0x5251d48, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0179.475] IUnknown:QueryInterface (in: This=0x5251d48, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0179.475] IUnknown:QueryInterface (in: This=0x5251d48, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5251d4c) returned 0x0 [0179.475] IMarshal:GetUnmarshalClass (in: This=0x5251d4c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0179.475] IUnknown:Release (This=0x5251d4c) returned 0x3 [0179.475] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0179.475] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0179.475] IUnknown:QueryInterface (in: This=0x5251d48, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0179.475] IUnknown:Release (This=0x5251d48) returned 0x2 [0179.475] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0179.475] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0179.475] IUnknown:QueryInterface (in: This=0x5251d48, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5251d48) returned 0x0 [0179.475] IUnknown:AddRef (This=0x5251d48) returned 0x4 [0179.476] IUnknown:Release (This=0x5251d48) returned 0x3 [0179.476] IUnknown:Release (This=0x5251d48) returned 0x2 [0179.476] CoTaskMemFree (pv=0x71d380) [0179.476] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0179.476] IUnknown:AddRef (This=0x5251d48) returned 0x3 [0179.476] IWbemClassObject:Get (in: This=0x5251d48, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0179.476] IWbemClassObject:Get (in: This=0x5251d48, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"780\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0179.476] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"780\"") returned 0x5c [0179.476] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"780\"") returned 0x5c [0179.476] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x8b0 [0179.476] SetEvent (hEvent=0x638) returned 1 [0179.477] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x8b0, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0179.521] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0179.521] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0179.522] WbemDefPath:IUnknown:QueryInterface (in: This=0x523ff88, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x523ff88) returned 0x0 [0179.522] WbemDefPath:IUnknown:AddRef (This=0x523ff88) returned 0x3 [0179.522] WbemDefPath:IUnknown:Release (This=0x523ff88) returned 0x2 [0179.522] WbemDefPath:IWbemPath:SetText (This=0x523ff88, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"780\"") returned 0x0 [0179.522] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0179.522] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0179.522] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.522] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0179.522] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0179.522] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.522] IWbemClassObject:Get (in: This=0x5251d48, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29977c4*=0, plFlavor=0x29977c8*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x30c, varVal2=0x0), pType=0x29977c4*=19, plFlavor=0x29977c8*=0) returned 0x0 [0179.522] IWbemClassObject:Get (in: This=0x5251d48, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29977c4*=19, plFlavor=0x29977c8*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x30c, varVal2=0x0), pType=0x29977c4*=19, plFlavor=0x29977c8*=0) returned 0x0 [0179.522] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0179.522] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0179.522] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.522] IWbemClassObject:Get (in: This=0x5251d48, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29978c4*=0, plFlavor=0x29978c8*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="dwm.exe", varVal2=0x0), pType=0x29978c4*=8, plFlavor=0x29978c8*=0) returned 0x0 [0179.523] SysStringByteLen (bstr="dwm.exe") returned 0xe [0179.523] SysStringByteLen (bstr="dwm.exe") returned 0xe [0179.523] IWbemClassObject:Get (in: This=0x5251d48, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29978c4*=8, plFlavor=0x29978c8*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="dwm.exe", varVal2=0x0), pType=0x29978c4*=8, plFlavor=0x29978c8*=0) returned 0x0 [0179.523] SysStringByteLen (bstr="dwm.exe") returned 0xe [0179.523] SysStringByteLen (bstr="dwm.exe") returned 0xe [0179.523] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0179.523] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0179.523] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.523] IWbemClassObject:Get (in: This=0x5251d48, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29979f0*=0, plFlavor=0x29979f4*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"dwm.exe\"", varVal2=0x0), pType=0x29979f0*=8, plFlavor=0x29979f4*=0) returned 0x0 [0179.523] SysStringByteLen (bstr="\"dwm.exe\"") returned 0x12 [0179.523] SysStringByteLen (bstr="\"dwm.exe\"") returned 0x12 [0179.523] IWbemClassObject:Get (in: This=0x5251d48, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29979f0*=8, plFlavor=0x29979f4*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"dwm.exe\"", varVal2=0x0), pType=0x29979f0*=8, plFlavor=0x29979f4*=0) returned 0x0 [0179.523] SysStringByteLen (bstr="\"dwm.exe\"") returned 0x12 [0179.523] SysStringByteLen (bstr="\"dwm.exe\"") returned 0x12 [0179.523] CoTaskMemAlloc (cb=0x4) returned 0x71d2d0 [0179.523] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d2d0, puReturned=0x2995760 | out: apObjects=0x71d2d0*=0x5251a18, puReturned=0x2995760*=0x1) returned 0x0 [0179.567] IUnknown:QueryInterface (in: This=0x5251a18, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5251a18) returned 0x0 [0179.567] IUnknown:QueryInterface (in: This=0x5251a18, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0179.567] IUnknown:QueryInterface (in: This=0x5251a18, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0179.567] IUnknown:QueryInterface (in: This=0x5251a18, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0179.567] IUnknown:AddRef (This=0x5251a18) returned 0x3 [0179.567] IUnknown:QueryInterface (in: This=0x5251a18, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0179.567] IUnknown:QueryInterface (in: This=0x5251a18, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0179.567] IUnknown:QueryInterface (in: This=0x5251a18, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5251a1c) returned 0x0 [0179.568] IMarshal:GetUnmarshalClass (in: This=0x5251a1c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0179.568] IUnknown:Release (This=0x5251a1c) returned 0x3 [0179.568] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0179.568] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0179.568] IUnknown:QueryInterface (in: This=0x5251a18, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0179.568] IUnknown:Release (This=0x5251a18) returned 0x2 [0179.568] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0179.568] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0179.568] IUnknown:QueryInterface (in: This=0x5251a18, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5251a18) returned 0x0 [0179.568] IUnknown:AddRef (This=0x5251a18) returned 0x4 [0179.568] IUnknown:Release (This=0x5251a18) returned 0x3 [0179.568] IUnknown:Release (This=0x5251a18) returned 0x2 [0179.568] CoTaskMemFree (pv=0x71d2d0) [0179.568] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0179.568] IUnknown:AddRef (This=0x5251a18) returned 0x3 [0179.568] IWbemClassObject:Get (in: This=0x5251a18, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0179.568] IWbemClassObject:Get (in: This=0x5251a18, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1356\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0179.568] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1356\"") returned 0x5e [0179.569] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1356\"") returned 0x5e [0179.569] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x8b8 [0179.569] SetEvent (hEvent=0x638) returned 1 [0179.569] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x8b8, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0179.615] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0179.615] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0179.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f6c8, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x523f6c8) returned 0x0 [0179.615] WbemDefPath:IUnknown:AddRef (This=0x523f6c8) returned 0x3 [0179.616] WbemDefPath:IUnknown:Release (This=0x523f6c8) returned 0x2 [0179.616] WbemDefPath:IWbemPath:SetText (This=0x523f6c8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1356\"") returned 0x0 [0179.616] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0179.616] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0179.616] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.616] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0179.616] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0179.616] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.616] IWbemClassObject:Get (in: This=0x5251a18, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2998384*=0, plFlavor=0x2998388*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x54c, varVal2=0x0), pType=0x2998384*=19, plFlavor=0x2998388*=0) returned 0x0 [0179.616] IWbemClassObject:Get (in: This=0x5251a18, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2998384*=19, plFlavor=0x2998388*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x54c, varVal2=0x0), pType=0x2998384*=19, plFlavor=0x2998388*=0) returned 0x0 [0179.616] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0179.616] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0179.616] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.616] IWbemClassObject:Get (in: This=0x5251a18, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2998488*=0, plFlavor=0x299848c*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="sihost.exe", varVal2=0x0), pType=0x2998488*=8, plFlavor=0x299848c*=0) returned 0x0 [0179.616] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0179.616] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0179.617] IWbemClassObject:Get (in: This=0x5251a18, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2998488*=8, plFlavor=0x299848c*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="sihost.exe", varVal2=0x0), pType=0x2998488*=8, plFlavor=0x299848c*=0) returned 0x0 [0179.617] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0179.617] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0179.617] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0179.617] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0179.617] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.617] IWbemClassObject:Get (in: This=0x5251a18, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29985c4*=0, plFlavor=0x29985c8*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="sihost.exe", varVal2=0x0), pType=0x29985c4*=8, plFlavor=0x29985c8*=0) returned 0x0 [0179.617] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0179.617] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0179.617] IWbemClassObject:Get (in: This=0x5251a18, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29985c4*=8, plFlavor=0x29985c8*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="sihost.exe", varVal2=0x0), pType=0x29985c4*=8, plFlavor=0x29985c8*=0) returned 0x0 [0179.617] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0179.617] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0179.617] CoTaskMemAlloc (cb=0x4) returned 0x71d2d0 [0179.617] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d2d0, puReturned=0x2995760 | out: apObjects=0x71d2d0*=0x5252ba0, puReturned=0x2995760*=0x1) returned 0x0 [0179.661] IUnknown:QueryInterface (in: This=0x5252ba0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5252ba0) returned 0x0 [0179.661] IUnknown:QueryInterface (in: This=0x5252ba0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0179.661] IUnknown:QueryInterface (in: This=0x5252ba0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0179.661] IUnknown:QueryInterface (in: This=0x5252ba0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0179.661] IUnknown:AddRef (This=0x5252ba0) returned 0x3 [0179.661] IUnknown:QueryInterface (in: This=0x5252ba0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0179.661] IUnknown:QueryInterface (in: This=0x5252ba0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0179.661] IUnknown:QueryInterface (in: This=0x5252ba0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5252ba4) returned 0x0 [0179.662] IMarshal:GetUnmarshalClass (in: This=0x5252ba4, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0179.662] IUnknown:Release (This=0x5252ba4) returned 0x3 [0179.662] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0179.662] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0179.662] IUnknown:QueryInterface (in: This=0x5252ba0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0179.662] IUnknown:Release (This=0x5252ba0) returned 0x2 [0179.662] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0179.662] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0179.662] IUnknown:QueryInterface (in: This=0x5252ba0, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5252ba0) returned 0x0 [0179.662] IUnknown:AddRef (This=0x5252ba0) returned 0x4 [0179.662] IUnknown:Release (This=0x5252ba0) returned 0x3 [0179.662] IUnknown:Release (This=0x5252ba0) returned 0x2 [0179.662] CoTaskMemFree (pv=0x71d2d0) [0179.662] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0179.662] IUnknown:AddRef (This=0x5252ba0) returned 0x3 [0179.663] IWbemClassObject:Get (in: This=0x5252ba0, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0179.663] IWbemClassObject:Get (in: This=0x5252ba0, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1540\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0179.663] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1540\"") returned 0x5e [0179.663] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1540\"") returned 0x5e [0179.663] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x8b4 [0179.663] SetEvent (hEvent=0x638) returned 1 [0179.663] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x8b4, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0179.709] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0179.709] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0179.709] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f818, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x523f818) returned 0x0 [0179.709] WbemDefPath:IUnknown:AddRef (This=0x523f818) returned 0x3 [0179.709] WbemDefPath:IUnknown:Release (This=0x523f818) returned 0x2 [0179.709] WbemDefPath:IWbemPath:SetText (This=0x523f818, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1540\"") returned 0x0 [0179.709] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0179.710] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0179.710] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.710] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0179.710] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0179.710] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.710] IWbemClassObject:Get (in: This=0x5252ba0, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2998f68*=0, plFlavor=0x2998f6c*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x604, varVal2=0x0), pType=0x2998f68*=19, plFlavor=0x2998f6c*=0) returned 0x0 [0179.710] IWbemClassObject:Get (in: This=0x5252ba0, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2998f68*=19, plFlavor=0x2998f6c*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x604, varVal2=0x0), pType=0x2998f68*=19, plFlavor=0x2998f6c*=0) returned 0x0 [0179.710] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0179.710] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0179.710] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.710] IWbemClassObject:Get (in: This=0x5252ba0, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299906c*=0, plFlavor=0x2999070*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="RuntimeBroker.exe", varVal2=0x0), pType=0x299906c*=8, plFlavor=0x2999070*=0) returned 0x0 [0179.710] SysStringByteLen (bstr="RuntimeBroker.exe") returned 0x22 [0179.710] SysStringByteLen (bstr="RuntimeBroker.exe") returned 0x22 [0179.711] IWbemClassObject:Get (in: This=0x5252ba0, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299906c*=8, plFlavor=0x2999070*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="RuntimeBroker.exe", varVal2=0x0), pType=0x299906c*=8, plFlavor=0x2999070*=0) returned 0x0 [0179.711] SysStringByteLen (bstr="RuntimeBroker.exe") returned 0x22 [0179.711] SysStringByteLen (bstr="RuntimeBroker.exe") returned 0x22 [0179.711] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0179.711] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0179.711] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.711] IWbemClassObject:Get (in: This=0x5252ba0, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29991c0*=0, plFlavor=0x29991c4*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\System32\\RuntimeBroker.exe -Embedding", varVal2=0x0), pType=0x29991c0*=8, plFlavor=0x29991c4*=0) returned 0x0 [0179.711] SysStringByteLen (bstr="C:\\Windows\\System32\\RuntimeBroker.exe -Embedding") returned 0x60 [0179.711] SysStringByteLen (bstr="C:\\Windows\\System32\\RuntimeBroker.exe -Embedding") returned 0x60 [0179.711] IWbemClassObject:Get (in: This=0x5252ba0, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29991c0*=8, plFlavor=0x29991c4*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\System32\\RuntimeBroker.exe -Embedding", varVal2=0x0), pType=0x29991c0*=8, plFlavor=0x29991c4*=0) returned 0x0 [0179.711] SysStringByteLen (bstr="C:\\Windows\\System32\\RuntimeBroker.exe -Embedding") returned 0x60 [0179.711] SysStringByteLen (bstr="C:\\Windows\\System32\\RuntimeBroker.exe -Embedding") returned 0x60 [0179.711] CoTaskMemAlloc (cb=0x4) returned 0x71d2d0 [0179.711] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d2d0, puReturned=0x2995760 | out: apObjects=0x71d2d0*=0x5252d38, puReturned=0x2995760*=0x1) returned 0x0 [0179.754] IUnknown:QueryInterface (in: This=0x5252d38, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5252d38) returned 0x0 [0179.754] IUnknown:QueryInterface (in: This=0x5252d38, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0179.755] IUnknown:QueryInterface (in: This=0x5252d38, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0179.755] IUnknown:QueryInterface (in: This=0x5252d38, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0179.755] IUnknown:AddRef (This=0x5252d38) returned 0x3 [0179.755] IUnknown:QueryInterface (in: This=0x5252d38, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0179.755] IUnknown:QueryInterface (in: This=0x5252d38, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0179.755] IUnknown:QueryInterface (in: This=0x5252d38, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5252d3c) returned 0x0 [0179.755] IMarshal:GetUnmarshalClass (in: This=0x5252d3c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0179.755] IUnknown:Release (This=0x5252d3c) returned 0x3 [0179.755] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0179.755] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0179.755] IUnknown:QueryInterface (in: This=0x5252d38, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0179.755] IUnknown:Release (This=0x5252d38) returned 0x2 [0179.755] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0179.755] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0179.755] IUnknown:QueryInterface (in: This=0x5252d38, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5252d38) returned 0x0 [0179.755] IUnknown:AddRef (This=0x5252d38) returned 0x4 [0179.755] IUnknown:Release (This=0x5252d38) returned 0x3 [0179.755] IUnknown:Release (This=0x5252d38) returned 0x2 [0179.755] CoTaskMemFree (pv=0x71d2d0) [0179.755] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0179.755] IUnknown:AddRef (This=0x5252d38) returned 0x3 [0179.756] IWbemClassObject:Get (in: This=0x5252d38, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0179.756] IWbemClassObject:Get (in: This=0x5252d38, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1972\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0179.756] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1972\"") returned 0x5e [0179.756] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1972\"") returned 0x5e [0179.756] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x8bc [0179.756] SetEvent (hEvent=0x638) returned 1 [0179.756] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x8bc, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0179.804] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0179.804] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0179.804] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f738, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x523f738) returned 0x0 [0179.804] WbemDefPath:IUnknown:AddRef (This=0x523f738) returned 0x3 [0179.804] WbemDefPath:IUnknown:Release (This=0x523f738) returned 0x2 [0179.804] WbemDefPath:IWbemPath:SetText (This=0x523f738, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1972\"") returned 0x0 [0179.804] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0179.804] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0179.804] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.804] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0179.804] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0179.804] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.804] IWbemClassObject:Get (in: This=0x5252d38, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2999c84*=0, plFlavor=0x2999c88*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x7b4, varVal2=0x0), pType=0x2999c84*=19, plFlavor=0x2999c88*=0) returned 0x0 [0179.804] IWbemClassObject:Get (in: This=0x5252d38, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2999c84*=19, plFlavor=0x2999c88*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x7b4, varVal2=0x0), pType=0x2999c84*=19, plFlavor=0x2999c88*=0) returned 0x0 [0179.805] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0179.805] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0179.805] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.805] IWbemClassObject:Get (in: This=0x5252d38, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2999d88*=0, plFlavor=0x2999d8c*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="explorer.exe", varVal2=0x0), pType=0x2999d88*=8, plFlavor=0x2999d8c*=0) returned 0x0 [0179.805] SysStringByteLen (bstr="explorer.exe") returned 0x18 [0179.805] SysStringByteLen (bstr="explorer.exe") returned 0x18 [0179.805] IWbemClassObject:Get (in: This=0x5252d38, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2999d88*=8, plFlavor=0x2999d8c*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="explorer.exe", varVal2=0x0), pType=0x2999d88*=8, plFlavor=0x2999d8c*=0) returned 0x0 [0179.805] SysStringByteLen (bstr="explorer.exe") returned 0x18 [0179.805] SysStringByteLen (bstr="explorer.exe") returned 0x18 [0179.805] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0179.805] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0179.805] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.805] IWbemClassObject:Get (in: This=0x5252d38, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2999ecc*=0, plFlavor=0x2999ed0*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\Explorer.EXE", varVal2=0x0), pType=0x2999ecc*=8, plFlavor=0x2999ed0*=0) returned 0x0 [0179.805] SysStringByteLen (bstr="C:\\Windows\\Explorer.EXE") returned 0x2e [0179.805] SysStringByteLen (bstr="C:\\Windows\\Explorer.EXE") returned 0x2e [0179.805] IWbemClassObject:Get (in: This=0x5252d38, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2999ecc*=8, plFlavor=0x2999ed0*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\Explorer.EXE", varVal2=0x0), pType=0x2999ecc*=8, plFlavor=0x2999ed0*=0) returned 0x0 [0179.805] SysStringByteLen (bstr="C:\\Windows\\Explorer.EXE") returned 0x2e [0179.806] SysStringByteLen (bstr="C:\\Windows\\Explorer.EXE") returned 0x2e [0179.806] CoTaskMemAlloc (cb=0x4) returned 0x71d380 [0179.806] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d380, puReturned=0x2995760 | out: apObjects=0x71d380*=0x5252210, puReturned=0x2995760*=0x1) returned 0x0 [0179.849] IUnknown:QueryInterface (in: This=0x5252210, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5252210) returned 0x0 [0179.849] IUnknown:QueryInterface (in: This=0x5252210, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0179.849] IUnknown:QueryInterface (in: This=0x5252210, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0179.849] IUnknown:QueryInterface (in: This=0x5252210, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0179.849] IUnknown:AddRef (This=0x5252210) returned 0x3 [0179.849] IUnknown:QueryInterface (in: This=0x5252210, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0179.849] IUnknown:QueryInterface (in: This=0x5252210, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0179.849] IUnknown:QueryInterface (in: This=0x5252210, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5252214) returned 0x0 [0179.849] IMarshal:GetUnmarshalClass (in: This=0x5252214, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0179.849] IUnknown:Release (This=0x5252214) returned 0x3 [0179.850] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0179.850] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0179.850] IUnknown:QueryInterface (in: This=0x5252210, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0179.850] IUnknown:Release (This=0x5252210) returned 0x2 [0179.850] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0179.850] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0179.850] IUnknown:QueryInterface (in: This=0x5252210, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5252210) returned 0x0 [0179.850] IUnknown:AddRef (This=0x5252210) returned 0x4 [0179.850] IUnknown:Release (This=0x5252210) returned 0x3 [0179.850] IUnknown:Release (This=0x5252210) returned 0x2 [0179.850] CoTaskMemFree (pv=0x71d380) [0179.850] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0179.850] IUnknown:AddRef (This=0x5252210) returned 0x3 [0179.850] IWbemClassObject:Get (in: This=0x5252210, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0179.850] IWbemClassObject:Get (in: This=0x5252210, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2028\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0179.851] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2028\"") returned 0x5e [0179.851] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2028\"") returned 0x5e [0179.851] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x8c0 [0179.851] SetEvent (hEvent=0x638) returned 1 [0179.851] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x8c0, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0179.896] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0179.896] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0179.896] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fc08, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x523fc08) returned 0x0 [0179.896] WbemDefPath:IUnknown:AddRef (This=0x523fc08) returned 0x3 [0179.897] WbemDefPath:IUnknown:Release (This=0x523fc08) returned 0x2 [0179.897] WbemDefPath:IWbemPath:SetText (This=0x523fc08, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2028\"") returned 0x0 [0179.897] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0179.897] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0179.897] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.897] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0179.897] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0179.897] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.897] IWbemClassObject:Get (in: This=0x5252210, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299a8c0*=0, plFlavor=0x299a8c4*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x7ec, varVal2=0x0), pType=0x299a8c0*=19, plFlavor=0x299a8c4*=0) returned 0x0 [0179.897] IWbemClassObject:Get (in: This=0x5252210, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299a8c0*=19, plFlavor=0x299a8c4*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x7ec, varVal2=0x0), pType=0x299a8c0*=19, plFlavor=0x299a8c4*=0) returned 0x0 [0179.897] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0179.897] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0179.897] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.897] IWbemClassObject:Get (in: This=0x5252210, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299a9c4*=0, plFlavor=0x299a9c8*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="taskhostw.exe", varVal2=0x0), pType=0x299a9c4*=8, plFlavor=0x299a9c8*=0) returned 0x0 [0179.897] SysStringByteLen (bstr="taskhostw.exe") returned 0x1a [0179.898] SysStringByteLen (bstr="taskhostw.exe") returned 0x1a [0179.898] IWbemClassObject:Get (in: This=0x5252210, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299a9c4*=8, plFlavor=0x299a9c8*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="taskhostw.exe", varVal2=0x0), pType=0x299a9c4*=8, plFlavor=0x299a9c8*=0) returned 0x0 [0179.898] SysStringByteLen (bstr="taskhostw.exe") returned 0x1a [0179.898] SysStringByteLen (bstr="taskhostw.exe") returned 0x1a [0179.898] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0179.898] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0179.898] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.898] IWbemClassObject:Get (in: This=0x5252210, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299ab08*=0, plFlavor=0x299ab0c*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}", varVal2=0x0), pType=0x299ab08*=8, plFlavor=0x299ab0c*=0) returned 0x0 [0179.898] SysStringByteLen (bstr="taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}") returned 0x68 [0179.898] SysStringByteLen (bstr="taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}") returned 0x68 [0179.898] IWbemClassObject:Get (in: This=0x5252210, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299ab08*=8, plFlavor=0x299ab0c*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}", varVal2=0x0), pType=0x299ab08*=8, plFlavor=0x299ab0c*=0) returned 0x0 [0179.898] SysStringByteLen (bstr="taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}") returned 0x68 [0179.898] SysStringByteLen (bstr="taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}") returned 0x68 [0179.898] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0179.899] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5251ee0, puReturned=0x2995760*=0x1) returned 0x0 [0179.942] IUnknown:QueryInterface (in: This=0x5251ee0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5251ee0) returned 0x0 [0179.942] IUnknown:QueryInterface (in: This=0x5251ee0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0179.942] IUnknown:QueryInterface (in: This=0x5251ee0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0179.942] IUnknown:QueryInterface (in: This=0x5251ee0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0179.943] IUnknown:AddRef (This=0x5251ee0) returned 0x3 [0179.943] IUnknown:QueryInterface (in: This=0x5251ee0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0179.943] IUnknown:QueryInterface (in: This=0x5251ee0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0179.943] IUnknown:QueryInterface (in: This=0x5251ee0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5251ee4) returned 0x0 [0179.943] IMarshal:GetUnmarshalClass (in: This=0x5251ee4, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0179.943] IUnknown:Release (This=0x5251ee4) returned 0x3 [0179.943] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0179.943] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0179.943] IUnknown:QueryInterface (in: This=0x5251ee0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0179.943] IUnknown:Release (This=0x5251ee0) returned 0x2 [0179.943] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0179.943] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0179.943] IUnknown:QueryInterface (in: This=0x5251ee0, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5251ee0) returned 0x0 [0179.943] IUnknown:AddRef (This=0x5251ee0) returned 0x4 [0179.943] IUnknown:Release (This=0x5251ee0) returned 0x3 [0179.943] IUnknown:Release (This=0x5251ee0) returned 0x2 [0179.943] CoTaskMemFree (pv=0x71d200) [0179.943] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0179.943] IUnknown:AddRef (This=0x5251ee0) returned 0x3 [0179.944] IWbemClassObject:Get (in: This=0x5251ee0, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0179.944] IWbemClassObject:Get (in: This=0x5251ee0, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2196\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0179.944] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2196\"") returned 0x5e [0179.944] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2196\"") returned 0x5e [0179.944] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x8c4 [0179.944] SetEvent (hEvent=0x638) returned 1 [0179.944] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x8c4, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0179.990] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0179.990] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0179.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f888, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x523f888) returned 0x0 [0179.990] WbemDefPath:IUnknown:AddRef (This=0x523f888) returned 0x3 [0179.990] WbemDefPath:IUnknown:Release (This=0x523f888) returned 0x2 [0179.990] WbemDefPath:IWbemPath:SetText (This=0x523f888, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2196\"") returned 0x0 [0179.990] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0179.991] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0179.991] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.991] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0179.991] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0179.991] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.991] IWbemClassObject:Get (in: This=0x5251ee0, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299b5b0*=0, plFlavor=0x299b5b4*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x894, varVal2=0x0), pType=0x299b5b0*=19, plFlavor=0x299b5b4*=0) returned 0x0 [0179.991] IWbemClassObject:Get (in: This=0x5251ee0, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299b5b0*=19, plFlavor=0x299b5b4*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x894, varVal2=0x0), pType=0x299b5b0*=19, plFlavor=0x299b5b4*=0) returned 0x0 [0179.991] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0179.991] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0179.991] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.991] IWbemClassObject:Get (in: This=0x5251ee0, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299b6b4*=0, plFlavor=0x299b6b8*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ShellExperienceHost.exe", varVal2=0x0), pType=0x299b6b4*=8, plFlavor=0x299b6b8*=0) returned 0x0 [0179.991] SysStringByteLen (bstr="ShellExperienceHost.exe") returned 0x2e [0179.991] SysStringByteLen (bstr="ShellExperienceHost.exe") returned 0x2e [0179.991] IWbemClassObject:Get (in: This=0x5251ee0, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299b6b4*=8, plFlavor=0x299b6b8*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ShellExperienceHost.exe", varVal2=0x0), pType=0x299b6b4*=8, plFlavor=0x299b6b8*=0) returned 0x0 [0179.992] SysStringByteLen (bstr="ShellExperienceHost.exe") returned 0x2e [0179.992] SysStringByteLen (bstr="ShellExperienceHost.exe") returned 0x2e [0179.992] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0179.992] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0179.992] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0179.992] IWbemClassObject:Get (in: This=0x5251ee0, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299b820*=0, plFlavor=0x299b824*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\ShellExperienceHost.exe\" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca", varVal2=0x0), pType=0x299b820*=8, plFlavor=0x299b824*=0) returned 0x0 [0179.992] SysStringByteLen (bstr="\"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\ShellExperienceHost.exe\" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca") returned 0x114 [0179.992] SysStringByteLen (bstr="\"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\ShellExperienceHost.exe\" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca") returned 0x114 [0179.992] IWbemClassObject:Get (in: This=0x5251ee0, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299b820*=8, plFlavor=0x299b824*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\ShellExperienceHost.exe\" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca", varVal2=0x0), pType=0x299b820*=8, plFlavor=0x299b824*=0) returned 0x0 [0179.992] SysStringByteLen (bstr="\"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\ShellExperienceHost.exe\" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca") returned 0x114 [0179.992] SysStringByteLen (bstr="\"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\ShellExperienceHost.exe\" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca") returned 0x114 [0179.992] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0179.992] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5251880, puReturned=0x2995760*=0x1) returned 0x0 [0180.038] IUnknown:QueryInterface (in: This=0x5251880, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5251880) returned 0x0 [0180.039] IUnknown:QueryInterface (in: This=0x5251880, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0180.039] IUnknown:QueryInterface (in: This=0x5251880, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0180.039] IUnknown:QueryInterface (in: This=0x5251880, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0180.039] IUnknown:AddRef (This=0x5251880) returned 0x3 [0180.039] IUnknown:QueryInterface (in: This=0x5251880, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0180.039] IUnknown:QueryInterface (in: This=0x5251880, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0180.039] IUnknown:QueryInterface (in: This=0x5251880, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5251884) returned 0x0 [0180.039] IMarshal:GetUnmarshalClass (in: This=0x5251884, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0180.039] IUnknown:Release (This=0x5251884) returned 0x3 [0180.039] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0180.040] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0180.040] IUnknown:QueryInterface (in: This=0x5251880, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0180.040] IUnknown:Release (This=0x5251880) returned 0x2 [0180.040] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0180.040] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0180.040] IUnknown:QueryInterface (in: This=0x5251880, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5251880) returned 0x0 [0180.040] IUnknown:AddRef (This=0x5251880) returned 0x4 [0180.040] IUnknown:Release (This=0x5251880) returned 0x3 [0180.040] IUnknown:Release (This=0x5251880) returned 0x2 [0180.040] CoTaskMemFree (pv=0x71d200) [0180.040] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0180.040] IUnknown:AddRef (This=0x5251880) returned 0x3 [0180.040] IWbemClassObject:Get (in: This=0x5251880, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0180.040] IWbemClassObject:Get (in: This=0x5251880, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2312\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0180.040] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2312\"") returned 0x5e [0180.040] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2312\"") returned 0x5e [0180.040] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x8c8 [0180.041] SetEvent (hEvent=0x638) returned 1 [0180.082] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x8c8, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0180.084] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0180.085] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0180.085] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fce8, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x523fce8) returned 0x0 [0180.085] WbemDefPath:IUnknown:AddRef (This=0x523fce8) returned 0x3 [0180.085] WbemDefPath:IUnknown:Release (This=0x523fce8) returned 0x2 [0180.085] WbemDefPath:IWbemPath:SetText (This=0x523fce8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2312\"") returned 0x0 [0180.085] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0180.085] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0180.085] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.085] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0180.085] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0180.085] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.085] IWbemClassObject:Get (in: This=0x5251880, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299c4e0*=0, plFlavor=0x299c4e4*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x908, varVal2=0x0), pType=0x299c4e0*=19, plFlavor=0x299c4e4*=0) returned 0x0 [0180.085] IWbemClassObject:Get (in: This=0x5251880, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299c4e0*=19, plFlavor=0x299c4e4*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x908, varVal2=0x0), pType=0x299c4e0*=19, plFlavor=0x299c4e4*=0) returned 0x0 [0180.085] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0180.085] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0180.085] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.086] IWbemClassObject:Get (in: This=0x5251880, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299c5e4*=0, plFlavor=0x299c5e8*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="SearchUI.exe", varVal2=0x0), pType=0x299c5e4*=8, plFlavor=0x299c5e8*=0) returned 0x0 [0180.086] SysStringByteLen (bstr="SearchUI.exe") returned 0x18 [0180.086] SysStringByteLen (bstr="SearchUI.exe") returned 0x18 [0180.086] IWbemClassObject:Get (in: This=0x5251880, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299c5e4*=8, plFlavor=0x299c5e8*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="SearchUI.exe", varVal2=0x0), pType=0x299c5e4*=8, plFlavor=0x299c5e8*=0) returned 0x0 [0180.086] SysStringByteLen (bstr="SearchUI.exe") returned 0x18 [0180.086] SysStringByteLen (bstr="SearchUI.exe") returned 0x18 [0180.086] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0180.086] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0180.086] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.086] IWbemClassObject:Get (in: This=0x5251880, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299c728*=0, plFlavor=0x299c72c*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Windows\\SystemApps\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\SearchUI.exe\" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca", varVal2=0x0), pType=0x299c728*=8, plFlavor=0x299c72c*=0) returned 0x0 [0180.086] SysStringByteLen (bstr="\"C:\\Windows\\SystemApps\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\SearchUI.exe\" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca") returned 0x116 [0180.086] SysStringByteLen (bstr="\"C:\\Windows\\SystemApps\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\SearchUI.exe\" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca") returned 0x116 [0180.086] IWbemClassObject:Get (in: This=0x5251880, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299c728*=8, plFlavor=0x299c72c*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Windows\\SystemApps\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\SearchUI.exe\" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca", varVal2=0x0), pType=0x299c728*=8, plFlavor=0x299c72c*=0) returned 0x0 [0180.086] SysStringByteLen (bstr="\"C:\\Windows\\SystemApps\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\SearchUI.exe\" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca") returned 0x116 [0180.087] SysStringByteLen (bstr="\"C:\\Windows\\SystemApps\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\SearchUI.exe\" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca") returned 0x116 [0180.087] CoTaskMemAlloc (cb=0x4) returned 0x71d300 [0180.087] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d300, puReturned=0x2995760 | out: apObjects=0x71d300*=0x5250ef0, puReturned=0x2995760*=0x1) returned 0x0 [0180.170] IUnknown:QueryInterface (in: This=0x5250ef0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5250ef0) returned 0x0 [0180.170] IUnknown:QueryInterface (in: This=0x5250ef0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0180.170] IUnknown:QueryInterface (in: This=0x5250ef0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0180.170] IUnknown:QueryInterface (in: This=0x5250ef0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0180.171] IUnknown:AddRef (This=0x5250ef0) returned 0x3 [0180.171] IUnknown:QueryInterface (in: This=0x5250ef0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0180.171] IUnknown:QueryInterface (in: This=0x5250ef0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0180.171] IUnknown:QueryInterface (in: This=0x5250ef0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5250ef4) returned 0x0 [0180.171] IMarshal:GetUnmarshalClass (in: This=0x5250ef4, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0180.171] IUnknown:Release (This=0x5250ef4) returned 0x3 [0180.171] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0180.171] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0180.171] IUnknown:QueryInterface (in: This=0x5250ef0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0180.171] IUnknown:Release (This=0x5250ef0) returned 0x2 [0180.171] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0180.171] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0180.171] IUnknown:QueryInterface (in: This=0x5250ef0, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5250ef0) returned 0x0 [0180.171] IUnknown:AddRef (This=0x5250ef0) returned 0x4 [0180.171] IUnknown:Release (This=0x5250ef0) returned 0x3 [0180.171] IUnknown:Release (This=0x5250ef0) returned 0x2 [0180.171] CoTaskMemFree (pv=0x71d300) [0180.171] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0180.171] IUnknown:AddRef (This=0x5250ef0) returned 0x3 [0180.171] IWbemClassObject:Get (in: This=0x5250ef0, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0180.171] IWbemClassObject:Get (in: This=0x5250ef0, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2264\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0180.172] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2264\"") returned 0x5e [0180.172] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2264\"") returned 0x5e [0180.172] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x8cc [0180.172] SetEvent (hEvent=0x638) returned 1 [0180.172] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x8cc, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0180.209] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0180.209] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0180.209] WbemDefPath:IUnknown:QueryInterface (in: This=0x52400d8, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x52400d8) returned 0x0 [0180.209] WbemDefPath:IUnknown:AddRef (This=0x52400d8) returned 0x3 [0180.209] WbemDefPath:IUnknown:Release (This=0x52400d8) returned 0x2 [0180.209] WbemDefPath:IWbemPath:SetText (This=0x52400d8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2264\"") returned 0x0 [0180.209] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0180.209] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0180.209] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.209] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0180.209] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0180.209] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.209] IWbemClassObject:Get (in: This=0x5250ef0, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299d420*=0, plFlavor=0x299d424*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8d8, varVal2=0x0), pType=0x299d420*=19, plFlavor=0x299d424*=0) returned 0x0 [0180.209] IWbemClassObject:Get (in: This=0x5250ef0, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299d420*=19, plFlavor=0x299d424*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8d8, varVal2=0x0), pType=0x299d420*=19, plFlavor=0x299d424*=0) returned 0x0 [0180.209] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0180.209] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0180.209] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.209] IWbemClassObject:Get (in: This=0x5250ef0, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299d524*=0, plFlavor=0x299d528*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="svchost.exe", varVal2=0x0), pType=0x299d524*=8, plFlavor=0x299d528*=0) returned 0x0 [0180.210] SysStringByteLen (bstr="svchost.exe") returned 0x16 [0180.210] SysStringByteLen (bstr="svchost.exe") returned 0x16 [0180.210] IWbemClassObject:Get (in: This=0x5250ef0, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299d524*=8, plFlavor=0x299d528*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="svchost.exe", varVal2=0x0), pType=0x299d524*=8, plFlavor=0x299d528*=0) returned 0x0 [0180.210] SysStringByteLen (bstr="svchost.exe") returned 0x16 [0180.210] SysStringByteLen (bstr="svchost.exe") returned 0x16 [0180.210] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0180.210] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0180.210] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.210] IWbemClassObject:Get (in: This=0x5250ef0, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299d660*=0, plFlavor=0x299d664*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\svchost.exe -k UnistackSvcGroup", varVal2=0x0), pType=0x299d660*=8, plFlavor=0x299d664*=0) returned 0x0 [0180.210] SysStringByteLen (bstr="C:\\Windows\\system32\\svchost.exe -k UnistackSvcGroup") returned 0x66 [0180.210] SysStringByteLen (bstr="C:\\Windows\\system32\\svchost.exe -k UnistackSvcGroup") returned 0x66 [0180.210] IWbemClassObject:Get (in: This=0x5250ef0, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299d660*=8, plFlavor=0x299d664*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\svchost.exe -k UnistackSvcGroup", varVal2=0x0), pType=0x299d660*=8, plFlavor=0x299d664*=0) returned 0x0 [0180.210] SysStringByteLen (bstr="C:\\Windows\\system32\\svchost.exe -k UnistackSvcGroup") returned 0x66 [0180.210] SysStringByteLen (bstr="C:\\Windows\\system32\\svchost.exe -k UnistackSvcGroup") returned 0x66 [0180.210] CoTaskMemAlloc (cb=0x4) returned 0x71d380 [0180.210] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d380, puReturned=0x2995760 | out: apObjects=0x71d380*=0x5252870, puReturned=0x2995760*=0x1) returned 0x0 [0180.256] IUnknown:QueryInterface (in: This=0x5252870, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5252870) returned 0x0 [0180.256] IUnknown:QueryInterface (in: This=0x5252870, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0180.256] IUnknown:QueryInterface (in: This=0x5252870, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0180.256] IUnknown:QueryInterface (in: This=0x5252870, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0180.256] IUnknown:AddRef (This=0x5252870) returned 0x3 [0180.256] IUnknown:QueryInterface (in: This=0x5252870, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0180.256] IUnknown:QueryInterface (in: This=0x5252870, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0180.256] IUnknown:QueryInterface (in: This=0x5252870, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5252874) returned 0x0 [0180.256] IMarshal:GetUnmarshalClass (in: This=0x5252874, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0180.257] IUnknown:Release (This=0x5252874) returned 0x3 [0180.257] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0180.257] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0180.257] IUnknown:QueryInterface (in: This=0x5252870, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0180.257] IUnknown:Release (This=0x5252870) returned 0x2 [0180.257] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0180.257] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0180.257] IUnknown:QueryInterface (in: This=0x5252870, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5252870) returned 0x0 [0180.257] IUnknown:AddRef (This=0x5252870) returned 0x4 [0180.257] IUnknown:Release (This=0x5252870) returned 0x3 [0180.257] IUnknown:Release (This=0x5252870) returned 0x2 [0180.257] CoTaskMemFree (pv=0x71d380) [0180.257] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0180.257] IUnknown:AddRef (This=0x5252870) returned 0x3 [0180.257] IWbemClassObject:Get (in: This=0x5252870, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0180.257] IWbemClassObject:Get (in: This=0x5252870, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1604\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0180.257] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1604\"") returned 0x5e [0180.258] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1604\"") returned 0x5e [0180.258] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x8d0 [0180.258] SetEvent (hEvent=0x638) returned 1 [0180.258] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x8d0, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0180.335] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0180.335] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0180.335] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f8f8, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x523f8f8) returned 0x0 [0180.335] WbemDefPath:IUnknown:AddRef (This=0x523f8f8) returned 0x3 [0180.335] WbemDefPath:IUnknown:Release (This=0x523f8f8) returned 0x2 [0180.335] WbemDefPath:IWbemPath:SetText (This=0x523f8f8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1604\"") returned 0x0 [0180.335] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0180.335] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0180.335] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.335] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0180.335] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0180.335] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.335] IWbemClassObject:Get (in: This=0x5252870, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299e0f8*=0, plFlavor=0x299e0fc*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x644, varVal2=0x0), pType=0x299e0f8*=19, plFlavor=0x299e0fc*=0) returned 0x0 [0180.336] IWbemClassObject:Get (in: This=0x5252870, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299e0f8*=19, plFlavor=0x299e0fc*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x644, varVal2=0x0), pType=0x299e0f8*=19, plFlavor=0x299e0fc*=0) returned 0x0 [0180.336] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0180.336] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0180.336] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.336] IWbemClassObject:Get (in: This=0x5252870, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299e1fc*=0, plFlavor=0x299e200*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="iexplore.exe", varVal2=0x0), pType=0x299e1fc*=8, plFlavor=0x299e200*=0) returned 0x0 [0180.336] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0180.336] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0180.336] IWbemClassObject:Get (in: This=0x5252870, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299e1fc*=8, plFlavor=0x299e200*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="iexplore.exe", varVal2=0x0), pType=0x299e1fc*=8, plFlavor=0x299e200*=0) returned 0x0 [0180.336] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0180.336] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0180.336] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0180.336] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0180.336] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.337] IWbemClassObject:Get (in: This=0x5252870, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299e340*=0, plFlavor=0x299e344*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" about:blank", varVal2=0x0), pType=0x299e340*=8, plFlavor=0x299e344*=0) returned 0x0 [0180.337] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" about:blank") returned 0x7a [0180.337] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" about:blank") returned 0x7a [0180.337] IWbemClassObject:Get (in: This=0x5252870, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299e340*=8, plFlavor=0x299e344*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" about:blank", varVal2=0x0), pType=0x299e340*=8, plFlavor=0x299e344*=0) returned 0x0 [0180.337] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" about:blank") returned 0x7a [0180.337] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" about:blank") returned 0x7a [0180.337] CoTaskMemAlloc (cb=0x4) returned 0x71d2d0 [0180.337] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d2d0, puReturned=0x2995760 | out: apObjects=0x71d2d0*=0x5252078, puReturned=0x2995760*=0x1) returned 0x0 [0180.380] IUnknown:QueryInterface (in: This=0x5252078, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5252078) returned 0x0 [0180.380] IUnknown:QueryInterface (in: This=0x5252078, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0180.380] IUnknown:QueryInterface (in: This=0x5252078, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0180.380] IUnknown:QueryInterface (in: This=0x5252078, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0180.380] IUnknown:AddRef (This=0x5252078) returned 0x3 [0180.380] IUnknown:QueryInterface (in: This=0x5252078, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0180.380] IUnknown:QueryInterface (in: This=0x5252078, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0180.380] IUnknown:QueryInterface (in: This=0x5252078, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x525207c) returned 0x0 [0180.380] IMarshal:GetUnmarshalClass (in: This=0x525207c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0180.381] IUnknown:Release (This=0x525207c) returned 0x3 [0180.381] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0180.381] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0180.381] IUnknown:QueryInterface (in: This=0x5252078, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0180.381] IUnknown:Release (This=0x5252078) returned 0x2 [0180.381] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0180.381] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0180.381] IUnknown:QueryInterface (in: This=0x5252078, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5252078) returned 0x0 [0180.381] IUnknown:AddRef (This=0x5252078) returned 0x4 [0180.381] IUnknown:Release (This=0x5252078) returned 0x3 [0180.381] IUnknown:Release (This=0x5252078) returned 0x2 [0180.381] CoTaskMemFree (pv=0x71d2d0) [0180.381] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0180.381] IUnknown:AddRef (This=0x5252078) returned 0x3 [0180.381] IWbemClassObject:Get (in: This=0x5252078, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0180.381] IWbemClassObject:Get (in: This=0x5252078, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"944\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0180.382] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"944\"") returned 0x5c [0180.382] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"944\"") returned 0x5c [0180.382] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x8d4 [0180.382] SetEvent (hEvent=0x638) returned 1 [0180.382] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x8d4, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0180.437] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0180.437] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0180.437] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fb98, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x523fb98) returned 0x0 [0180.437] WbemDefPath:IUnknown:AddRef (This=0x523fb98) returned 0x3 [0180.437] WbemDefPath:IUnknown:Release (This=0x523fb98) returned 0x2 [0180.437] WbemDefPath:IWbemPath:SetText (This=0x523fb98, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"944\"") returned 0x0 [0180.437] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0180.437] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0180.437] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.437] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0180.437] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0180.437] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.437] IWbemClassObject:Get (in: This=0x5252078, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299ee18*=0, plFlavor=0x299ee1c*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3b0, varVal2=0x0), pType=0x299ee18*=19, plFlavor=0x299ee1c*=0) returned 0x0 [0180.437] IWbemClassObject:Get (in: This=0x5252078, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299ee18*=19, plFlavor=0x299ee1c*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3b0, varVal2=0x0), pType=0x299ee18*=19, plFlavor=0x299ee1c*=0) returned 0x0 [0180.438] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0180.438] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0180.438] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.438] IWbemClassObject:Get (in: This=0x5252078, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299ef18*=0, plFlavor=0x299ef1c*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="iexplore.exe", varVal2=0x0), pType=0x299ef18*=8, plFlavor=0x299ef1c*=0) returned 0x0 [0180.438] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0180.438] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0180.438] IWbemClassObject:Get (in: This=0x5252078, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299ef18*=8, plFlavor=0x299ef1c*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="iexplore.exe", varVal2=0x0), pType=0x299ef18*=8, plFlavor=0x299ef1c*=0) returned 0x0 [0180.438] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0180.438] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0180.438] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0180.438] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0180.438] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.438] IWbemClassObject:Get (in: This=0x5252078, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299f05c*=0, plFlavor=0x299f060*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE\" SCODEF:1604 CREDAT:82945 /prefetch:2", varVal2=0x0), pType=0x299f05c*=8, plFlavor=0x299f060*=0) returned 0x0 [0180.438] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE\" SCODEF:1604 CREDAT:82945 /prefetch:2") returned 0xb8 [0180.438] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE\" SCODEF:1604 CREDAT:82945 /prefetch:2") returned 0xb8 [0180.439] IWbemClassObject:Get (in: This=0x5252078, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299f05c*=8, plFlavor=0x299f060*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE\" SCODEF:1604 CREDAT:82945 /prefetch:2", varVal2=0x0), pType=0x299f05c*=8, plFlavor=0x299f060*=0) returned 0x0 [0180.439] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE\" SCODEF:1604 CREDAT:82945 /prefetch:2") returned 0xb8 [0180.439] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE\" SCODEF:1604 CREDAT:82945 /prefetch:2") returned 0xb8 [0180.439] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0180.439] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x52516e8, puReturned=0x2995760*=0x1) returned 0x0 [0180.507] IUnknown:QueryInterface (in: This=0x52516e8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x52516e8) returned 0x0 [0180.507] IUnknown:QueryInterface (in: This=0x52516e8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0180.507] IUnknown:QueryInterface (in: This=0x52516e8, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0180.507] IUnknown:QueryInterface (in: This=0x52516e8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0180.508] IUnknown:AddRef (This=0x52516e8) returned 0x3 [0180.508] IUnknown:QueryInterface (in: This=0x52516e8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0180.508] IUnknown:QueryInterface (in: This=0x52516e8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0180.508] IUnknown:QueryInterface (in: This=0x52516e8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x52516ec) returned 0x0 [0180.508] IMarshal:GetUnmarshalClass (in: This=0x52516ec, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0180.508] IUnknown:Release (This=0x52516ec) returned 0x3 [0180.508] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0180.508] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0180.508] IUnknown:QueryInterface (in: This=0x52516e8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0180.508] IUnknown:Release (This=0x52516e8) returned 0x2 [0180.508] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0180.508] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0180.508] IUnknown:QueryInterface (in: This=0x52516e8, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x52516e8) returned 0x0 [0180.508] IUnknown:AddRef (This=0x52516e8) returned 0x4 [0180.508] IUnknown:Release (This=0x52516e8) returned 0x3 [0180.508] IUnknown:Release (This=0x52516e8) returned 0x2 [0180.509] CoTaskMemFree (pv=0x71d200) [0180.509] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0180.509] IUnknown:AddRef (This=0x52516e8) returned 0x3 [0180.509] IWbemClassObject:Get (in: This=0x52516e8, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0180.509] IWbemClassObject:Get (in: This=0x52516e8, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1644\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0180.509] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1644\"") returned 0x5e [0180.509] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1644\"") returned 0x5e [0180.509] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x8d8 [0180.509] SetEvent (hEvent=0x638) returned 1 [0180.510] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x8d8, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0180.570] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0180.570] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0180.570] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fff8, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x523fff8) returned 0x0 [0180.570] WbemDefPath:IUnknown:AddRef (This=0x523fff8) returned 0x3 [0180.570] WbemDefPath:IUnknown:Release (This=0x523fff8) returned 0x2 [0180.570] WbemDefPath:IWbemPath:SetText (This=0x523fff8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1644\"") returned 0x0 [0180.570] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0180.570] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0180.570] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.570] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0180.570] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0180.570] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.571] IWbemClassObject:Get (in: This=0x52516e8, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299fbf0*=0, plFlavor=0x299fbf4*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x66c, varVal2=0x0), pType=0x299fbf0*=19, plFlavor=0x299fbf4*=0) returned 0x0 [0180.571] IWbemClassObject:Get (in: This=0x52516e8, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299fbf0*=19, plFlavor=0x299fbf4*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x66c, varVal2=0x0), pType=0x299fbf0*=19, plFlavor=0x299fbf4*=0) returned 0x0 [0180.571] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0180.571] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0180.571] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.571] IWbemClassObject:Get (in: This=0x52516e8, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299fcf4*=0, plFlavor=0x299fcf8*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="tradefinancial.exe", varVal2=0x0), pType=0x299fcf4*=8, plFlavor=0x299fcf8*=0) returned 0x0 [0180.571] SysStringByteLen (bstr="tradefinancial.exe") returned 0x24 [0180.571] SysStringByteLen (bstr="tradefinancial.exe") returned 0x24 [0180.571] IWbemClassObject:Get (in: This=0x52516e8, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299fcf4*=8, plFlavor=0x299fcf8*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="tradefinancial.exe", varVal2=0x0), pType=0x299fcf4*=8, plFlavor=0x299fcf8*=0) returned 0x0 [0180.571] SysStringByteLen (bstr="tradefinancial.exe") returned 0x24 [0180.571] SysStringByteLen (bstr="tradefinancial.exe") returned 0x24 [0180.571] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0180.572] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0180.572] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.572] IWbemClassObject:Get (in: This=0x52516e8, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299fe50*=0, plFlavor=0x299fe54*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft Office\\tradefinancial.exe\" ", varVal2=0x0), pType=0x299fe50*=8, plFlavor=0x299fe54*=0) returned 0x0 [0180.572] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Office\\tradefinancial.exe\" ") returned 0x7a [0180.572] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Office\\tradefinancial.exe\" ") returned 0x7a [0180.572] IWbemClassObject:Get (in: This=0x52516e8, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299fe50*=8, plFlavor=0x299fe54*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft Office\\tradefinancial.exe\" ", varVal2=0x0), pType=0x299fe50*=8, plFlavor=0x299fe54*=0) returned 0x0 [0180.572] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Office\\tradefinancial.exe\" ") returned 0x7a [0180.572] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Office\\tradefinancial.exe\" ") returned 0x7a [0180.572] CoTaskMemAlloc (cb=0x4) returned 0x71d300 [0180.572] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d300, puReturned=0x2995760 | out: apObjects=0x71d300*=0x52523a8, puReturned=0x2995760*=0x1) returned 0x0 [0180.614] IUnknown:QueryInterface (in: This=0x52523a8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x52523a8) returned 0x0 [0180.614] IUnknown:QueryInterface (in: This=0x52523a8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0180.614] IUnknown:QueryInterface (in: This=0x52523a8, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0180.614] IUnknown:QueryInterface (in: This=0x52523a8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0180.615] IUnknown:AddRef (This=0x52523a8) returned 0x3 [0180.615] IUnknown:QueryInterface (in: This=0x52523a8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0180.615] IUnknown:QueryInterface (in: This=0x52523a8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0180.616] IUnknown:QueryInterface (in: This=0x52523a8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x52523ac) returned 0x0 [0180.616] IMarshal:GetUnmarshalClass (in: This=0x52523ac, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0180.616] IUnknown:Release (This=0x52523ac) returned 0x3 [0180.616] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0180.616] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0180.616] IUnknown:QueryInterface (in: This=0x52523a8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0180.616] IUnknown:Release (This=0x52523a8) returned 0x2 [0180.616] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0180.616] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0180.617] IUnknown:QueryInterface (in: This=0x52523a8, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x52523a8) returned 0x0 [0180.617] IUnknown:AddRef (This=0x52523a8) returned 0x4 [0180.617] IUnknown:Release (This=0x52523a8) returned 0x3 [0180.617] IUnknown:Release (This=0x52523a8) returned 0x2 [0180.617] CoTaskMemFree (pv=0x71d300) [0180.617] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0180.617] IUnknown:AddRef (This=0x52523a8) returned 0x3 [0180.617] IWbemClassObject:Get (in: This=0x52523a8, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0180.617] IWbemClassObject:Get (in: This=0x52523a8, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2516\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0180.617] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2516\"") returned 0x5e [0180.617] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2516\"") returned 0x5e [0180.618] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x8dc [0180.618] SetEvent (hEvent=0x638) returned 1 [0180.618] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x8dc, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0180.662] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0180.662] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0180.663] WbemDefPath:IUnknown:QueryInterface (in: This=0x52403e8, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x52403e8) returned 0x0 [0180.663] WbemDefPath:IUnknown:AddRef (This=0x52403e8) returned 0x3 [0180.663] WbemDefPath:IUnknown:Release (This=0x52403e8) returned 0x2 [0180.663] WbemDefPath:IWbemPath:SetText (This=0x52403e8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2516\"") returned 0x0 [0180.664] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0180.664] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0180.664] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.664] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0180.664] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0180.664] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.664] IWbemClassObject:Get (in: This=0x52523a8, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a0934*=0, plFlavor=0x29a0938*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x9d4, varVal2=0x0), pType=0x29a0934*=19, plFlavor=0x29a0938*=0) returned 0x0 [0180.664] IWbemClassObject:Get (in: This=0x52523a8, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a0934*=19, plFlavor=0x29a0938*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x9d4, varVal2=0x0), pType=0x29a0934*=19, plFlavor=0x29a0938*=0) returned 0x0 [0180.664] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0180.664] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0180.664] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.664] IWbemClassObject:Get (in: This=0x52523a8, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a0a38*=0, plFlavor=0x29a0a3c*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="final.exe", varVal2=0x0), pType=0x29a0a38*=8, plFlavor=0x29a0a3c*=0) returned 0x0 [0180.665] SysStringByteLen (bstr="final.exe") returned 0x12 [0180.665] SysStringByteLen (bstr="final.exe") returned 0x12 [0180.665] IWbemClassObject:Get (in: This=0x52523a8, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a0a38*=8, plFlavor=0x29a0a3c*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="final.exe", varVal2=0x0), pType=0x29a0a38*=8, plFlavor=0x29a0a3c*=0) returned 0x0 [0180.665] SysStringByteLen (bstr="final.exe") returned 0x12 [0180.665] SysStringByteLen (bstr="final.exe") returned 0x12 [0180.665] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0180.665] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0180.665] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.665] IWbemClassObject:Get (in: This=0x52523a8, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a0b6c*=0, plFlavor=0x29a0b70*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Portable Devices\\final.exe\" ", varVal2=0x0), pType=0x29a0b6c*=8, plFlavor=0x29a0b70*=0) returned 0x0 [0180.665] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Portable Devices\\final.exe\" ") returned 0x6c [0180.665] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Portable Devices\\final.exe\" ") returned 0x6c [0180.665] IWbemClassObject:Get (in: This=0x52523a8, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a0b6c*=8, plFlavor=0x29a0b70*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Portable Devices\\final.exe\" ", varVal2=0x0), pType=0x29a0b6c*=8, plFlavor=0x29a0b70*=0) returned 0x0 [0180.665] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Portable Devices\\final.exe\" ") returned 0x6c [0180.665] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Portable Devices\\final.exe\" ") returned 0x6c [0180.666] CoTaskMemAlloc (cb=0x4) returned 0x71d300 [0180.666] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d300, puReturned=0x2995760 | out: apObjects=0x71d300*=0x5252540, puReturned=0x2995760*=0x1) returned 0x0 [0180.708] IUnknown:QueryInterface (in: This=0x5252540, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5252540) returned 0x0 [0180.709] IUnknown:QueryInterface (in: This=0x5252540, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0180.709] IUnknown:QueryInterface (in: This=0x5252540, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0180.709] IUnknown:QueryInterface (in: This=0x5252540, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0180.709] IUnknown:AddRef (This=0x5252540) returned 0x3 [0180.709] IUnknown:QueryInterface (in: This=0x5252540, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0180.709] IUnknown:QueryInterface (in: This=0x5252540, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0180.709] IUnknown:QueryInterface (in: This=0x5252540, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5252544) returned 0x0 [0180.709] IMarshal:GetUnmarshalClass (in: This=0x5252544, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0180.709] IUnknown:Release (This=0x5252544) returned 0x3 [0180.709] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0180.709] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0180.709] IUnknown:QueryInterface (in: This=0x5252540, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0180.710] IUnknown:Release (This=0x5252540) returned 0x2 [0180.710] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0180.710] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0180.710] IUnknown:QueryInterface (in: This=0x5252540, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5252540) returned 0x0 [0180.710] IUnknown:AddRef (This=0x5252540) returned 0x4 [0180.710] IUnknown:Release (This=0x5252540) returned 0x3 [0180.710] IUnknown:Release (This=0x5252540) returned 0x2 [0180.710] CoTaskMemFree (pv=0x71d300) [0180.710] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0180.710] IUnknown:AddRef (This=0x5252540) returned 0x3 [0180.710] IWbemClassObject:Get (in: This=0x5252540, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0180.710] IWbemClassObject:Get (in: This=0x5252540, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"332\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0180.710] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"332\"") returned 0x5c [0180.710] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"332\"") returned 0x5c [0180.710] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x8e0 [0180.710] SetEvent (hEvent=0x638) returned 1 [0180.711] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x8e0, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0180.757] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0180.757] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0180.757] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240458, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5240458) returned 0x0 [0180.758] WbemDefPath:IUnknown:AddRef (This=0x5240458) returned 0x3 [0180.758] WbemDefPath:IUnknown:Release (This=0x5240458) returned 0x2 [0180.758] WbemDefPath:IWbemPath:SetText (This=0x5240458, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"332\"") returned 0x0 [0180.758] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0180.758] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0180.758] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.758] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0180.758] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0180.758] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.758] IWbemClassObject:Get (in: This=0x5252540, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a1618*=0, plFlavor=0x29a161c*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x14c, varVal2=0x0), pType=0x29a1618*=19, plFlavor=0x29a161c*=0) returned 0x0 [0180.758] IWbemClassObject:Get (in: This=0x5252540, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a1618*=19, plFlavor=0x29a161c*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x14c, varVal2=0x0), pType=0x29a1618*=19, plFlavor=0x29a161c*=0) returned 0x0 [0180.758] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0180.758] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0180.758] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.758] IWbemClassObject:Get (in: This=0x5252540, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a1718*=0, plFlavor=0x29a171c*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="with-particular.exe", varVal2=0x0), pType=0x29a1718*=8, plFlavor=0x29a171c*=0) returned 0x0 [0180.758] SysStringByteLen (bstr="with-particular.exe") returned 0x26 [0180.759] SysStringByteLen (bstr="with-particular.exe") returned 0x26 [0180.759] IWbemClassObject:Get (in: This=0x5252540, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a1718*=8, plFlavor=0x29a171c*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="with-particular.exe", varVal2=0x0), pType=0x29a1718*=8, plFlavor=0x29a171c*=0) returned 0x0 [0180.759] SysStringByteLen (bstr="with-particular.exe") returned 0x26 [0180.759] SysStringByteLen (bstr="with-particular.exe") returned 0x26 [0180.759] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0180.759] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0180.759] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.759] IWbemClassObject:Get (in: This=0x5252540, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a1874*=0, plFlavor=0x29a1878*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Mail\\with-particular.exe\" ", varVal2=0x0), pType=0x29a1874*=8, plFlavor=0x29a1878*=0) returned 0x0 [0180.759] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Mail\\with-particular.exe\" ") returned 0x74 [0180.759] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Mail\\with-particular.exe\" ") returned 0x74 [0180.759] IWbemClassObject:Get (in: This=0x5252540, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a1874*=8, plFlavor=0x29a1878*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Mail\\with-particular.exe\" ", varVal2=0x0), pType=0x29a1874*=8, plFlavor=0x29a1878*=0) returned 0x0 [0180.759] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Mail\\with-particular.exe\" ") returned 0x74 [0180.759] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Mail\\with-particular.exe\" ") returned 0x74 [0180.759] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0180.760] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x52526d8, puReturned=0x2995760*=0x1) returned 0x0 [0180.801] IUnknown:QueryInterface (in: This=0x52526d8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x52526d8) returned 0x0 [0180.801] IUnknown:QueryInterface (in: This=0x52526d8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0180.801] IUnknown:QueryInterface (in: This=0x52526d8, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0180.801] IUnknown:QueryInterface (in: This=0x52526d8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0180.802] IUnknown:AddRef (This=0x52526d8) returned 0x3 [0180.802] IUnknown:QueryInterface (in: This=0x52526d8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0180.802] IUnknown:QueryInterface (in: This=0x52526d8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0180.802] IUnknown:QueryInterface (in: This=0x52526d8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x52526dc) returned 0x0 [0180.802] IMarshal:GetUnmarshalClass (in: This=0x52526dc, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0180.802] IUnknown:Release (This=0x52526dc) returned 0x3 [0180.802] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0180.802] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0180.802] IUnknown:QueryInterface (in: This=0x52526d8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0180.802] IUnknown:Release (This=0x52526d8) returned 0x2 [0180.802] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0180.802] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0180.802] IUnknown:QueryInterface (in: This=0x52526d8, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x52526d8) returned 0x0 [0180.802] IUnknown:AddRef (This=0x52526d8) returned 0x4 [0180.802] IUnknown:Release (This=0x52526d8) returned 0x3 [0180.802] IUnknown:Release (This=0x52526d8) returned 0x2 [0180.802] CoTaskMemFree (pv=0x71d200) [0180.802] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0180.802] IUnknown:AddRef (This=0x52526d8) returned 0x3 [0180.802] IWbemClassObject:Get (in: This=0x52526d8, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0180.803] IWbemClassObject:Get (in: This=0x52526d8, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1508\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0180.803] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1508\"") returned 0x5e [0180.803] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1508\"") returned 0x5e [0180.803] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x8e4 [0180.803] SetEvent (hEvent=0x638) returned 1 [0180.803] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x8e4, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0180.855] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0180.855] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0180.855] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240538, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5240538) returned 0x0 [0180.855] WbemDefPath:IUnknown:AddRef (This=0x5240538) returned 0x3 [0180.855] WbemDefPath:IUnknown:Release (This=0x5240538) returned 0x2 [0180.855] WbemDefPath:IWbemPath:SetText (This=0x5240538, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1508\"") returned 0x0 [0180.855] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0180.855] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0180.855] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.855] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0180.855] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0180.855] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.856] IWbemClassObject:Get (in: This=0x52526d8, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a2348*=0, plFlavor=0x29a234c*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5e4, varVal2=0x0), pType=0x29a2348*=19, plFlavor=0x29a234c*=0) returned 0x0 [0180.856] IWbemClassObject:Get (in: This=0x52526d8, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a2348*=19, plFlavor=0x29a234c*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5e4, varVal2=0x0), pType=0x29a2348*=19, plFlavor=0x29a234c*=0) returned 0x0 [0180.856] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0180.856] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0180.856] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.856] IWbemClassObject:Get (in: This=0x52526d8, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a244c*=0, plFlavor=0x29a2450*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="option.exe", varVal2=0x0), pType=0x29a244c*=8, plFlavor=0x29a2450*=0) returned 0x0 [0180.856] SysStringByteLen (bstr="option.exe") returned 0x14 [0180.856] SysStringByteLen (bstr="option.exe") returned 0x14 [0180.856] IWbemClassObject:Get (in: This=0x52526d8, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a244c*=8, plFlavor=0x29a2450*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="option.exe", varVal2=0x0), pType=0x29a244c*=8, plFlavor=0x29a2450*=0) returned 0x0 [0180.856] SysStringByteLen (bstr="option.exe") returned 0x14 [0180.856] SysStringByteLen (bstr="option.exe") returned 0x14 [0180.857] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0180.857] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0180.857] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.857] IWbemClassObject:Get (in: This=0x52526d8, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a2588*=0, plFlavor=0x29a258c*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Sidebar\\option.exe\" ", varVal2=0x0), pType=0x29a2588*=8, plFlavor=0x29a258c*=0) returned 0x0 [0180.857] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Sidebar\\option.exe\" ") returned 0x5c [0180.857] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Sidebar\\option.exe\" ") returned 0x5c [0180.857] IWbemClassObject:Get (in: This=0x52526d8, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a2588*=8, plFlavor=0x29a258c*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Sidebar\\option.exe\" ", varVal2=0x0), pType=0x29a2588*=8, plFlavor=0x29a258c*=0) returned 0x0 [0180.857] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Sidebar\\option.exe\" ") returned 0x5c [0180.857] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Sidebar\\option.exe\" ") returned 0x5c [0180.857] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0180.857] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5251088, puReturned=0x2995760*=0x1) returned 0x0 [0180.912] IUnknown:QueryInterface (in: This=0x5251088, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5251088) returned 0x0 [0180.913] IUnknown:QueryInterface (in: This=0x5251088, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0180.913] IUnknown:QueryInterface (in: This=0x5251088, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0180.913] IUnknown:QueryInterface (in: This=0x5251088, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0180.913] IUnknown:AddRef (This=0x5251088) returned 0x3 [0180.913] IUnknown:QueryInterface (in: This=0x5251088, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0180.913] IUnknown:QueryInterface (in: This=0x5251088, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0180.913] IUnknown:QueryInterface (in: This=0x5251088, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x525108c) returned 0x0 [0180.913] IMarshal:GetUnmarshalClass (in: This=0x525108c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0180.913] IUnknown:Release (This=0x525108c) returned 0x3 [0180.913] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0180.913] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0180.914] IUnknown:QueryInterface (in: This=0x5251088, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0180.914] IUnknown:Release (This=0x5251088) returned 0x2 [0180.914] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0180.914] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0180.914] IUnknown:QueryInterface (in: This=0x5251088, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5251088) returned 0x0 [0180.914] IUnknown:AddRef (This=0x5251088) returned 0x4 [0180.914] IUnknown:Release (This=0x5251088) returned 0x3 [0180.914] IUnknown:Release (This=0x5251088) returned 0x2 [0180.914] CoTaskMemFree (pv=0x71d200) [0180.914] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0180.914] IUnknown:AddRef (This=0x5251088) returned 0x3 [0180.914] IWbemClassObject:Get (in: This=0x5251088, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0180.914] IWbemClassObject:Get (in: This=0x5251088, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1948\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0180.914] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1948\"") returned 0x5e [0180.914] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1948\"") returned 0x5e [0180.915] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x8e8 [0180.915] SetEvent (hEvent=0x638) returned 1 [0180.915] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x8e8, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0180.959] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0180.959] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0180.959] WbemDefPath:IUnknown:QueryInterface (in: This=0x52404c8, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x52404c8) returned 0x0 [0180.959] WbemDefPath:IUnknown:AddRef (This=0x52404c8) returned 0x3 [0180.959] WbemDefPath:IUnknown:Release (This=0x52404c8) returned 0x2 [0180.959] WbemDefPath:IWbemPath:SetText (This=0x52404c8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1948\"") returned 0x0 [0180.959] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0180.959] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0180.959] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.960] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0180.960] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0180.960] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.960] IWbemClassObject:Get (in: This=0x5251088, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a3004*=0, plFlavor=0x29a3008*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x79c, varVal2=0x0), pType=0x29a3004*=19, plFlavor=0x29a3008*=0) returned 0x0 [0180.960] IWbemClassObject:Get (in: This=0x5251088, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a3004*=19, plFlavor=0x29a3008*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x79c, varVal2=0x0), pType=0x29a3004*=19, plFlavor=0x29a3008*=0) returned 0x0 [0180.960] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0180.960] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0180.960] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.960] IWbemClassObject:Get (in: This=0x5251088, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a3108*=0, plFlavor=0x29a310c*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="include.exe", varVal2=0x0), pType=0x29a3108*=8, plFlavor=0x29a310c*=0) returned 0x0 [0180.960] SysStringByteLen (bstr="include.exe") returned 0x16 [0180.960] SysStringByteLen (bstr="include.exe") returned 0x16 [0180.960] IWbemClassObject:Get (in: This=0x5251088, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a3108*=8, plFlavor=0x29a310c*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="include.exe", varVal2=0x0), pType=0x29a3108*=8, plFlavor=0x29a310c*=0) returned 0x0 [0180.960] SysStringByteLen (bstr="include.exe") returned 0x16 [0180.960] SysStringByteLen (bstr="include.exe") returned 0x16 [0180.961] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0180.961] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0180.961] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0180.961] IWbemClassObject:Get (in: This=0x5251088, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a3244*=0, plFlavor=0x29a3248*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows NT\\include.exe\" ", varVal2=0x0), pType=0x29a3244*=8, plFlavor=0x29a3248*=0) returned 0x0 [0180.961] SysStringByteLen (bstr="\"C:\\Program Files\\Windows NT\\include.exe\" ") returned 0x54 [0180.961] SysStringByteLen (bstr="\"C:\\Program Files\\Windows NT\\include.exe\" ") returned 0x54 [0180.961] IWbemClassObject:Get (in: This=0x5251088, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a3244*=8, plFlavor=0x29a3248*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows NT\\include.exe\" ", varVal2=0x0), pType=0x29a3244*=8, plFlavor=0x29a3248*=0) returned 0x0 [0180.961] SysStringByteLen (bstr="\"C:\\Program Files\\Windows NT\\include.exe\" ") returned 0x54 [0180.961] SysStringByteLen (bstr="\"C:\\Program Files\\Windows NT\\include.exe\" ") returned 0x54 [0180.961] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0180.961] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5251220, puReturned=0x2995760*=0x1) returned 0x0 [0181.005] IUnknown:QueryInterface (in: This=0x5251220, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5251220) returned 0x0 [0181.006] IUnknown:QueryInterface (in: This=0x5251220, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.006] IUnknown:QueryInterface (in: This=0x5251220, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.006] IUnknown:QueryInterface (in: This=0x5251220, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.006] IUnknown:AddRef (This=0x5251220) returned 0x3 [0181.006] IUnknown:QueryInterface (in: This=0x5251220, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.006] IUnknown:QueryInterface (in: This=0x5251220, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.006] IUnknown:QueryInterface (in: This=0x5251220, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5251224) returned 0x0 [0181.006] IMarshal:GetUnmarshalClass (in: This=0x5251224, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.006] IUnknown:Release (This=0x5251224) returned 0x3 [0181.006] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.006] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.006] IUnknown:QueryInterface (in: This=0x5251220, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.006] IUnknown:Release (This=0x5251220) returned 0x2 [0181.006] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.006] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.006] IUnknown:QueryInterface (in: This=0x5251220, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5251220) returned 0x0 [0181.007] IUnknown:AddRef (This=0x5251220) returned 0x4 [0181.007] IUnknown:Release (This=0x5251220) returned 0x3 [0181.007] IUnknown:Release (This=0x5251220) returned 0x2 [0181.007] CoTaskMemFree (pv=0x71d200) [0181.007] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.007] IUnknown:AddRef (This=0x5251220) returned 0x3 [0181.007] IWbemClassObject:Get (in: This=0x5251220, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.007] IWbemClassObject:Get (in: This=0x5251220, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1088\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.007] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1088\"") returned 0x5e [0181.007] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1088\"") returned 0x5e [0181.007] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x8ec [0181.007] SetEvent (hEvent=0x638) returned 1 [0181.008] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x8ec, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.069] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.069] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.069] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260d40, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5260d40) returned 0x0 [0181.069] WbemDefPath:IUnknown:AddRef (This=0x5260d40) returned 0x3 [0181.069] WbemDefPath:IUnknown:Release (This=0x5260d40) returned 0x2 [0181.069] WbemDefPath:IWbemPath:SetText (This=0x5260d40, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1088\"") returned 0x0 [0181.069] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.069] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.069] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.069] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.069] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.069] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.069] IWbemClassObject:Get (in: This=0x5251220, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a3d38*=0, plFlavor=0x29a3d3c*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x440, varVal2=0x0), pType=0x29a3d38*=19, plFlavor=0x29a3d3c*=0) returned 0x0 [0181.070] IWbemClassObject:Get (in: This=0x5251220, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a3d38*=19, plFlavor=0x29a3d3c*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x440, varVal2=0x0), pType=0x29a3d38*=19, plFlavor=0x29a3d3c*=0) returned 0x0 [0181.070] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.070] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.070] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.070] IWbemClassObject:Get (in: This=0x5251220, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a3e3c*=0, plFlavor=0x29a3e40*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="society-walk.exe", varVal2=0x0), pType=0x29a3e3c*=8, plFlavor=0x29a3e40*=0) returned 0x0 [0181.070] SysStringByteLen (bstr="society-walk.exe") returned 0x20 [0181.070] SysStringByteLen (bstr="society-walk.exe") returned 0x20 [0181.070] IWbemClassObject:Get (in: This=0x5251220, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a3e3c*=8, plFlavor=0x29a3e40*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="society-walk.exe", varVal2=0x0), pType=0x29a3e3c*=8, plFlavor=0x29a3e40*=0) returned 0x0 [0181.070] SysStringByteLen (bstr="society-walk.exe") returned 0x20 [0181.070] SysStringByteLen (bstr="society-walk.exe") returned 0x20 [0181.070] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.070] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.070] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.070] IWbemClassObject:Get (in: This=0x5251220, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a3f90*=0, plFlavor=0x29a3f94*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Portable Devices\\society-walk.exe\" ", varVal2=0x0), pType=0x29a3f90*=8, plFlavor=0x29a3f94*=0) returned 0x0 [0181.070] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Portable Devices\\society-walk.exe\" ") returned 0x7a [0181.071] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Portable Devices\\society-walk.exe\" ") returned 0x7a [0181.071] IWbemClassObject:Get (in: This=0x5251220, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a3f90*=8, plFlavor=0x29a3f94*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Portable Devices\\society-walk.exe\" ", varVal2=0x0), pType=0x29a3f90*=8, plFlavor=0x29a3f94*=0) returned 0x0 [0181.071] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Portable Devices\\society-walk.exe\" ") returned 0x7a [0181.071] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Portable Devices\\society-walk.exe\" ") returned 0x7a [0181.071] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.071] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x52513b8, puReturned=0x2995760*=0x1) returned 0x0 [0181.114] IUnknown:QueryInterface (in: This=0x52513b8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x52513b8) returned 0x0 [0181.115] IUnknown:QueryInterface (in: This=0x52513b8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.115] IUnknown:QueryInterface (in: This=0x52513b8, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.115] IUnknown:QueryInterface (in: This=0x52513b8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.115] IUnknown:AddRef (This=0x52513b8) returned 0x3 [0181.115] IUnknown:QueryInterface (in: This=0x52513b8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.115] IUnknown:QueryInterface (in: This=0x52513b8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.115] IUnknown:QueryInterface (in: This=0x52513b8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x52513bc) returned 0x0 [0181.115] IMarshal:GetUnmarshalClass (in: This=0x52513bc, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.115] IUnknown:Release (This=0x52513bc) returned 0x3 [0181.115] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.115] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.115] IUnknown:QueryInterface (in: This=0x52513b8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.115] IUnknown:Release (This=0x52513b8) returned 0x2 [0181.115] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.115] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.115] IUnknown:QueryInterface (in: This=0x52513b8, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x52513b8) returned 0x0 [0181.115] IUnknown:AddRef (This=0x52513b8) returned 0x4 [0181.115] IUnknown:Release (This=0x52513b8) returned 0x3 [0181.115] IUnknown:Release (This=0x52513b8) returned 0x2 [0181.115] CoTaskMemFree (pv=0x71d200) [0181.116] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.116] IUnknown:AddRef (This=0x52513b8) returned 0x3 [0181.116] IWbemClassObject:Get (in: This=0x52513b8, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.116] IWbemClassObject:Get (in: This=0x52513b8, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3080\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.116] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3080\"") returned 0x5e [0181.116] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3080\"") returned 0x5e [0181.116] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x8f0 [0181.116] SetEvent (hEvent=0x638) returned 1 [0181.116] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x8f0, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.155] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.155] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.155] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260fe0, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5260fe0) returned 0x0 [0181.155] WbemDefPath:IUnknown:AddRef (This=0x5260fe0) returned 0x3 [0181.155] WbemDefPath:IUnknown:Release (This=0x5260fe0) returned 0x2 [0181.155] WbemDefPath:IWbemPath:SetText (This=0x5260fe0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3080\"") returned 0x0 [0181.155] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.155] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.155] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.155] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.155] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.156] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.156] IWbemClassObject:Get (in: This=0x52513b8, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a4a70*=0, plFlavor=0x29a4a74*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc08, varVal2=0x0), pType=0x29a4a70*=19, plFlavor=0x29a4a74*=0) returned 0x0 [0181.156] IWbemClassObject:Get (in: This=0x52513b8, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a4a70*=19, plFlavor=0x29a4a74*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc08, varVal2=0x0), pType=0x29a4a70*=19, plFlavor=0x29a4a74*=0) returned 0x0 [0181.156] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.156] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.156] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.156] IWbemClassObject:Get (in: This=0x52513b8, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a4b74*=0, plFlavor=0x29a4b78*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="series girl into.exe", varVal2=0x0), pType=0x29a4b74*=8, plFlavor=0x29a4b78*=0) returned 0x0 [0181.156] SysStringByteLen (bstr="series girl into.exe") returned 0x28 [0181.156] SysStringByteLen (bstr="series girl into.exe") returned 0x28 [0181.156] IWbemClassObject:Get (in: This=0x52513b8, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a4b74*=8, plFlavor=0x29a4b78*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="series girl into.exe", varVal2=0x0), pType=0x29a4b74*=8, plFlavor=0x29a4b78*=0) returned 0x0 [0181.156] SysStringByteLen (bstr="series girl into.exe") returned 0x28 [0181.156] SysStringByteLen (bstr="series girl into.exe") returned 0x28 [0181.156] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.156] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.156] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.156] IWbemClassObject:Get (in: This=0x52513b8, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a4cd8*=0, plFlavor=0x29a4cdc*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\WindowsPowerShell\\series girl into.exe\" ", varVal2=0x0), pType=0x29a4cd8*=8, plFlavor=0x29a4cdc*=0) returned 0x0 [0181.157] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\series girl into.exe\" ") returned 0x74 [0181.157] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\series girl into.exe\" ") returned 0x74 [0181.157] IWbemClassObject:Get (in: This=0x52513b8, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a4cd8*=8, plFlavor=0x29a4cdc*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\WindowsPowerShell\\series girl into.exe\" ", varVal2=0x0), pType=0x29a4cd8*=8, plFlavor=0x29a4cdc*=0) returned 0x0 [0181.157] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\series girl into.exe\" ") returned 0x74 [0181.157] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\series girl into.exe\" ") returned 0x74 [0181.157] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.157] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5251550, puReturned=0x2995760*=0x1) returned 0x0 [0181.183] IUnknown:QueryInterface (in: This=0x5251550, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5251550) returned 0x0 [0181.183] IUnknown:QueryInterface (in: This=0x5251550, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.183] IUnknown:QueryInterface (in: This=0x5251550, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.183] IUnknown:QueryInterface (in: This=0x5251550, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.183] IUnknown:AddRef (This=0x5251550) returned 0x3 [0181.183] IUnknown:QueryInterface (in: This=0x5251550, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.183] IUnknown:QueryInterface (in: This=0x5251550, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.183] IUnknown:QueryInterface (in: This=0x5251550, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5251554) returned 0x0 [0181.184] IMarshal:GetUnmarshalClass (in: This=0x5251554, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.184] IUnknown:Release (This=0x5251554) returned 0x3 [0181.184] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.184] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.184] IUnknown:QueryInterface (in: This=0x5251550, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.184] IUnknown:Release (This=0x5251550) returned 0x2 [0181.184] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.184] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.184] IUnknown:QueryInterface (in: This=0x5251550, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5251550) returned 0x0 [0181.184] IUnknown:AddRef (This=0x5251550) returned 0x4 [0181.184] IUnknown:Release (This=0x5251550) returned 0x3 [0181.184] IUnknown:Release (This=0x5251550) returned 0x2 [0181.184] CoTaskMemFree (pv=0x71d200) [0181.184] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.184] IUnknown:AddRef (This=0x5251550) returned 0x3 [0181.184] IWbemClassObject:Get (in: This=0x5251550, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.184] IWbemClassObject:Get (in: This=0x5251550, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3088\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.184] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3088\"") returned 0x5e [0181.184] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3088\"") returned 0x5e [0181.184] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x8f4 [0181.185] SetEvent (hEvent=0x638) returned 1 [0181.185] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x8f4, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.226] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.226] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.226] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261910, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5261910) returned 0x0 [0181.226] WbemDefPath:IUnknown:AddRef (This=0x5261910) returned 0x3 [0181.226] WbemDefPath:IUnknown:Release (This=0x5261910) returned 0x2 [0181.226] WbemDefPath:IWbemPath:SetText (This=0x5261910, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3088\"") returned 0x0 [0181.226] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.226] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.226] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.226] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.226] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.226] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.226] IWbemClassObject:Get (in: This=0x5251550, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a57b0*=0, plFlavor=0x29a57b4*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc10, varVal2=0x0), pType=0x29a57b0*=19, plFlavor=0x29a57b4*=0) returned 0x0 [0181.226] IWbemClassObject:Get (in: This=0x5251550, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a57b0*=19, plFlavor=0x29a57b4*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc10, varVal2=0x0), pType=0x29a57b0*=19, plFlavor=0x29a57b4*=0) returned 0x0 [0181.227] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.227] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.227] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.227] IWbemClassObject:Get (in: This=0x5251550, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a58b4*=0, plFlavor=0x29a58b8*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="something.exe", varVal2=0x0), pType=0x29a58b4*=8, plFlavor=0x29a58b8*=0) returned 0x0 [0181.227] SysStringByteLen (bstr="something.exe") returned 0x1a [0181.227] SysStringByteLen (bstr="something.exe") returned 0x1a [0181.227] IWbemClassObject:Get (in: This=0x5251550, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a58b4*=8, plFlavor=0x29a58b8*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="something.exe", varVal2=0x0), pType=0x29a58b4*=8, plFlavor=0x29a58b8*=0) returned 0x0 [0181.227] SysStringByteLen (bstr="something.exe") returned 0x1a [0181.227] SysStringByteLen (bstr="something.exe") returned 0x1a [0181.227] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.227] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.227] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.227] IWbemClassObject:Get (in: This=0x5251550, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a59f8*=0, plFlavor=0x29a59fc*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Defender\\something.exe\" ", varVal2=0x0), pType=0x29a59f8*=8, plFlavor=0x29a59fc*=0) returned 0x0 [0181.227] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Defender\\something.exe\" ") returned 0x64 [0181.227] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Defender\\something.exe\" ") returned 0x64 [0181.227] IWbemClassObject:Get (in: This=0x5251550, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a59f8*=8, plFlavor=0x29a59fc*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Defender\\something.exe\" ", varVal2=0x0), pType=0x29a59f8*=8, plFlavor=0x29a59fc*=0) returned 0x0 [0181.227] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Defender\\something.exe\" ") returned 0x64 [0181.228] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Defender\\something.exe\" ") returned 0x64 [0181.228] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.228] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5263df8, puReturned=0x2995760*=0x1) returned 0x0 [0181.275] IUnknown:QueryInterface (in: This=0x5263df8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5263df8) returned 0x0 [0181.275] IUnknown:QueryInterface (in: This=0x5263df8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.275] IUnknown:QueryInterface (in: This=0x5263df8, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.275] IUnknown:QueryInterface (in: This=0x5263df8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.275] IUnknown:AddRef (This=0x5263df8) returned 0x3 [0181.276] IUnknown:QueryInterface (in: This=0x5263df8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.276] IUnknown:QueryInterface (in: This=0x5263df8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.276] IUnknown:QueryInterface (in: This=0x5263df8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5263dfc) returned 0x0 [0181.276] IMarshal:GetUnmarshalClass (in: This=0x5263dfc, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.276] IUnknown:Release (This=0x5263dfc) returned 0x3 [0181.276] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.276] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.276] IUnknown:QueryInterface (in: This=0x5263df8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.276] IUnknown:Release (This=0x5263df8) returned 0x2 [0181.276] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.276] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.276] IUnknown:QueryInterface (in: This=0x5263df8, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5263df8) returned 0x0 [0181.276] IUnknown:AddRef (This=0x5263df8) returned 0x4 [0181.276] IUnknown:Release (This=0x5263df8) returned 0x3 [0181.276] IUnknown:Release (This=0x5263df8) returned 0x2 [0181.276] CoTaskMemFree (pv=0x71d200) [0181.276] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.276] IUnknown:AddRef (This=0x5263df8) returned 0x3 [0181.276] IWbemClassObject:Get (in: This=0x5263df8, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.277] IWbemClassObject:Get (in: This=0x5263df8, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3096\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.277] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3096\"") returned 0x5e [0181.277] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3096\"") returned 0x5e [0181.277] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x8f8 [0181.277] SetEvent (hEvent=0x638) returned 1 [0181.277] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x8f8, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.359] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.359] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.359] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261ad0, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5261ad0) returned 0x0 [0181.359] WbemDefPath:IUnknown:AddRef (This=0x5261ad0) returned 0x3 [0181.359] WbemDefPath:IUnknown:Release (This=0x5261ad0) returned 0x2 [0181.359] WbemDefPath:IWbemPath:SetText (This=0x5261ad0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3096\"") returned 0x0 [0181.359] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.359] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.359] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.359] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.359] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.359] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.359] IWbemClassObject:Get (in: This=0x5263df8, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a6494*=0, plFlavor=0x29a6498*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc18, varVal2=0x0), pType=0x29a6494*=19, plFlavor=0x29a6498*=0) returned 0x0 [0181.360] IWbemClassObject:Get (in: This=0x5263df8, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a6494*=19, plFlavor=0x29a6498*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc18, varVal2=0x0), pType=0x29a6494*=19, plFlavor=0x29a6498*=0) returned 0x0 [0181.360] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.360] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.360] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.360] IWbemClassObject:Get (in: This=0x5263df8, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a6598*=0, plFlavor=0x29a659c*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="at-produce.exe", varVal2=0x0), pType=0x29a6598*=8, plFlavor=0x29a659c*=0) returned 0x0 [0181.360] SysStringByteLen (bstr="at-produce.exe") returned 0x1c [0181.360] SysStringByteLen (bstr="at-produce.exe") returned 0x1c [0181.360] IWbemClassObject:Get (in: This=0x5263df8, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a6598*=8, plFlavor=0x29a659c*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="at-produce.exe", varVal2=0x0), pType=0x29a6598*=8, plFlavor=0x29a659c*=0) returned 0x0 [0181.360] SysStringByteLen (bstr="at-produce.exe") returned 0x1c [0181.360] SysStringByteLen (bstr="at-produce.exe") returned 0x1c [0181.360] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.360] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.360] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.360] IWbemClassObject:Get (in: This=0x5263df8, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a66e4*=0, plFlavor=0x29a66e8*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\WindowsPowerShell\\at-produce.exe\" ", varVal2=0x0), pType=0x29a66e4*=8, plFlavor=0x29a66e8*=0) returned 0x0 [0181.361] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\at-produce.exe\" ") returned 0x68 [0181.361] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\at-produce.exe\" ") returned 0x68 [0181.361] IWbemClassObject:Get (in: This=0x5263df8, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a66e4*=8, plFlavor=0x29a66e8*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\WindowsPowerShell\\at-produce.exe\" ", varVal2=0x0), pType=0x29a66e4*=8, plFlavor=0x29a66e8*=0) returned 0x0 [0181.361] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\at-produce.exe\" ") returned 0x68 [0181.361] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\at-produce.exe\" ") returned 0x68 [0181.361] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.361] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5263c60, puReturned=0x2995760*=0x1) returned 0x0 [0181.393] IUnknown:QueryInterface (in: This=0x5263c60, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5263c60) returned 0x0 [0181.393] IUnknown:QueryInterface (in: This=0x5263c60, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.393] IUnknown:QueryInterface (in: This=0x5263c60, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.393] IUnknown:QueryInterface (in: This=0x5263c60, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.394] IUnknown:AddRef (This=0x5263c60) returned 0x3 [0181.394] IUnknown:QueryInterface (in: This=0x5263c60, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.394] IUnknown:QueryInterface (in: This=0x5263c60, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.394] IUnknown:QueryInterface (in: This=0x5263c60, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5263c64) returned 0x0 [0181.395] IMarshal:GetUnmarshalClass (in: This=0x5263c64, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.395] IUnknown:Release (This=0x5263c64) returned 0x3 [0181.395] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.395] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.395] IUnknown:QueryInterface (in: This=0x5263c60, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.395] IUnknown:Release (This=0x5263c60) returned 0x2 [0181.395] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.395] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.395] IUnknown:QueryInterface (in: This=0x5263c60, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5263c60) returned 0x0 [0181.395] IUnknown:AddRef (This=0x5263c60) returned 0x4 [0181.395] IUnknown:Release (This=0x5263c60) returned 0x3 [0181.395] IUnknown:Release (This=0x5263c60) returned 0x2 [0181.395] CoTaskMemFree (pv=0x71d200) [0181.395] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.395] IUnknown:AddRef (This=0x5263c60) returned 0x3 [0181.395] IWbemClassObject:Get (in: This=0x5263c60, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.395] IWbemClassObject:Get (in: This=0x5263c60, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3104\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.396] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3104\"") returned 0x5e [0181.396] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3104\"") returned 0x5e [0181.396] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x8fc [0181.396] SetEvent (hEvent=0x638) returned 1 [0181.396] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x8fc, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.409] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.409] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.409] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260e90, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5260e90) returned 0x0 [0181.409] WbemDefPath:IUnknown:AddRef (This=0x5260e90) returned 0x3 [0181.409] WbemDefPath:IUnknown:Release (This=0x5260e90) returned 0x2 [0181.409] WbemDefPath:IWbemPath:SetText (This=0x5260e90, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3104\"") returned 0x0 [0181.409] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.409] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.409] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.409] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.409] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.409] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.409] IWbemClassObject:Get (in: This=0x5263c60, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a718c*=0, plFlavor=0x29a7190*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc20, varVal2=0x0), pType=0x29a718c*=19, plFlavor=0x29a7190*=0) returned 0x0 [0181.409] IWbemClassObject:Get (in: This=0x5263c60, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a718c*=19, plFlavor=0x29a7190*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc20, varVal2=0x0), pType=0x29a718c*=19, plFlavor=0x29a7190*=0) returned 0x0 [0181.410] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.410] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.410] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.410] IWbemClassObject:Get (in: This=0x5263c60, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a7290*=0, plFlavor=0x29a7294*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="management training.exe", varVal2=0x0), pType=0x29a7290*=8, plFlavor=0x29a7294*=0) returned 0x0 [0181.410] SysStringByteLen (bstr="management training.exe") returned 0x2e [0181.410] SysStringByteLen (bstr="management training.exe") returned 0x2e [0181.410] IWbemClassObject:Get (in: This=0x5263c60, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a7290*=8, plFlavor=0x29a7294*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="management training.exe", varVal2=0x0), pType=0x29a7290*=8, plFlavor=0x29a7294*=0) returned 0x0 [0181.410] SysStringByteLen (bstr="management training.exe") returned 0x2e [0181.410] SysStringByteLen (bstr="management training.exe") returned 0x2e [0181.410] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.411] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.411] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.411] IWbemClassObject:Get (in: This=0x5263c60, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a73fc*=0, plFlavor=0x29a7400*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\MSBuild\\management training.exe\" ", varVal2=0x0), pType=0x29a73fc*=8, plFlavor=0x29a7400*=0) returned 0x0 [0181.411] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\MSBuild\\management training.exe\" ") returned 0x72 [0181.411] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\MSBuild\\management training.exe\" ") returned 0x72 [0181.411] IWbemClassObject:Get (in: This=0x5263c60, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a73fc*=8, plFlavor=0x29a7400*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\MSBuild\\management training.exe\" ", varVal2=0x0), pType=0x29a73fc*=8, plFlavor=0x29a7400*=0) returned 0x0 [0181.411] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\MSBuild\\management training.exe\" ") returned 0x72 [0181.411] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\MSBuild\\management training.exe\" ") returned 0x72 [0181.411] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.411] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5263f90, puReturned=0x2995760*=0x1) returned 0x0 [0181.442] IUnknown:QueryInterface (in: This=0x5263f90, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5263f90) returned 0x0 [0181.443] IUnknown:QueryInterface (in: This=0x5263f90, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.443] IUnknown:QueryInterface (in: This=0x5263f90, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.443] IUnknown:QueryInterface (in: This=0x5263f90, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.443] IUnknown:AddRef (This=0x5263f90) returned 0x3 [0181.443] IUnknown:QueryInterface (in: This=0x5263f90, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.443] IUnknown:QueryInterface (in: This=0x5263f90, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.443] IUnknown:QueryInterface (in: This=0x5263f90, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5263f94) returned 0x0 [0181.443] IMarshal:GetUnmarshalClass (in: This=0x5263f94, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.443] IUnknown:Release (This=0x5263f94) returned 0x3 [0181.443] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.443] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.443] IUnknown:QueryInterface (in: This=0x5263f90, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.443] IUnknown:Release (This=0x5263f90) returned 0x2 [0181.443] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.443] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.443] IUnknown:QueryInterface (in: This=0x5263f90, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5263f90) returned 0x0 [0181.444] IUnknown:AddRef (This=0x5263f90) returned 0x4 [0181.444] IUnknown:Release (This=0x5263f90) returned 0x3 [0181.444] IUnknown:Release (This=0x5263f90) returned 0x2 [0181.444] CoTaskMemFree (pv=0x71d200) [0181.444] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.444] IUnknown:AddRef (This=0x5263f90) returned 0x3 [0181.444] IWbemClassObject:Get (in: This=0x5263f90, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.444] IWbemClassObject:Get (in: This=0x5263f90, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3112\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.444] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3112\"") returned 0x5e [0181.444] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3112\"") returned 0x5e [0181.444] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x900 [0181.444] SetEvent (hEvent=0x638) returned 1 [0181.445] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x900, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.452] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.452] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.452] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260f00, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5260f00) returned 0x0 [0181.452] WbemDefPath:IUnknown:AddRef (This=0x5260f00) returned 0x3 [0181.452] WbemDefPath:IUnknown:Release (This=0x5260f00) returned 0x2 [0181.452] WbemDefPath:IWbemPath:SetText (This=0x5260f00, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3112\"") returned 0x0 [0181.452] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.452] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.452] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.453] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.453] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.453] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.453] IWbemClassObject:Get (in: This=0x5263f90, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a7ed0*=0, plFlavor=0x29a7ed4*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc28, varVal2=0x0), pType=0x29a7ed0*=19, plFlavor=0x29a7ed4*=0) returned 0x0 [0181.453] IWbemClassObject:Get (in: This=0x5263f90, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a7ed0*=19, plFlavor=0x29a7ed4*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc28, varVal2=0x0), pType=0x29a7ed0*=19, plFlavor=0x29a7ed4*=0) returned 0x0 [0181.453] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.453] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.453] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.453] IWbemClassObject:Get (in: This=0x5263f90, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a7fd4*=0, plFlavor=0x29a7fd8*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="better.exe", varVal2=0x0), pType=0x29a7fd4*=8, plFlavor=0x29a7fd8*=0) returned 0x0 [0181.453] SysStringByteLen (bstr="better.exe") returned 0x14 [0181.453] SysStringByteLen (bstr="better.exe") returned 0x14 [0181.453] IWbemClassObject:Get (in: This=0x5263f90, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a7fd4*=8, plFlavor=0x29a7fd8*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="better.exe", varVal2=0x0), pType=0x29a7fd4*=8, plFlavor=0x29a7fd8*=0) returned 0x0 [0181.454] SysStringByteLen (bstr="better.exe") returned 0x14 [0181.454] SysStringByteLen (bstr="better.exe") returned 0x14 [0181.454] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.454] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.454] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.454] IWbemClassObject:Get (in: This=0x5263f90, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a8110*=0, plFlavor=0x29a8114*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Mail\\better.exe\" ", varVal2=0x0), pType=0x29a8110*=8, plFlavor=0x29a8114*=0) returned 0x0 [0181.454] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Mail\\better.exe\" ") returned 0x56 [0181.454] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Mail\\better.exe\" ") returned 0x56 [0181.454] IWbemClassObject:Get (in: This=0x5263f90, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a8110*=8, plFlavor=0x29a8114*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Mail\\better.exe\" ", varVal2=0x0), pType=0x29a8110*=8, plFlavor=0x29a8114*=0) returned 0x0 [0181.454] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Mail\\better.exe\" ") returned 0x56 [0181.454] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Mail\\better.exe\" ") returned 0x56 [0181.454] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.454] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5264128, puReturned=0x2995760*=0x1) returned 0x0 [0181.457] IUnknown:QueryInterface (in: This=0x5264128, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5264128) returned 0x0 [0181.457] IUnknown:QueryInterface (in: This=0x5264128, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.457] IUnknown:QueryInterface (in: This=0x5264128, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.457] IUnknown:QueryInterface (in: This=0x5264128, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.457] IUnknown:AddRef (This=0x5264128) returned 0x3 [0181.458] IUnknown:QueryInterface (in: This=0x5264128, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.458] IUnknown:QueryInterface (in: This=0x5264128, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.458] IUnknown:QueryInterface (in: This=0x5264128, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x526412c) returned 0x0 [0181.458] IMarshal:GetUnmarshalClass (in: This=0x526412c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.458] IUnknown:Release (This=0x526412c) returned 0x3 [0181.458] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.458] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.458] IUnknown:QueryInterface (in: This=0x5264128, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.458] IUnknown:Release (This=0x5264128) returned 0x2 [0181.458] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.458] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.458] IUnknown:QueryInterface (in: This=0x5264128, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5264128) returned 0x0 [0181.458] IUnknown:AddRef (This=0x5264128) returned 0x4 [0181.458] IUnknown:Release (This=0x5264128) returned 0x3 [0181.458] IUnknown:Release (This=0x5264128) returned 0x2 [0181.458] CoTaskMemFree (pv=0x71d200) [0181.458] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.458] IUnknown:AddRef (This=0x5264128) returned 0x3 [0181.458] IWbemClassObject:Get (in: This=0x5264128, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.459] IWbemClassObject:Get (in: This=0x5264128, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3120\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.459] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3120\"") returned 0x5e [0181.459] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3120\"") returned 0x5e [0181.459] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x904 [0181.459] SetEvent (hEvent=0x638) returned 1 [0181.459] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x904, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.462] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.462] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.462] WbemDefPath:IUnknown:QueryInterface (in: This=0x52611a0, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x52611a0) returned 0x0 [0181.462] WbemDefPath:IUnknown:AddRef (This=0x52611a0) returned 0x3 [0181.462] WbemDefPath:IUnknown:Release (This=0x52611a0) returned 0x2 [0181.462] WbemDefPath:IWbemPath:SetText (This=0x52611a0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3120\"") returned 0x0 [0181.462] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.462] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.462] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.462] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.462] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.462] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.462] IWbemClassObject:Get (in: This=0x5264128, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a8b78*=0, plFlavor=0x29a8b7c*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc30, varVal2=0x0), pType=0x29a8b78*=19, plFlavor=0x29a8b7c*=0) returned 0x0 [0181.462] IWbemClassObject:Get (in: This=0x5264128, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a8b78*=19, plFlavor=0x29a8b7c*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc30, varVal2=0x0), pType=0x29a8b78*=19, plFlavor=0x29a8b7c*=0) returned 0x0 [0181.463] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.463] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.463] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.463] IWbemClassObject:Get (in: This=0x5264128, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a8c7c*=0, plFlavor=0x29a8c80*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="out_public.exe", varVal2=0x0), pType=0x29a8c7c*=8, plFlavor=0x29a8c80*=0) returned 0x0 [0181.463] SysStringByteLen (bstr="out_public.exe") returned 0x1c [0181.463] SysStringByteLen (bstr="out_public.exe") returned 0x1c [0181.463] IWbemClassObject:Get (in: This=0x5264128, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a8c7c*=8, plFlavor=0x29a8c80*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="out_public.exe", varVal2=0x0), pType=0x29a8c7c*=8, plFlavor=0x29a8c80*=0) returned 0x0 [0181.463] SysStringByteLen (bstr="out_public.exe") returned 0x1c [0181.463] SysStringByteLen (bstr="out_public.exe") returned 0x1c [0181.463] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.463] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.463] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.463] IWbemClassObject:Get (in: This=0x5264128, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a8dc8*=0, plFlavor=0x29a8dcc*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Reference Assemblies\\out_public.exe\" ", varVal2=0x0), pType=0x29a8dc8*=8, plFlavor=0x29a8dcc*=0) returned 0x0 [0181.463] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Reference Assemblies\\out_public.exe\" ") returned 0x7a [0181.463] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Reference Assemblies\\out_public.exe\" ") returned 0x7a [0181.464] IWbemClassObject:Get (in: This=0x5264128, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a8dc8*=8, plFlavor=0x29a8dcc*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Reference Assemblies\\out_public.exe\" ", varVal2=0x0), pType=0x29a8dc8*=8, plFlavor=0x29a8dcc*=0) returned 0x0 [0181.464] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Reference Assemblies\\out_public.exe\" ") returned 0x7a [0181.464] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Reference Assemblies\\out_public.exe\" ") returned 0x7a [0181.464] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.464] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5262fa0, puReturned=0x2995760*=0x1) returned 0x0 [0181.466] IUnknown:QueryInterface (in: This=0x5262fa0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5262fa0) returned 0x0 [0181.467] IUnknown:QueryInterface (in: This=0x5262fa0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.467] IUnknown:QueryInterface (in: This=0x5262fa0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.467] IUnknown:QueryInterface (in: This=0x5262fa0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.467] IUnknown:AddRef (This=0x5262fa0) returned 0x3 [0181.467] IUnknown:QueryInterface (in: This=0x5262fa0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.467] IUnknown:QueryInterface (in: This=0x5262fa0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.467] IUnknown:QueryInterface (in: This=0x5262fa0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5262fa4) returned 0x0 [0181.467] IMarshal:GetUnmarshalClass (in: This=0x5262fa4, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.467] IUnknown:Release (This=0x5262fa4) returned 0x3 [0181.467] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.467] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.467] IUnknown:QueryInterface (in: This=0x5262fa0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.467] IUnknown:Release (This=0x5262fa0) returned 0x2 [0181.467] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.467] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.467] IUnknown:QueryInterface (in: This=0x5262fa0, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5262fa0) returned 0x0 [0181.468] IUnknown:AddRef (This=0x5262fa0) returned 0x4 [0181.468] IUnknown:Release (This=0x5262fa0) returned 0x3 [0181.468] IUnknown:Release (This=0x5262fa0) returned 0x2 [0181.468] CoTaskMemFree (pv=0x71d200) [0181.468] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.468] IUnknown:AddRef (This=0x5262fa0) returned 0x3 [0181.468] IWbemClassObject:Get (in: This=0x5262fa0, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.468] IWbemClassObject:Get (in: This=0x5262fa0, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3128\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.468] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3128\"") returned 0x5e [0181.468] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3128\"") returned 0x5e [0181.468] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x908 [0181.468] SetEvent (hEvent=0x638) returned 1 [0181.468] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x908, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.479] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.479] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.479] WbemDefPath:IUnknown:QueryInterface (in: This=0x52610c0, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x52610c0) returned 0x0 [0181.479] WbemDefPath:IUnknown:AddRef (This=0x52610c0) returned 0x3 [0181.479] WbemDefPath:IUnknown:Release (This=0x52610c0) returned 0x2 [0181.479] WbemDefPath:IWbemPath:SetText (This=0x52610c0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3128\"") returned 0x0 [0181.479] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.479] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.479] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.479] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.480] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.480] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.480] IWbemClassObject:Get (in: This=0x5262fa0, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a98a4*=0, plFlavor=0x29a98a8*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc38, varVal2=0x0), pType=0x29a98a4*=19, plFlavor=0x29a98a8*=0) returned 0x0 [0181.480] IWbemClassObject:Get (in: This=0x5262fa0, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a98a4*=19, plFlavor=0x29a98a8*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc38, varVal2=0x0), pType=0x29a98a4*=19, plFlavor=0x29a98a8*=0) returned 0x0 [0181.480] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.480] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.480] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.480] IWbemClassObject:Get (in: This=0x5262fa0, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a99a8*=0, plFlavor=0x29a99ac*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="start.exe", varVal2=0x0), pType=0x29a99a8*=8, plFlavor=0x29a99ac*=0) returned 0x0 [0181.480] SysStringByteLen (bstr="start.exe") returned 0x12 [0181.480] SysStringByteLen (bstr="start.exe") returned 0x12 [0181.480] IWbemClassObject:Get (in: This=0x5262fa0, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a99a8*=8, plFlavor=0x29a99ac*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="start.exe", varVal2=0x0), pType=0x29a99a8*=8, plFlavor=0x29a99ac*=0) returned 0x0 [0181.480] SysStringByteLen (bstr="start.exe") returned 0x12 [0181.480] SysStringByteLen (bstr="start.exe") returned 0x12 [0181.480] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.481] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.481] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.481] IWbemClassObject:Get (in: This=0x5262fa0, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a9adc*=0, plFlavor=0x29a9ae0*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Internet Explorer\\start.exe\" ", varVal2=0x0), pType=0x29a9adc*=8, plFlavor=0x29a9ae0*=0) returned 0x0 [0181.481] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\start.exe\" ") returned 0x5e [0181.481] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\start.exe\" ") returned 0x5e [0181.481] IWbemClassObject:Get (in: This=0x5262fa0, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a9adc*=8, plFlavor=0x29a9ae0*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Internet Explorer\\start.exe\" ", varVal2=0x0), pType=0x29a9adc*=8, plFlavor=0x29a9ae0*=0) returned 0x0 [0181.481] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\start.exe\" ") returned 0x5e [0181.481] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\start.exe\" ") returned 0x5e [0181.481] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.481] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5263ac8, puReturned=0x2995760*=0x1) returned 0x0 [0181.482] IUnknown:QueryInterface (in: This=0x5263ac8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5263ac8) returned 0x0 [0181.483] IUnknown:QueryInterface (in: This=0x5263ac8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.483] IUnknown:QueryInterface (in: This=0x5263ac8, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.483] IUnknown:QueryInterface (in: This=0x5263ac8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.483] IUnknown:AddRef (This=0x5263ac8) returned 0x3 [0181.483] IUnknown:QueryInterface (in: This=0x5263ac8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.483] IUnknown:QueryInterface (in: This=0x5263ac8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.483] IUnknown:QueryInterface (in: This=0x5263ac8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5263acc) returned 0x0 [0181.483] IMarshal:GetUnmarshalClass (in: This=0x5263acc, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.483] IUnknown:Release (This=0x5263acc) returned 0x3 [0181.483] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.483] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.483] IUnknown:QueryInterface (in: This=0x5263ac8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.483] IUnknown:Release (This=0x5263ac8) returned 0x2 [0181.483] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.483] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.483] IUnknown:QueryInterface (in: This=0x5263ac8, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5263ac8) returned 0x0 [0181.484] IUnknown:AddRef (This=0x5263ac8) returned 0x4 [0181.484] IUnknown:Release (This=0x5263ac8) returned 0x3 [0181.484] IUnknown:Release (This=0x5263ac8) returned 0x2 [0181.484] CoTaskMemFree (pv=0x71d200) [0181.484] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.484] IUnknown:AddRef (This=0x5263ac8) returned 0x3 [0181.484] IWbemClassObject:Get (in: This=0x5263ac8, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.484] IWbemClassObject:Get (in: This=0x5263ac8, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3136\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.484] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3136\"") returned 0x5e [0181.484] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3136\"") returned 0x5e [0181.484] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x90c [0181.484] SetEvent (hEvent=0x638) returned 1 [0181.485] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x90c, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.487] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.487] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.487] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261590, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5261590) returned 0x0 [0181.487] WbemDefPath:IUnknown:AddRef (This=0x5261590) returned 0x3 [0181.487] WbemDefPath:IUnknown:Release (This=0x5261590) returned 0x2 [0181.487] WbemDefPath:IWbemPath:SetText (This=0x5261590, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3136\"") returned 0x0 [0181.487] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.487] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.487] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.487] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.487] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.487] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.489] IWbemClassObject:Get (in: This=0x5263ac8, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29aa558*=0, plFlavor=0x29aa55c*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc40, varVal2=0x0), pType=0x29aa558*=19, plFlavor=0x29aa55c*=0) returned 0x0 [0181.489] IWbemClassObject:Get (in: This=0x5263ac8, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29aa558*=19, plFlavor=0x29aa55c*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc40, varVal2=0x0), pType=0x29aa558*=19, plFlavor=0x29aa55c*=0) returned 0x0 [0181.489] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.489] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.489] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.490] IWbemClassObject:Get (in: This=0x5263ac8, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29aa65c*=0, plFlavor=0x29aa660*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="situation_group_head.exe", varVal2=0x0), pType=0x29aa65c*=8, plFlavor=0x29aa660*=0) returned 0x0 [0181.490] SysStringByteLen (bstr="situation_group_head.exe") returned 0x30 [0181.490] SysStringByteLen (bstr="situation_group_head.exe") returned 0x30 [0181.490] IWbemClassObject:Get (in: This=0x5263ac8, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29aa65c*=8, plFlavor=0x29aa660*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="situation_group_head.exe", varVal2=0x0), pType=0x29aa65c*=8, plFlavor=0x29aa660*=0) returned 0x0 [0181.490] SysStringByteLen (bstr="situation_group_head.exe") returned 0x30 [0181.490] SysStringByteLen (bstr="situation_group_head.exe") returned 0x30 [0181.490] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.490] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.490] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.490] IWbemClassObject:Get (in: This=0x5263ac8, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29aa7d0*=0, plFlavor=0x29aa7d4*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\WindowsPowerShell\\situation_group_head.exe\" ", varVal2=0x0), pType=0x29aa7d0*=8, plFlavor=0x29aa7d4*=0) returned 0x0 [0181.490] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\WindowsPowerShell\\situation_group_head.exe\" ") returned 0x88 [0181.490] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\WindowsPowerShell\\situation_group_head.exe\" ") returned 0x88 [0181.490] IWbemClassObject:Get (in: This=0x5263ac8, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29aa7d0*=8, plFlavor=0x29aa7d4*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\WindowsPowerShell\\situation_group_head.exe\" ", varVal2=0x0), pType=0x29aa7d0*=8, plFlavor=0x29aa7d4*=0) returned 0x0 [0181.490] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\WindowsPowerShell\\situation_group_head.exe\" ") returned 0x88 [0181.490] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\WindowsPowerShell\\situation_group_head.exe\" ") returned 0x88 [0181.491] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.491] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x52622e0, puReturned=0x2995760*=0x1) returned 0x0 [0181.492] IUnknown:QueryInterface (in: This=0x52622e0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x52622e0) returned 0x0 [0181.492] IUnknown:QueryInterface (in: This=0x52622e0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.492] IUnknown:QueryInterface (in: This=0x52622e0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.492] IUnknown:QueryInterface (in: This=0x52622e0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.492] IUnknown:AddRef (This=0x52622e0) returned 0x3 [0181.492] IUnknown:QueryInterface (in: This=0x52622e0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.492] IUnknown:QueryInterface (in: This=0x52622e0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.492] IUnknown:QueryInterface (in: This=0x52622e0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x52622e4) returned 0x0 [0181.493] IMarshal:GetUnmarshalClass (in: This=0x52622e4, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.493] IUnknown:Release (This=0x52622e4) returned 0x3 [0181.493] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.493] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.493] IUnknown:QueryInterface (in: This=0x52622e0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.493] IUnknown:Release (This=0x52622e0) returned 0x2 [0181.493] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.493] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.493] IUnknown:QueryInterface (in: This=0x52622e0, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x52622e0) returned 0x0 [0181.493] IUnknown:AddRef (This=0x52622e0) returned 0x4 [0181.493] IUnknown:Release (This=0x52622e0) returned 0x3 [0181.493] IUnknown:Release (This=0x52622e0) returned 0x2 [0181.493] CoTaskMemFree (pv=0x71d200) [0181.493] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.493] IUnknown:AddRef (This=0x52622e0) returned 0x3 [0181.493] IWbemClassObject:Get (in: This=0x52622e0, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.493] IWbemClassObject:Get (in: This=0x52622e0, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3148\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.494] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3148\"") returned 0x5e [0181.494] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3148\"") returned 0x5e [0181.494] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x910 [0181.494] SetEvent (hEvent=0x638) returned 1 [0181.494] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x910, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.496] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.496] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.496] WbemDefPath:IUnknown:QueryInterface (in: This=0x52614b0, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x52614b0) returned 0x0 [0181.496] WbemDefPath:IUnknown:AddRef (This=0x52614b0) returned 0x3 [0181.496] WbemDefPath:IUnknown:Release (This=0x52614b0) returned 0x2 [0181.496] WbemDefPath:IWbemPath:SetText (This=0x52614b0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3148\"") returned 0x0 [0181.496] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.496] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.497] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.497] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.497] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.497] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.497] IWbemClassObject:Get (in: This=0x52622e0, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29ab2ec*=0, plFlavor=0x29ab2f0*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc4c, varVal2=0x0), pType=0x29ab2ec*=19, plFlavor=0x29ab2f0*=0) returned 0x0 [0181.497] IWbemClassObject:Get (in: This=0x52622e0, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29ab2ec*=19, plFlavor=0x29ab2f0*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc4c, varVal2=0x0), pType=0x29ab2ec*=19, plFlavor=0x29ab2f0*=0) returned 0x0 [0181.497] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.497] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.497] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.497] IWbemClassObject:Get (in: This=0x52622e0, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29ab3f0*=0, plFlavor=0x29ab3f4*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="collection-will-husband.exe", varVal2=0x0), pType=0x29ab3f0*=8, plFlavor=0x29ab3f4*=0) returned 0x0 [0181.497] SysStringByteLen (bstr="collection-will-husband.exe") returned 0x36 [0181.497] SysStringByteLen (bstr="collection-will-husband.exe") returned 0x36 [0181.497] IWbemClassObject:Get (in: This=0x52622e0, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29ab3f0*=8, plFlavor=0x29ab3f4*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="collection-will-husband.exe", varVal2=0x0), pType=0x29ab3f0*=8, plFlavor=0x29ab3f4*=0) returned 0x0 [0181.497] SysStringByteLen (bstr="collection-will-husband.exe") returned 0x36 [0181.497] SysStringByteLen (bstr="collection-will-husband.exe") returned 0x36 [0181.498] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.498] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.498] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.498] IWbemClassObject:Get (in: This=0x52622e0, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29ab56c*=0, plFlavor=0x29ab570*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft SQL Server\\collection-will-husband.exe\" ", varVal2=0x0), pType=0x29ab56c*=8, plFlavor=0x29ab570*=0) returned 0x0 [0181.498] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft SQL Server\\collection-will-husband.exe\" ") returned 0x94 [0181.498] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft SQL Server\\collection-will-husband.exe\" ") returned 0x94 [0181.498] IWbemClassObject:Get (in: This=0x52622e0, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29ab56c*=8, plFlavor=0x29ab570*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft SQL Server\\collection-will-husband.exe\" ", varVal2=0x0), pType=0x29ab56c*=8, plFlavor=0x29ab570*=0) returned 0x0 [0181.498] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft SQL Server\\collection-will-husband.exe\" ") returned 0x94 [0181.498] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft SQL Server\\collection-will-husband.exe\" ") returned 0x94 [0181.498] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.498] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5262478, puReturned=0x2995760*=0x1) returned 0x0 [0181.499] IUnknown:QueryInterface (in: This=0x5262478, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5262478) returned 0x0 [0181.499] IUnknown:QueryInterface (in: This=0x5262478, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.499] IUnknown:QueryInterface (in: This=0x5262478, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.499] IUnknown:QueryInterface (in: This=0x5262478, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.500] IUnknown:AddRef (This=0x5262478) returned 0x3 [0181.500] IUnknown:QueryInterface (in: This=0x5262478, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.500] IUnknown:QueryInterface (in: This=0x5262478, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.500] IUnknown:QueryInterface (in: This=0x5262478, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x526247c) returned 0x0 [0181.500] IMarshal:GetUnmarshalClass (in: This=0x526247c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.500] IUnknown:Release (This=0x526247c) returned 0x3 [0181.500] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.500] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.500] IUnknown:QueryInterface (in: This=0x5262478, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.500] IUnknown:Release (This=0x5262478) returned 0x2 [0181.500] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.500] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.500] IUnknown:QueryInterface (in: This=0x5262478, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5262478) returned 0x0 [0181.500] IUnknown:AddRef (This=0x5262478) returned 0x4 [0181.500] IUnknown:Release (This=0x5262478) returned 0x3 [0181.500] IUnknown:Release (This=0x5262478) returned 0x2 [0181.500] CoTaskMemFree (pv=0x71d200) [0181.500] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.500] IUnknown:AddRef (This=0x5262478) returned 0x3 [0181.500] IWbemClassObject:Get (in: This=0x5262478, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.501] IWbemClassObject:Get (in: This=0x5262478, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3520\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.501] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3520\"") returned 0x5e [0181.501] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3520\"") returned 0x5e [0181.501] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x914 [0181.501] SetEvent (hEvent=0x638) returned 1 [0181.501] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x914, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.504] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.504] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.504] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261520, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5261520) returned 0x0 [0181.504] WbemDefPath:IUnknown:AddRef (This=0x5261520) returned 0x3 [0181.504] WbemDefPath:IUnknown:Release (This=0x5261520) returned 0x2 [0181.504] WbemDefPath:IWbemPath:SetText (This=0x5261520, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3520\"") returned 0x0 [0181.504] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.504] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.504] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.504] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.504] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.505] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.505] IWbemClassObject:Get (in: This=0x5262478, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29ac0b4*=0, plFlavor=0x29ac0b8*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdc0, varVal2=0x0), pType=0x29ac0b4*=19, plFlavor=0x29ac0b8*=0) returned 0x0 [0181.505] IWbemClassObject:Get (in: This=0x5262478, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29ac0b4*=19, plFlavor=0x29ac0b8*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdc0, varVal2=0x0), pType=0x29ac0b4*=19, plFlavor=0x29ac0b8*=0) returned 0x0 [0181.505] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.505] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.505] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.505] IWbemClassObject:Get (in: This=0x5262478, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29ac1b8*=0, plFlavor=0x29ac1bc*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="foxmailincmail.exe", varVal2=0x0), pType=0x29ac1b8*=8, plFlavor=0x29ac1bc*=0) returned 0x0 [0181.505] SysStringByteLen (bstr="foxmailincmail.exe") returned 0x24 [0181.505] SysStringByteLen (bstr="foxmailincmail.exe") returned 0x24 [0181.505] IWbemClassObject:Get (in: This=0x5262478, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29ac1b8*=8, plFlavor=0x29ac1bc*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="foxmailincmail.exe", varVal2=0x0), pType=0x29ac1b8*=8, plFlavor=0x29ac1bc*=0) returned 0x0 [0181.505] SysStringByteLen (bstr="foxmailincmail.exe") returned 0x24 [0181.505] SysStringByteLen (bstr="foxmailincmail.exe") returned 0x24 [0181.505] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.505] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.505] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.506] IWbemClassObject:Get (in: This=0x5262478, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29ac314*=0, plFlavor=0x29ac318*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Media Player\\foxmailincmail.exe\" ", varVal2=0x0), pType=0x29ac314*=8, plFlavor=0x29ac318*=0) returned 0x0 [0181.506] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Media Player\\foxmailincmail.exe\" ") returned 0x76 [0181.506] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Media Player\\foxmailincmail.exe\" ") returned 0x76 [0181.506] IWbemClassObject:Get (in: This=0x5262478, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29ac314*=8, plFlavor=0x29ac318*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Media Player\\foxmailincmail.exe\" ", varVal2=0x0), pType=0x29ac314*=8, plFlavor=0x29ac318*=0) returned 0x0 [0181.506] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Media Player\\foxmailincmail.exe\" ") returned 0x76 [0181.506] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Media Player\\foxmailincmail.exe\" ") returned 0x76 [0181.506] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.506] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x52627a8, puReturned=0x2995760*=0x1) returned 0x0 [0181.508] IUnknown:QueryInterface (in: This=0x52627a8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x52627a8) returned 0x0 [0181.509] IUnknown:QueryInterface (in: This=0x52627a8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.509] IUnknown:QueryInterface (in: This=0x52627a8, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.509] IUnknown:QueryInterface (in: This=0x52627a8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.509] IUnknown:AddRef (This=0x52627a8) returned 0x3 [0181.509] IUnknown:QueryInterface (in: This=0x52627a8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.509] IUnknown:QueryInterface (in: This=0x52627a8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.509] IUnknown:QueryInterface (in: This=0x52627a8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x52627ac) returned 0x0 [0181.509] IMarshal:GetUnmarshalClass (in: This=0x52627ac, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.509] IUnknown:Release (This=0x52627ac) returned 0x3 [0181.509] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.509] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.509] IUnknown:QueryInterface (in: This=0x52627a8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.509] IUnknown:Release (This=0x52627a8) returned 0x2 [0181.509] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.509] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.509] IUnknown:QueryInterface (in: This=0x52627a8, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x52627a8) returned 0x0 [0181.510] IUnknown:AddRef (This=0x52627a8) returned 0x4 [0181.510] IUnknown:Release (This=0x52627a8) returned 0x3 [0181.510] IUnknown:Release (This=0x52627a8) returned 0x2 [0181.510] CoTaskMemFree (pv=0x71d200) [0181.510] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.510] IUnknown:AddRef (This=0x52627a8) returned 0x3 [0181.510] IWbemClassObject:Get (in: This=0x52627a8, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.510] IWbemClassObject:Get (in: This=0x52627a8, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3528\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.510] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3528\"") returned 0x5e [0181.510] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3528\"") returned 0x5e [0181.510] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x918 [0181.510] SetEvent (hEvent=0x638) returned 1 [0181.510] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x918, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.513] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.513] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.513] WbemDefPath:IUnknown:QueryInterface (in: This=0x52612f0, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x52612f0) returned 0x0 [0181.513] WbemDefPath:IUnknown:AddRef (This=0x52612f0) returned 0x3 [0181.513] WbemDefPath:IUnknown:Release (This=0x52612f0) returned 0x2 [0181.513] WbemDefPath:IWbemPath:SetText (This=0x52612f0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3528\"") returned 0x0 [0181.513] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.513] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.513] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.513] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.513] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.513] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.513] IWbemClassObject:Get (in: This=0x52627a8, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29acdec*=0, plFlavor=0x29acdf0*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdc8, varVal2=0x0), pType=0x29acdec*=19, plFlavor=0x29acdf0*=0) returned 0x0 [0181.513] IWbemClassObject:Get (in: This=0x52627a8, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29acdec*=19, plFlavor=0x29acdf0*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdc8, varVal2=0x0), pType=0x29acdec*=19, plFlavor=0x29acdf0*=0) returned 0x0 [0181.514] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.514] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.514] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.514] IWbemClassObject:Get (in: This=0x52627a8, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29acef0*=0, plFlavor=0x29acef4*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fling.exe", varVal2=0x0), pType=0x29acef0*=8, plFlavor=0x29acef4*=0) returned 0x0 [0181.514] SysStringByteLen (bstr="fling.exe") returned 0x12 [0181.514] SysStringByteLen (bstr="fling.exe") returned 0x12 [0181.514] IWbemClassObject:Get (in: This=0x52627a8, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29acef0*=8, plFlavor=0x29acef4*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fling.exe", varVal2=0x0), pType=0x29acef0*=8, plFlavor=0x29acef4*=0) returned 0x0 [0181.514] SysStringByteLen (bstr="fling.exe") returned 0x12 [0181.514] SysStringByteLen (bstr="fling.exe") returned 0x12 [0181.514] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.514] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.514] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.514] IWbemClassObject:Get (in: This=0x52627a8, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29ad024*=0, plFlavor=0x29ad028*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows NT\\fling.exe\" ", varVal2=0x0), pType=0x29ad024*=8, plFlavor=0x29ad028*=0) returned 0x0 [0181.514] SysStringByteLen (bstr="\"C:\\Program Files\\Windows NT\\fling.exe\" ") returned 0x50 [0181.514] SysStringByteLen (bstr="\"C:\\Program Files\\Windows NT\\fling.exe\" ") returned 0x50 [0181.515] IWbemClassObject:Get (in: This=0x52627a8, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29ad024*=8, plFlavor=0x29ad028*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows NT\\fling.exe\" ", varVal2=0x0), pType=0x29ad024*=8, plFlavor=0x29ad028*=0) returned 0x0 [0181.515] SysStringByteLen (bstr="\"C:\\Program Files\\Windows NT\\fling.exe\" ") returned 0x50 [0181.515] SysStringByteLen (bstr="\"C:\\Program Files\\Windows NT\\fling.exe\" ") returned 0x50 [0181.515] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.515] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5263930, puReturned=0x2995760*=0x1) returned 0x0 [0181.516] IUnknown:QueryInterface (in: This=0x5263930, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5263930) returned 0x0 [0181.516] IUnknown:QueryInterface (in: This=0x5263930, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.516] IUnknown:QueryInterface (in: This=0x5263930, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.516] IUnknown:QueryInterface (in: This=0x5263930, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.516] IUnknown:AddRef (This=0x5263930) returned 0x3 [0181.516] IUnknown:QueryInterface (in: This=0x5263930, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.516] IUnknown:QueryInterface (in: This=0x5263930, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.516] IUnknown:QueryInterface (in: This=0x5263930, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5263934) returned 0x0 [0181.517] IMarshal:GetUnmarshalClass (in: This=0x5263934, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.517] IUnknown:Release (This=0x5263934) returned 0x3 [0181.517] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.517] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.517] IUnknown:QueryInterface (in: This=0x5263930, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.517] IUnknown:Release (This=0x5263930) returned 0x2 [0181.517] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.517] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.517] IUnknown:QueryInterface (in: This=0x5263930, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5263930) returned 0x0 [0181.517] IUnknown:AddRef (This=0x5263930) returned 0x4 [0181.517] IUnknown:Release (This=0x5263930) returned 0x3 [0181.517] IUnknown:Release (This=0x5263930) returned 0x2 [0181.517] CoTaskMemFree (pv=0x71d200) [0181.517] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.517] IUnknown:AddRef (This=0x5263930) returned 0x3 [0181.517] IWbemClassObject:Get (in: This=0x5263930, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.518] IWbemClassObject:Get (in: This=0x5263930, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3536\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.518] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3536\"") returned 0x5e [0181.518] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3536\"") returned 0x5e [0181.518] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x91c [0181.518] SetEvent (hEvent=0x638) returned 1 [0181.519] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x91c, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.521] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.521] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.521] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261600, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5261600) returned 0x0 [0181.521] WbemDefPath:IUnknown:AddRef (This=0x5261600) returned 0x3 [0181.521] WbemDefPath:IUnknown:Release (This=0x5261600) returned 0x2 [0181.521] WbemDefPath:IWbemPath:SetText (This=0x5261600, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3536\"") returned 0x0 [0181.521] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.521] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.521] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.522] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.522] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.522] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.522] IWbemClassObject:Get (in: This=0x5263930, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29ada7c*=0, plFlavor=0x29ada80*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdd0, varVal2=0x0), pType=0x29ada7c*=19, plFlavor=0x29ada80*=0) returned 0x0 [0181.522] IWbemClassObject:Get (in: This=0x5263930, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29ada7c*=19, plFlavor=0x29ada80*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdd0, varVal2=0x0), pType=0x29ada7c*=19, plFlavor=0x29ada80*=0) returned 0x0 [0181.522] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.522] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.522] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.522] IWbemClassObject:Get (in: This=0x5263930, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29adb80*=0, plFlavor=0x29adb84*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="flashfxp.exe", varVal2=0x0), pType=0x29adb80*=8, plFlavor=0x29adb84*=0) returned 0x0 [0181.522] SysStringByteLen (bstr="flashfxp.exe") returned 0x18 [0181.522] SysStringByteLen (bstr="flashfxp.exe") returned 0x18 [0181.522] IWbemClassObject:Get (in: This=0x5263930, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29adb80*=8, plFlavor=0x29adb84*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="flashfxp.exe", varVal2=0x0), pType=0x29adb80*=8, plFlavor=0x29adb84*=0) returned 0x0 [0181.522] SysStringByteLen (bstr="flashfxp.exe") returned 0x18 [0181.522] SysStringByteLen (bstr="flashfxp.exe") returned 0x18 [0181.522] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.523] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.523] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.523] IWbemClassObject:Get (in: This=0x5263930, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29adcc4*=0, plFlavor=0x29adcc8*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Defender\\flashfxp.exe\" ", varVal2=0x0), pType=0x29adcc4*=8, plFlavor=0x29adcc8*=0) returned 0x0 [0181.523] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Defender\\flashfxp.exe\" ") returned 0x6e [0181.523] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Defender\\flashfxp.exe\" ") returned 0x6e [0181.523] IWbemClassObject:Get (in: This=0x5263930, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29adcc4*=8, plFlavor=0x29adcc8*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Defender\\flashfxp.exe\" ", varVal2=0x0), pType=0x29adcc4*=8, plFlavor=0x29adcc8*=0) returned 0x0 [0181.523] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Defender\\flashfxp.exe\" ") returned 0x6e [0181.523] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Defender\\flashfxp.exe\" ") returned 0x6e [0181.523] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.523] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5262610, puReturned=0x2995760*=0x1) returned 0x0 [0181.525] IUnknown:QueryInterface (in: This=0x5262610, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5262610) returned 0x0 [0181.525] IUnknown:QueryInterface (in: This=0x5262610, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.525] IUnknown:QueryInterface (in: This=0x5262610, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.525] IUnknown:QueryInterface (in: This=0x5262610, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.526] IUnknown:AddRef (This=0x5262610) returned 0x3 [0181.526] IUnknown:QueryInterface (in: This=0x5262610, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.526] IUnknown:QueryInterface (in: This=0x5262610, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.526] IUnknown:QueryInterface (in: This=0x5262610, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5262614) returned 0x0 [0181.526] IMarshal:GetUnmarshalClass (in: This=0x5262614, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.526] IUnknown:Release (This=0x5262614) returned 0x3 [0181.526] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.526] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.526] IUnknown:QueryInterface (in: This=0x5262610, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.526] IUnknown:Release (This=0x5262610) returned 0x2 [0181.526] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.526] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.526] IUnknown:QueryInterface (in: This=0x5262610, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5262610) returned 0x0 [0181.526] IUnknown:AddRef (This=0x5262610) returned 0x4 [0181.526] IUnknown:Release (This=0x5262610) returned 0x3 [0181.526] IUnknown:Release (This=0x5262610) returned 0x2 [0181.526] CoTaskMemFree (pv=0x71d200) [0181.526] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.526] IUnknown:AddRef (This=0x5262610) returned 0x3 [0181.526] IWbemClassObject:Get (in: This=0x5262610, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.527] IWbemClassObject:Get (in: This=0x5262610, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3544\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.527] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3544\"") returned 0x5e [0181.527] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3544\"") returned 0x5e [0181.527] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x920 [0181.527] SetEvent (hEvent=0x638) returned 1 [0181.527] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x920, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.530] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.530] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.530] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261670, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5261670) returned 0x0 [0181.530] WbemDefPath:IUnknown:AddRef (This=0x5261670) returned 0x3 [0181.530] WbemDefPath:IUnknown:Release (This=0x5261670) returned 0x2 [0181.530] WbemDefPath:IWbemPath:SetText (This=0x5261670, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3544\"") returned 0x0 [0181.530] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.530] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.530] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.530] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.530] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.530] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.530] IWbemClassObject:Get (in: This=0x5262610, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29ae778*=0, plFlavor=0x29ae77c*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdd8, varVal2=0x0), pType=0x29ae778*=19, plFlavor=0x29ae77c*=0) returned 0x0 [0181.530] IWbemClassObject:Get (in: This=0x5262610, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29ae778*=19, plFlavor=0x29ae77c*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdd8, varVal2=0x0), pType=0x29ae778*=19, plFlavor=0x29ae77c*=0) returned 0x0 [0181.530] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.530] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.530] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.530] IWbemClassObject:Get (in: This=0x5262610, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29ae87c*=0, plFlavor=0x29ae880*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="filezilla.exe", varVal2=0x0), pType=0x29ae87c*=8, plFlavor=0x29ae880*=0) returned 0x0 [0181.531] SysStringByteLen (bstr="filezilla.exe") returned 0x1a [0181.531] SysStringByteLen (bstr="filezilla.exe") returned 0x1a [0181.531] IWbemClassObject:Get (in: This=0x5262610, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29ae87c*=8, plFlavor=0x29ae880*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="filezilla.exe", varVal2=0x0), pType=0x29ae87c*=8, plFlavor=0x29ae880*=0) returned 0x0 [0181.531] SysStringByteLen (bstr="filezilla.exe") returned 0x1a [0181.531] SysStringByteLen (bstr="filezilla.exe") returned 0x1a [0181.531] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.531] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.531] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.531] IWbemClassObject:Get (in: This=0x5262610, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29ae9c0*=0, plFlavor=0x29ae9c4*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Portable Devices\\filezilla.exe\" ", varVal2=0x0), pType=0x29ae9c0*=8, plFlavor=0x29ae9c4*=0) returned 0x0 [0181.531] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Portable Devices\\filezilla.exe\" ") returned 0x74 [0181.531] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Portable Devices\\filezilla.exe\" ") returned 0x74 [0181.531] IWbemClassObject:Get (in: This=0x5262610, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29ae9c0*=8, plFlavor=0x29ae9c4*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Portable Devices\\filezilla.exe\" ", varVal2=0x0), pType=0x29ae9c0*=8, plFlavor=0x29ae9c4*=0) returned 0x0 [0181.531] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Portable Devices\\filezilla.exe\" ") returned 0x74 [0181.531] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Portable Devices\\filezilla.exe\" ") returned 0x74 [0181.531] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.531] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5263798, puReturned=0x2995760*=0x1) returned 0x0 [0181.537] IUnknown:QueryInterface (in: This=0x5263798, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5263798) returned 0x0 [0181.537] IUnknown:QueryInterface (in: This=0x5263798, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.537] IUnknown:QueryInterface (in: This=0x5263798, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.537] IUnknown:QueryInterface (in: This=0x5263798, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.537] IUnknown:AddRef (This=0x5263798) returned 0x3 [0181.537] IUnknown:QueryInterface (in: This=0x5263798, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.537] IUnknown:QueryInterface (in: This=0x5263798, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.537] IUnknown:QueryInterface (in: This=0x5263798, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x526379c) returned 0x0 [0181.537] IMarshal:GetUnmarshalClass (in: This=0x526379c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.537] IUnknown:Release (This=0x526379c) returned 0x3 [0181.537] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.537] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.537] IUnknown:QueryInterface (in: This=0x5263798, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.537] IUnknown:Release (This=0x5263798) returned 0x2 [0181.538] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.538] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.538] IUnknown:QueryInterface (in: This=0x5263798, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5263798) returned 0x0 [0181.538] IUnknown:AddRef (This=0x5263798) returned 0x4 [0181.538] IUnknown:Release (This=0x5263798) returned 0x3 [0181.538] IUnknown:Release (This=0x5263798) returned 0x2 [0181.538] CoTaskMemFree (pv=0x71d200) [0181.538] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.538] IUnknown:AddRef (This=0x5263798) returned 0x3 [0181.538] IWbemClassObject:Get (in: This=0x5263798, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.538] IWbemClassObject:Get (in: This=0x5263798, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3552\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.538] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3552\"") returned 0x5e [0181.538] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3552\"") returned 0x5e [0181.538] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x924 [0181.538] SetEvent (hEvent=0x638) returned 1 [0181.538] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x924, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.541] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.541] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.541] WbemDefPath:IUnknown:QueryInterface (in: This=0x52618a0, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x52618a0) returned 0x0 [0181.541] WbemDefPath:IUnknown:AddRef (This=0x52618a0) returned 0x3 [0181.541] WbemDefPath:IUnknown:Release (This=0x52618a0) returned 0x2 [0181.541] WbemDefPath:IWbemPath:SetText (This=0x52618a0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3552\"") returned 0x0 [0181.541] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.541] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.541] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.541] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.541] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.541] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.541] IWbemClassObject:Get (in: This=0x5263798, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29af48c*=0, plFlavor=0x29af490*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xde0, varVal2=0x0), pType=0x29af48c*=19, plFlavor=0x29af490*=0) returned 0x0 [0181.542] IWbemClassObject:Get (in: This=0x5263798, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29af48c*=19, plFlavor=0x29af490*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xde0, varVal2=0x0), pType=0x29af48c*=19, plFlavor=0x29af490*=0) returned 0x0 [0181.542] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.542] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.542] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.542] IWbemClassObject:Get (in: This=0x5263798, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29af590*=0, plFlavor=0x29af594*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="far.exe", varVal2=0x0), pType=0x29af590*=8, plFlavor=0x29af594*=0) returned 0x0 [0181.542] SysStringByteLen (bstr="far.exe") returned 0xe [0181.542] SysStringByteLen (bstr="far.exe") returned 0xe [0181.542] IWbemClassObject:Get (in: This=0x5263798, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29af590*=8, plFlavor=0x29af594*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="far.exe", varVal2=0x0), pType=0x29af590*=8, plFlavor=0x29af594*=0) returned 0x0 [0181.542] SysStringByteLen (bstr="far.exe") returned 0xe [0181.542] SysStringByteLen (bstr="far.exe") returned 0xe [0181.542] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.542] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.542] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.542] IWbemClassObject:Get (in: This=0x5263798, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29af6bc*=0, plFlavor=0x29af6c0*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft Analysis Services\\far.exe\" ", varVal2=0x0), pType=0x29af6bc*=8, plFlavor=0x29af6c0*=0) returned 0x0 [0181.543] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Analysis Services\\far.exe\" ") returned 0x7a [0181.543] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Analysis Services\\far.exe\" ") returned 0x7a [0181.543] IWbemClassObject:Get (in: This=0x5263798, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29af6bc*=8, plFlavor=0x29af6c0*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft Analysis Services\\far.exe\" ", varVal2=0x0), pType=0x29af6bc*=8, plFlavor=0x29af6c0*=0) returned 0x0 [0181.543] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Analysis Services\\far.exe\" ") returned 0x7a [0181.543] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Analysis Services\\far.exe\" ") returned 0x7a [0181.543] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.543] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5263600, puReturned=0x2995760*=0x1) returned 0x0 [0181.544] IUnknown:QueryInterface (in: This=0x5263600, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5263600) returned 0x0 [0181.544] IUnknown:QueryInterface (in: This=0x5263600, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.544] IUnknown:QueryInterface (in: This=0x5263600, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.544] IUnknown:QueryInterface (in: This=0x5263600, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.545] IUnknown:AddRef (This=0x5263600) returned 0x3 [0181.545] IUnknown:QueryInterface (in: This=0x5263600, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.545] IUnknown:QueryInterface (in: This=0x5263600, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.545] IUnknown:QueryInterface (in: This=0x5263600, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5263604) returned 0x0 [0181.545] IMarshal:GetUnmarshalClass (in: This=0x5263604, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.545] IUnknown:Release (This=0x5263604) returned 0x3 [0181.545] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.545] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.545] IUnknown:QueryInterface (in: This=0x5263600, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.545] IUnknown:Release (This=0x5263600) returned 0x2 [0181.545] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.545] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.545] IUnknown:QueryInterface (in: This=0x5263600, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5263600) returned 0x0 [0181.545] IUnknown:AddRef (This=0x5263600) returned 0x4 [0181.545] IUnknown:Release (This=0x5263600) returned 0x3 [0181.545] IUnknown:Release (This=0x5263600) returned 0x2 [0181.545] CoTaskMemFree (pv=0x71d200) [0181.545] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.545] IUnknown:AddRef (This=0x5263600) returned 0x3 [0181.545] IWbemClassObject:Get (in: This=0x5263600, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.546] IWbemClassObject:Get (in: This=0x5263600, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3560\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.546] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3560\"") returned 0x5e [0181.546] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3560\"") returned 0x5e [0181.546] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x928 [0181.546] SetEvent (hEvent=0x638) returned 1 [0181.546] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x928, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.548] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.548] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.549] WbemDefPath:IUnknown:QueryInterface (in: This=0x52613d0, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x52613d0) returned 0x0 [0181.549] WbemDefPath:IUnknown:AddRef (This=0x52613d0) returned 0x3 [0181.549] WbemDefPath:IUnknown:Release (This=0x52613d0) returned 0x2 [0181.549] WbemDefPath:IWbemPath:SetText (This=0x52613d0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3560\"") returned 0x0 [0181.549] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.549] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.549] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.549] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.549] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.549] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.549] IWbemClassObject:Get (in: This=0x5263600, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b0188*=0, plFlavor=0x29b018c*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xde8, varVal2=0x0), pType=0x29b0188*=19, plFlavor=0x29b018c*=0) returned 0x0 [0181.549] IWbemClassObject:Get (in: This=0x5263600, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b0188*=19, plFlavor=0x29b018c*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xde8, varVal2=0x0), pType=0x29b0188*=19, plFlavor=0x29b018c*=0) returned 0x0 [0181.549] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.549] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.550] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.550] IWbemClassObject:Get (in: This=0x5263600, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b028c*=0, plFlavor=0x29b0290*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="coreftp.exe", varVal2=0x0), pType=0x29b028c*=8, plFlavor=0x29b0290*=0) returned 0x0 [0181.550] SysStringByteLen (bstr="coreftp.exe") returned 0x16 [0181.550] SysStringByteLen (bstr="coreftp.exe") returned 0x16 [0181.550] IWbemClassObject:Get (in: This=0x5263600, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b028c*=8, plFlavor=0x29b0290*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="coreftp.exe", varVal2=0x0), pType=0x29b028c*=8, plFlavor=0x29b0290*=0) returned 0x0 [0181.550] SysStringByteLen (bstr="coreftp.exe") returned 0x16 [0181.550] SysStringByteLen (bstr="coreftp.exe") returned 0x16 [0181.550] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.550] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.550] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.550] IWbemClassObject:Get (in: This=0x5263600, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b03c8*=0, plFlavor=0x29b03cc*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Common Files\\coreftp.exe\" ", varVal2=0x0), pType=0x29b03c8*=8, plFlavor=0x29b03cc*=0) returned 0x0 [0181.550] SysStringByteLen (bstr="\"C:\\Program Files\\Common Files\\coreftp.exe\" ") returned 0x58 [0181.550] SysStringByteLen (bstr="\"C:\\Program Files\\Common Files\\coreftp.exe\" ") returned 0x58 [0181.551] IWbemClassObject:Get (in: This=0x5263600, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b03c8*=8, plFlavor=0x29b03cc*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Common Files\\coreftp.exe\" ", varVal2=0x0), pType=0x29b03c8*=8, plFlavor=0x29b03cc*=0) returned 0x0 [0181.551] SysStringByteLen (bstr="\"C:\\Program Files\\Common Files\\coreftp.exe\" ") returned 0x58 [0181.551] SysStringByteLen (bstr="\"C:\\Program Files\\Common Files\\coreftp.exe\" ") returned 0x58 [0181.551] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.551] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5262e08, puReturned=0x2995760*=0x1) returned 0x0 [0181.553] IUnknown:QueryInterface (in: This=0x5262e08, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5262e08) returned 0x0 [0181.553] IUnknown:QueryInterface (in: This=0x5262e08, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.553] IUnknown:QueryInterface (in: This=0x5262e08, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.553] IUnknown:QueryInterface (in: This=0x5262e08, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.553] IUnknown:AddRef (This=0x5262e08) returned 0x3 [0181.553] IUnknown:QueryInterface (in: This=0x5262e08, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.553] IUnknown:QueryInterface (in: This=0x5262e08, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.553] IUnknown:QueryInterface (in: This=0x5262e08, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5262e0c) returned 0x0 [0181.554] IMarshal:GetUnmarshalClass (in: This=0x5262e0c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.554] IUnknown:Release (This=0x5262e0c) returned 0x3 [0181.554] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.554] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.554] IUnknown:QueryInterface (in: This=0x5262e08, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.554] IUnknown:Release (This=0x5262e08) returned 0x2 [0181.554] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.554] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.554] IUnknown:QueryInterface (in: This=0x5262e08, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5262e08) returned 0x0 [0181.554] IUnknown:AddRef (This=0x5262e08) returned 0x4 [0181.554] IUnknown:Release (This=0x5262e08) returned 0x3 [0181.554] IUnknown:Release (This=0x5262e08) returned 0x2 [0181.554] CoTaskMemFree (pv=0x71d200) [0181.554] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.554] IUnknown:AddRef (This=0x5262e08) returned 0x3 [0181.554] IWbemClassObject:Get (in: This=0x5262e08, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.555] IWbemClassObject:Get (in: This=0x5262e08, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3568\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.555] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3568\"") returned 0x5e [0181.555] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3568\"") returned 0x5e [0181.555] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x92c [0181.555] SetEvent (hEvent=0x638) returned 1 [0181.555] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x92c, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.557] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.557] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.557] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261980, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5261980) returned 0x0 [0181.558] WbemDefPath:IUnknown:AddRef (This=0x5261980) returned 0x3 [0181.558] WbemDefPath:IUnknown:Release (This=0x5261980) returned 0x2 [0181.558] WbemDefPath:IWbemPath:SetText (This=0x5261980, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3568\"") returned 0x0 [0181.558] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.558] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.558] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.558] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.558] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.558] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.558] IWbemClassObject:Get (in: This=0x5262e08, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b0f48*=0, plFlavor=0x29b0f4c*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdf0, varVal2=0x0), pType=0x29b0f48*=19, plFlavor=0x29b0f4c*=0) returned 0x0 [0181.558] IWbemClassObject:Get (in: This=0x5262e08, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b0f48*=19, plFlavor=0x29b0f4c*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdf0, varVal2=0x0), pType=0x29b0f48*=19, plFlavor=0x29b0f4c*=0) returned 0x0 [0181.558] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.558] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.558] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.558] IWbemClassObject:Get (in: This=0x5262e08, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b104c*=0, plFlavor=0x29b1050*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="bitkinex.exe", varVal2=0x0), pType=0x29b104c*=8, plFlavor=0x29b1050*=0) returned 0x0 [0181.558] SysStringByteLen (bstr="bitkinex.exe") returned 0x18 [0181.558] SysStringByteLen (bstr="bitkinex.exe") returned 0x18 [0181.559] IWbemClassObject:Get (in: This=0x5262e08, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b104c*=8, plFlavor=0x29b1050*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="bitkinex.exe", varVal2=0x0), pType=0x29b104c*=8, plFlavor=0x29b1050*=0) returned 0x0 [0181.559] SysStringByteLen (bstr="bitkinex.exe") returned 0x18 [0181.559] SysStringByteLen (bstr="bitkinex.exe") returned 0x18 [0181.559] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.559] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.559] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.559] IWbemClassObject:Get (in: This=0x5262e08, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b1190*=0, plFlavor=0x29b1194*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Journal\\bitkinex.exe\" ", varVal2=0x0), pType=0x29b1190*=8, plFlavor=0x29b1194*=0) returned 0x0 [0181.559] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Journal\\bitkinex.exe\" ") returned 0x60 [0181.559] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Journal\\bitkinex.exe\" ") returned 0x60 [0181.559] IWbemClassObject:Get (in: This=0x5262e08, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b1190*=8, plFlavor=0x29b1194*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Journal\\bitkinex.exe\" ", varVal2=0x0), pType=0x29b1190*=8, plFlavor=0x29b1194*=0) returned 0x0 [0181.559] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Journal\\bitkinex.exe\" ") returned 0x60 [0181.559] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Journal\\bitkinex.exe\" ") returned 0x60 [0181.559] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.559] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5262940, puReturned=0x2995760*=0x1) returned 0x0 [0181.561] IUnknown:QueryInterface (in: This=0x5262940, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5262940) returned 0x0 [0181.561] IUnknown:QueryInterface (in: This=0x5262940, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.561] IUnknown:QueryInterface (in: This=0x5262940, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.561] IUnknown:QueryInterface (in: This=0x5262940, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.561] IUnknown:AddRef (This=0x5262940) returned 0x3 [0181.561] IUnknown:QueryInterface (in: This=0x5262940, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.561] IUnknown:QueryInterface (in: This=0x5262940, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.561] IUnknown:QueryInterface (in: This=0x5262940, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5262944) returned 0x0 [0181.561] IMarshal:GetUnmarshalClass (in: This=0x5262944, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.561] IUnknown:Release (This=0x5262944) returned 0x3 [0181.561] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.561] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.561] IUnknown:QueryInterface (in: This=0x5262940, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.562] IUnknown:Release (This=0x5262940) returned 0x2 [0181.562] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.562] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.562] IUnknown:QueryInterface (in: This=0x5262940, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5262940) returned 0x0 [0181.562] IUnknown:AddRef (This=0x5262940) returned 0x4 [0181.562] IUnknown:Release (This=0x5262940) returned 0x3 [0181.562] IUnknown:Release (This=0x5262940) returned 0x2 [0181.562] CoTaskMemFree (pv=0x71d200) [0181.562] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.562] IUnknown:AddRef (This=0x5262940) returned 0x3 [0181.562] IWbemClassObject:Get (in: This=0x5262940, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.562] IWbemClassObject:Get (in: This=0x5262940, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3576\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.562] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3576\"") returned 0x5e [0181.562] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3576\"") returned 0x5e [0181.562] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x930 [0181.562] SetEvent (hEvent=0x638) returned 1 [0181.562] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x930, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.565] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.565] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.565] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261360, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5261360) returned 0x0 [0181.565] WbemDefPath:IUnknown:AddRef (This=0x5261360) returned 0x3 [0181.565] WbemDefPath:IUnknown:Release (This=0x5261360) returned 0x2 [0181.565] WbemDefPath:IWbemPath:SetText (This=0x5261360, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3576\"") returned 0x0 [0181.565] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.565] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.565] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.565] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.565] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.565] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.565] IWbemClassObject:Get (in: This=0x5262940, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b1c1c*=0, plFlavor=0x29b1c20*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdf8, varVal2=0x0), pType=0x29b1c1c*=19, plFlavor=0x29b1c20*=0) returned 0x0 [0181.566] IWbemClassObject:Get (in: This=0x5262940, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b1c1c*=19, plFlavor=0x29b1c20*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdf8, varVal2=0x0), pType=0x29b1c1c*=19, plFlavor=0x29b1c20*=0) returned 0x0 [0181.566] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.566] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.566] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.566] IWbemClassObject:Get (in: This=0x5262940, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b1d20*=0, plFlavor=0x29b1d24*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="barca.exe", varVal2=0x0), pType=0x29b1d20*=8, plFlavor=0x29b1d24*=0) returned 0x0 [0181.567] SysStringByteLen (bstr="barca.exe") returned 0x12 [0181.567] SysStringByteLen (bstr="barca.exe") returned 0x12 [0181.567] IWbemClassObject:Get (in: This=0x5262940, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b1d20*=8, plFlavor=0x29b1d24*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="barca.exe", varVal2=0x0), pType=0x29b1d20*=8, plFlavor=0x29b1d24*=0) returned 0x0 [0181.567] SysStringByteLen (bstr="barca.exe") returned 0x12 [0181.567] SysStringByteLen (bstr="barca.exe") returned 0x12 [0181.567] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.567] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.567] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.567] IWbemClassObject:Get (in: This=0x5262940, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b1e54*=0, plFlavor=0x29b1e58*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Photo Viewer\\barca.exe\" ", varVal2=0x0), pType=0x29b1e54*=8, plFlavor=0x29b1e58*=0) returned 0x0 [0181.567] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Photo Viewer\\barca.exe\" ") returned 0x64 [0181.567] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Photo Viewer\\barca.exe\" ") returned 0x64 [0181.567] IWbemClassObject:Get (in: This=0x5262940, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b1e54*=8, plFlavor=0x29b1e58*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Photo Viewer\\barca.exe\" ", varVal2=0x0), pType=0x29b1e54*=8, plFlavor=0x29b1e58*=0) returned 0x0 [0181.567] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Photo Viewer\\barca.exe\" ") returned 0x64 [0181.567] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Photo Viewer\\barca.exe\" ") returned 0x64 [0181.568] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.568] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5262ad8, puReturned=0x2995760*=0x1) returned 0x0 [0181.571] IUnknown:QueryInterface (in: This=0x5262ad8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5262ad8) returned 0x0 [0181.571] IUnknown:QueryInterface (in: This=0x5262ad8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.571] IUnknown:QueryInterface (in: This=0x5262ad8, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.572] IUnknown:QueryInterface (in: This=0x5262ad8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.572] IUnknown:AddRef (This=0x5262ad8) returned 0x3 [0181.572] IUnknown:QueryInterface (in: This=0x5262ad8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.572] IUnknown:QueryInterface (in: This=0x5262ad8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.572] IUnknown:QueryInterface (in: This=0x5262ad8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5262adc) returned 0x0 [0181.572] IMarshal:GetUnmarshalClass (in: This=0x5262adc, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.572] IUnknown:Release (This=0x5262adc) returned 0x3 [0181.572] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.572] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.572] IUnknown:QueryInterface (in: This=0x5262ad8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.572] IUnknown:Release (This=0x5262ad8) returned 0x2 [0181.572] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.572] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.572] IUnknown:QueryInterface (in: This=0x5262ad8, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5262ad8) returned 0x0 [0181.572] IUnknown:AddRef (This=0x5262ad8) returned 0x4 [0181.572] IUnknown:Release (This=0x5262ad8) returned 0x3 [0181.572] IUnknown:Release (This=0x5262ad8) returned 0x2 [0181.572] CoTaskMemFree (pv=0x71d200) [0181.572] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.573] IUnknown:AddRef (This=0x5262ad8) returned 0x3 [0181.573] IWbemClassObject:Get (in: This=0x5262ad8, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.573] IWbemClassObject:Get (in: This=0x5262ad8, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3584\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.573] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3584\"") returned 0x5e [0181.573] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3584\"") returned 0x5e [0181.573] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x934 [0181.573] SetEvent (hEvent=0x638) returned 1 [0181.573] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x934, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.576] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.576] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.576] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261a60, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5261a60) returned 0x0 [0181.576] WbemDefPath:IUnknown:AddRef (This=0x5261a60) returned 0x3 [0181.576] WbemDefPath:IUnknown:Release (This=0x5261a60) returned 0x2 [0181.576] WbemDefPath:IWbemPath:SetText (This=0x5261a60, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3584\"") returned 0x0 [0181.576] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.576] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.576] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.576] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.576] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.576] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.576] IWbemClassObject:Get (in: This=0x5262ad8, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b28e8*=0, plFlavor=0x29b28ec*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe00, varVal2=0x0), pType=0x29b28e8*=19, plFlavor=0x29b28ec*=0) returned 0x0 [0181.577] IWbemClassObject:Get (in: This=0x5262ad8, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b28e8*=19, plFlavor=0x29b28ec*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe00, varVal2=0x0), pType=0x29b28e8*=19, plFlavor=0x29b28ec*=0) returned 0x0 [0181.577] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.577] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.577] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.577] IWbemClassObject:Get (in: This=0x5262ad8, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b29ec*=0, plFlavor=0x29b29f0*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="alftp.exe", varVal2=0x0), pType=0x29b29ec*=8, plFlavor=0x29b29f0*=0) returned 0x0 [0181.577] SysStringByteLen (bstr="alftp.exe") returned 0x12 [0181.577] SysStringByteLen (bstr="alftp.exe") returned 0x12 [0181.577] IWbemClassObject:Get (in: This=0x5262ad8, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b29ec*=8, plFlavor=0x29b29f0*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="alftp.exe", varVal2=0x0), pType=0x29b29ec*=8, plFlavor=0x29b29f0*=0) returned 0x0 [0181.577] SysStringByteLen (bstr="alftp.exe") returned 0x12 [0181.577] SysStringByteLen (bstr="alftp.exe") returned 0x12 [0181.577] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.577] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.577] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.577] IWbemClassObject:Get (in: This=0x5262ad8, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b2b20*=0, plFlavor=0x29b2b24*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Media Player\\alftp.exe\" ", varVal2=0x0), pType=0x29b2b20*=8, plFlavor=0x29b2b24*=0) returned 0x0 [0181.578] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Media Player\\alftp.exe\" ") returned 0x70 [0181.578] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Media Player\\alftp.exe\" ") returned 0x70 [0181.578] IWbemClassObject:Get (in: This=0x5262ad8, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b2b20*=8, plFlavor=0x29b2b24*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Media Player\\alftp.exe\" ", varVal2=0x0), pType=0x29b2b20*=8, plFlavor=0x29b2b24*=0) returned 0x0 [0181.578] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Media Player\\alftp.exe\" ") returned 0x70 [0181.578] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Media Player\\alftp.exe\" ") returned 0x70 [0181.578] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.578] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5262c70, puReturned=0x2995760*=0x1) returned 0x0 [0181.579] IUnknown:QueryInterface (in: This=0x5262c70, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5262c70) returned 0x0 [0181.580] IUnknown:QueryInterface (in: This=0x5262c70, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.580] IUnknown:QueryInterface (in: This=0x5262c70, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.580] IUnknown:QueryInterface (in: This=0x5262c70, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.580] IUnknown:AddRef (This=0x5262c70) returned 0x3 [0181.580] IUnknown:QueryInterface (in: This=0x5262c70, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.580] IUnknown:QueryInterface (in: This=0x5262c70, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.580] IUnknown:QueryInterface (in: This=0x5262c70, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5262c74) returned 0x0 [0181.580] IMarshal:GetUnmarshalClass (in: This=0x5262c74, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.580] IUnknown:Release (This=0x5262c74) returned 0x3 [0181.580] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.580] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.580] IUnknown:QueryInterface (in: This=0x5262c70, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.580] IUnknown:Release (This=0x5262c70) returned 0x2 [0181.580] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.580] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.581] IUnknown:QueryInterface (in: This=0x5262c70, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5262c70) returned 0x0 [0181.581] IUnknown:AddRef (This=0x5262c70) returned 0x4 [0181.581] IUnknown:Release (This=0x5262c70) returned 0x3 [0181.581] IUnknown:Release (This=0x5262c70) returned 0x2 [0181.581] CoTaskMemFree (pv=0x71d200) [0181.581] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.581] IUnknown:AddRef (This=0x5262c70) returned 0x3 [0181.581] IWbemClassObject:Get (in: This=0x5262c70, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.581] IWbemClassObject:Get (in: This=0x5262c70, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3592\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.581] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3592\"") returned 0x5e [0181.581] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3592\"") returned 0x5e [0181.581] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x938 [0181.582] SetEvent (hEvent=0x638) returned 1 [0181.582] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x938, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.584] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.584] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261440, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5261440) returned 0x0 [0181.584] WbemDefPath:IUnknown:AddRef (This=0x5261440) returned 0x3 [0181.584] WbemDefPath:IUnknown:Release (This=0x5261440) returned 0x2 [0181.584] WbemDefPath:IWbemPath:SetText (This=0x5261440, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3592\"") returned 0x0 [0181.584] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.585] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.585] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.585] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.585] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.585] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.585] IWbemClassObject:Get (in: This=0x5262c70, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b35d8*=0, plFlavor=0x29b35dc*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe08, varVal2=0x0), pType=0x29b35d8*=19, plFlavor=0x29b35dc*=0) returned 0x0 [0181.585] IWbemClassObject:Get (in: This=0x5262c70, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b35d8*=19, plFlavor=0x29b35dc*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe08, varVal2=0x0), pType=0x29b35d8*=19, plFlavor=0x29b35dc*=0) returned 0x0 [0181.585] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.585] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.585] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.585] IWbemClassObject:Get (in: This=0x5262c70, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b36dc*=0, plFlavor=0x29b36e0*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="absolutetelnet.exe", varVal2=0x0), pType=0x29b36dc*=8, plFlavor=0x29b36e0*=0) returned 0x0 [0181.585] SysStringByteLen (bstr="absolutetelnet.exe") returned 0x24 [0181.585] SysStringByteLen (bstr="absolutetelnet.exe") returned 0x24 [0181.586] IWbemClassObject:Get (in: This=0x5262c70, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b36dc*=8, plFlavor=0x29b36e0*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="absolutetelnet.exe", varVal2=0x0), pType=0x29b36dc*=8, plFlavor=0x29b36e0*=0) returned 0x0 [0181.586] SysStringByteLen (bstr="absolutetelnet.exe") returned 0x24 [0181.586] SysStringByteLen (bstr="absolutetelnet.exe") returned 0x24 [0181.586] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.586] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.586] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.586] IWbemClassObject:Get (in: This=0x5262c70, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b3838*=0, plFlavor=0x29b383c*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft.NET\\absolutetelnet.exe\" ", varVal2=0x0), pType=0x29b3838*=8, plFlavor=0x29b383c*=0) returned 0x0 [0181.586] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft.NET\\absolutetelnet.exe\" ") returned 0x74 [0181.586] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft.NET\\absolutetelnet.exe\" ") returned 0x74 [0181.586] IWbemClassObject:Get (in: This=0x5262c70, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b3838*=8, plFlavor=0x29b383c*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft.NET\\absolutetelnet.exe\" ", varVal2=0x0), pType=0x29b3838*=8, plFlavor=0x29b383c*=0) returned 0x0 [0181.586] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft.NET\\absolutetelnet.exe\" ") returned 0x74 [0181.586] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft.NET\\absolutetelnet.exe\" ") returned 0x74 [0181.586] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.586] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5263138, puReturned=0x2995760*=0x1) returned 0x0 [0181.588] IUnknown:QueryInterface (in: This=0x5263138, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5263138) returned 0x0 [0181.588] IUnknown:QueryInterface (in: This=0x5263138, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.588] IUnknown:QueryInterface (in: This=0x5263138, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.588] IUnknown:QueryInterface (in: This=0x5263138, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.588] IUnknown:AddRef (This=0x5263138) returned 0x3 [0181.588] IUnknown:QueryInterface (in: This=0x5263138, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.588] IUnknown:QueryInterface (in: This=0x5263138, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.588] IUnknown:QueryInterface (in: This=0x5263138, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x526313c) returned 0x0 [0181.588] IMarshal:GetUnmarshalClass (in: This=0x526313c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.588] IUnknown:Release (This=0x526313c) returned 0x3 [0181.588] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.588] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.588] IUnknown:QueryInterface (in: This=0x5263138, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.588] IUnknown:Release (This=0x5263138) returned 0x2 [0181.588] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.589] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.589] IUnknown:QueryInterface (in: This=0x5263138, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5263138) returned 0x0 [0181.589] IUnknown:AddRef (This=0x5263138) returned 0x4 [0181.589] IUnknown:Release (This=0x5263138) returned 0x3 [0181.589] IUnknown:Release (This=0x5263138) returned 0x2 [0181.589] CoTaskMemFree (pv=0x71d200) [0181.589] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.589] IUnknown:AddRef (This=0x5263138) returned 0x3 [0181.589] IWbemClassObject:Get (in: This=0x5263138, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.589] IWbemClassObject:Get (in: This=0x5263138, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3600\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.589] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3600\"") returned 0x5e [0181.589] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3600\"") returned 0x5e [0181.589] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x93c [0181.589] SetEvent (hEvent=0x638) returned 1 [0181.589] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x93c, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.592] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.592] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.592] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261830, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5261830) returned 0x0 [0181.592] WbemDefPath:IUnknown:AddRef (This=0x5261830) returned 0x3 [0181.592] WbemDefPath:IUnknown:Release (This=0x5261830) returned 0x2 [0181.592] WbemDefPath:IWbemPath:SetText (This=0x5261830, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3600\"") returned 0x0 [0181.592] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.592] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.592] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.592] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.592] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.592] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.593] IWbemClassObject:Get (in: This=0x5263138, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b430c*=0, plFlavor=0x29b4310*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe10, varVal2=0x0), pType=0x29b430c*=19, plFlavor=0x29b4310*=0) returned 0x0 [0181.593] IWbemClassObject:Get (in: This=0x5263138, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b430c*=19, plFlavor=0x29b4310*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe10, varVal2=0x0), pType=0x29b430c*=19, plFlavor=0x29b4310*=0) returned 0x0 [0181.593] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.593] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.593] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.593] IWbemClassObject:Get (in: This=0x5263138, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b4410*=0, plFlavor=0x29b4414*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="3dftp.exe", varVal2=0x0), pType=0x29b4410*=8, plFlavor=0x29b4414*=0) returned 0x0 [0181.593] SysStringByteLen (bstr="3dftp.exe") returned 0x12 [0181.593] SysStringByteLen (bstr="3dftp.exe") returned 0x12 [0181.593] IWbemClassObject:Get (in: This=0x5263138, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b4410*=8, plFlavor=0x29b4414*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="3dftp.exe", varVal2=0x0), pType=0x29b4410*=8, plFlavor=0x29b4414*=0) returned 0x0 [0181.593] SysStringByteLen (bstr="3dftp.exe") returned 0x12 [0181.593] SysStringByteLen (bstr="3dftp.exe") returned 0x12 [0181.593] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.593] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.594] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.594] IWbemClassObject:Get (in: This=0x5263138, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b4544*=0, plFlavor=0x29b4548*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Sidebar\\3dftp.exe\" ", varVal2=0x0), pType=0x29b4544*=8, plFlavor=0x29b4548*=0) returned 0x0 [0181.594] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Sidebar\\3dftp.exe\" ") returned 0x5a [0181.594] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Sidebar\\3dftp.exe\" ") returned 0x5a [0181.594] IWbemClassObject:Get (in: This=0x5263138, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b4544*=8, plFlavor=0x29b4548*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Sidebar\\3dftp.exe\" ", varVal2=0x0), pType=0x29b4544*=8, plFlavor=0x29b4548*=0) returned 0x0 [0181.594] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Sidebar\\3dftp.exe\" ") returned 0x5a [0181.594] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Sidebar\\3dftp.exe\" ") returned 0x5a [0181.594] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.594] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x52632d0, puReturned=0x2995760*=0x1) returned 0x0 [0181.595] IUnknown:QueryInterface (in: This=0x52632d0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x52632d0) returned 0x0 [0181.595] IUnknown:QueryInterface (in: This=0x52632d0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.595] IUnknown:QueryInterface (in: This=0x52632d0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.595] IUnknown:QueryInterface (in: This=0x52632d0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.596] IUnknown:AddRef (This=0x52632d0) returned 0x3 [0181.596] IUnknown:QueryInterface (in: This=0x52632d0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.596] IUnknown:QueryInterface (in: This=0x52632d0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.596] IUnknown:QueryInterface (in: This=0x52632d0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x52632d4) returned 0x0 [0181.596] IMarshal:GetUnmarshalClass (in: This=0x52632d4, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.596] IUnknown:Release (This=0x52632d4) returned 0x3 [0181.596] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.596] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.596] IUnknown:QueryInterface (in: This=0x52632d0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.596] IUnknown:Release (This=0x52632d0) returned 0x2 [0181.596] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.596] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.596] IUnknown:QueryInterface (in: This=0x52632d0, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x52632d0) returned 0x0 [0181.596] IUnknown:AddRef (This=0x52632d0) returned 0x4 [0181.596] IUnknown:Release (This=0x52632d0) returned 0x3 [0181.596] IUnknown:Release (This=0x52632d0) returned 0x2 [0181.596] CoTaskMemFree (pv=0x71d200) [0181.596] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.596] IUnknown:AddRef (This=0x52632d0) returned 0x3 [0181.597] IWbemClassObject:Get (in: This=0x52632d0, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.597] IWbemClassObject:Get (in: This=0x52632d0, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3608\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.597] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3608\"") returned 0x5e [0181.597] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3608\"") returned 0x5e [0181.597] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x940 [0181.597] SetEvent (hEvent=0x638) returned 1 [0181.597] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x940, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.605] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.605] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260f70, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5260f70) returned 0x0 [0181.605] WbemDefPath:IUnknown:AddRef (This=0x5260f70) returned 0x3 [0181.605] WbemDefPath:IUnknown:Release (This=0x5260f70) returned 0x2 [0181.605] WbemDefPath:IWbemPath:SetText (This=0x5260f70, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3608\"") returned 0x0 [0181.605] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.605] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.605] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.605] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.605] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.605] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.605] IWbemClassObject:Get (in: This=0x52632d0, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b4fb4*=0, plFlavor=0x29b4fb8*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe18, varVal2=0x0), pType=0x29b4fb4*=19, plFlavor=0x29b4fb8*=0) returned 0x0 [0181.605] IWbemClassObject:Get (in: This=0x52632d0, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b4fb4*=19, plFlavor=0x29b4fb8*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe18, varVal2=0x0), pType=0x29b4fb4*=19, plFlavor=0x29b4fb8*=0) returned 0x0 [0181.606] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.606] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.606] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.606] IWbemClassObject:Get (in: This=0x52632d0, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b50b8*=0, plFlavor=0x29b50bc*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="gmailnotifierpro.exe", varVal2=0x0), pType=0x29b50b8*=8, plFlavor=0x29b50bc*=0) returned 0x0 [0181.606] SysStringByteLen (bstr="gmailnotifierpro.exe") returned 0x28 [0181.606] SysStringByteLen (bstr="gmailnotifierpro.exe") returned 0x28 [0181.606] IWbemClassObject:Get (in: This=0x52632d0, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b50b8*=8, plFlavor=0x29b50bc*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="gmailnotifierpro.exe", varVal2=0x0), pType=0x29b50b8*=8, plFlavor=0x29b50bc*=0) returned 0x0 [0181.606] SysStringByteLen (bstr="gmailnotifierpro.exe") returned 0x28 [0181.606] SysStringByteLen (bstr="gmailnotifierpro.exe") returned 0x28 [0181.606] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.606] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.606] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.606] IWbemClassObject:Get (in: This=0x52632d0, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b521c*=0, plFlavor=0x29b5220*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe\" ", varVal2=0x0), pType=0x29b521c*=8, plFlavor=0x29b5220*=0) returned 0x0 [0181.606] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe\" ") returned 0x72 [0181.606] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe\" ") returned 0x72 [0181.606] IWbemClassObject:Get (in: This=0x52632d0, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b521c*=8, plFlavor=0x29b5220*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe\" ", varVal2=0x0), pType=0x29b521c*=8, plFlavor=0x29b5220*=0) returned 0x0 [0181.607] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe\" ") returned 0x72 [0181.607] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe\" ") returned 0x72 [0181.607] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.607] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5263468, puReturned=0x2995760*=0x1) returned 0x0 [0181.608] IUnknown:QueryInterface (in: This=0x5263468, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5263468) returned 0x0 [0181.608] IUnknown:QueryInterface (in: This=0x5263468, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.608] IUnknown:QueryInterface (in: This=0x5263468, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.608] IUnknown:QueryInterface (in: This=0x5263468, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.608] IUnknown:AddRef (This=0x5263468) returned 0x3 [0181.608] IUnknown:QueryInterface (in: This=0x5263468, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.608] IUnknown:QueryInterface (in: This=0x5263468, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.608] IUnknown:QueryInterface (in: This=0x5263468, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x526346c) returned 0x0 [0181.609] IMarshal:GetUnmarshalClass (in: This=0x526346c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.609] IUnknown:Release (This=0x526346c) returned 0x3 [0181.609] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.609] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.609] IUnknown:QueryInterface (in: This=0x5263468, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.609] IUnknown:Release (This=0x5263468) returned 0x2 [0181.609] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.609] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.609] IUnknown:QueryInterface (in: This=0x5263468, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5263468) returned 0x0 [0181.609] IUnknown:AddRef (This=0x5263468) returned 0x4 [0181.609] IUnknown:Release (This=0x5263468) returned 0x3 [0181.609] IUnknown:Release (This=0x5263468) returned 0x2 [0181.609] CoTaskMemFree (pv=0x71d200) [0181.609] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.609] IUnknown:AddRef (This=0x5263468) returned 0x3 [0181.609] IWbemClassObject:Get (in: This=0x5263468, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.609] IWbemClassObject:Get (in: This=0x5263468, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3616\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.609] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3616\"") returned 0x5e [0181.609] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3616\"") returned 0x5e [0181.610] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x944 [0181.610] SetEvent (hEvent=0x638) returned 1 [0181.610] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x944, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.612] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.612] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.612] WbemDefPath:IUnknown:QueryInterface (in: This=0x52619f0, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x52619f0) returned 0x0 [0181.612] WbemDefPath:IUnknown:AddRef (This=0x52619f0) returned 0x3 [0181.612] WbemDefPath:IUnknown:Release (This=0x52619f0) returned 0x2 [0181.612] WbemDefPath:IWbemPath:SetText (This=0x52619f0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3616\"") returned 0x0 [0181.612] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.612] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.612] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.613] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.613] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.613] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.613] IWbemClassObject:Get (in: This=0x5263468, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b5cec*=0, plFlavor=0x29b5cf0*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe20, varVal2=0x0), pType=0x29b5cec*=19, plFlavor=0x29b5cf0*=0) returned 0x0 [0181.613] IWbemClassObject:Get (in: This=0x5263468, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b5cec*=19, plFlavor=0x29b5cf0*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe20, varVal2=0x0), pType=0x29b5cec*=19, plFlavor=0x29b5cf0*=0) returned 0x0 [0181.613] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.613] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.613] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.613] IWbemClassObject:Get (in: This=0x5263468, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b5df0*=0, plFlavor=0x29b5df4*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="icq.exe", varVal2=0x0), pType=0x29b5df0*=8, plFlavor=0x29b5df4*=0) returned 0x0 [0181.613] SysStringByteLen (bstr="icq.exe") returned 0xe [0181.613] SysStringByteLen (bstr="icq.exe") returned 0xe [0181.613] IWbemClassObject:Get (in: This=0x5263468, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b5df0*=8, plFlavor=0x29b5df4*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="icq.exe", varVal2=0x0), pType=0x29b5df0*=8, plFlavor=0x29b5df4*=0) returned 0x0 [0181.614] SysStringByteLen (bstr="icq.exe") returned 0xe [0181.614] SysStringByteLen (bstr="icq.exe") returned 0xe [0181.614] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.614] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.614] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.614] IWbemClassObject:Get (in: This=0x5263468, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b5f1c*=0, plFlavor=0x29b5f20*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft Office\\icq.exe\" ", varVal2=0x0), pType=0x29b5f1c*=8, plFlavor=0x29b5f20*=0) returned 0x0 [0181.614] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Office\\icq.exe\" ") returned 0x64 [0181.614] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Office\\icq.exe\" ") returned 0x64 [0181.614] IWbemClassObject:Get (in: This=0x5263468, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b5f1c*=8, plFlavor=0x29b5f20*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft Office\\icq.exe\" ", varVal2=0x0), pType=0x29b5f1c*=8, plFlavor=0x29b5f20*=0) returned 0x0 [0181.614] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Office\\icq.exe\" ") returned 0x64 [0181.614] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Office\\icq.exe\" ") returned 0x64 [0181.614] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.615] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5269f18, puReturned=0x2995760*=0x1) returned 0x0 [0181.616] IUnknown:QueryInterface (in: This=0x5269f18, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5269f18) returned 0x0 [0181.617] IUnknown:QueryInterface (in: This=0x5269f18, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.617] IUnknown:QueryInterface (in: This=0x5269f18, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.617] IUnknown:QueryInterface (in: This=0x5269f18, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.617] IUnknown:AddRef (This=0x5269f18) returned 0x3 [0181.617] IUnknown:QueryInterface (in: This=0x5269f18, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.617] IUnknown:QueryInterface (in: This=0x5269f18, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.617] IUnknown:QueryInterface (in: This=0x5269f18, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5269f1c) returned 0x0 [0181.617] IMarshal:GetUnmarshalClass (in: This=0x5269f1c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.617] IUnknown:Release (This=0x5269f1c) returned 0x3 [0181.617] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.617] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.617] IUnknown:QueryInterface (in: This=0x5269f18, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.617] IUnknown:Release (This=0x5269f18) returned 0x2 [0181.617] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.617] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.617] IUnknown:QueryInterface (in: This=0x5269f18, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5269f18) returned 0x0 [0181.617] IUnknown:AddRef (This=0x5269f18) returned 0x4 [0181.618] IUnknown:Release (This=0x5269f18) returned 0x3 [0181.618] IUnknown:Release (This=0x5269f18) returned 0x2 [0181.618] CoTaskMemFree (pv=0x71d200) [0181.618] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.618] IUnknown:AddRef (This=0x5269f18) returned 0x3 [0181.618] IWbemClassObject:Get (in: This=0x5269f18, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.618] IWbemClassObject:Get (in: This=0x5269f18, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3624\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.618] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3624\"") returned 0x5e [0181.618] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3624\"") returned 0x5e [0181.618] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x948 [0181.618] SetEvent (hEvent=0x638) returned 1 [0181.619] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x948, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.621] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.621] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260db0, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5260db0) returned 0x0 [0181.621] WbemDefPath:IUnknown:AddRef (This=0x5260db0) returned 0x3 [0181.621] WbemDefPath:IUnknown:Release (This=0x5260db0) returned 0x2 [0181.621] WbemDefPath:IWbemPath:SetText (This=0x5260db0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3624\"") returned 0x0 [0181.621] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.621] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.621] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.621] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.621] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.621] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.621] IWbemClassObject:Get (in: This=0x5269f18, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b69ac*=0, plFlavor=0x29b69b0*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe28, varVal2=0x0), pType=0x29b69ac*=19, plFlavor=0x29b69b0*=0) returned 0x0 [0181.621] IWbemClassObject:Get (in: This=0x5269f18, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b69ac*=19, plFlavor=0x29b69b0*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe28, varVal2=0x0), pType=0x29b69ac*=19, plFlavor=0x29b69b0*=0) returned 0x0 [0181.622] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.622] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.622] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.622] IWbemClassObject:Get (in: This=0x5269f18, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b6ab0*=0, plFlavor=0x29b6ab4*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="leechftp.exe", varVal2=0x0), pType=0x29b6ab0*=8, plFlavor=0x29b6ab4*=0) returned 0x0 [0181.622] SysStringByteLen (bstr="leechftp.exe") returned 0x18 [0181.622] SysStringByteLen (bstr="leechftp.exe") returned 0x18 [0181.622] IWbemClassObject:Get (in: This=0x5269f18, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b6ab0*=8, plFlavor=0x29b6ab4*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="leechftp.exe", varVal2=0x0), pType=0x29b6ab0*=8, plFlavor=0x29b6ab4*=0) returned 0x0 [0181.622] SysStringByteLen (bstr="leechftp.exe") returned 0x18 [0181.622] SysStringByteLen (bstr="leechftp.exe") returned 0x18 [0181.622] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.622] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.622] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.622] IWbemClassObject:Get (in: This=0x5269f18, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b6bf4*=0, plFlavor=0x29b6bf8*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Reference Assemblies\\leechftp.exe\" ", varVal2=0x0), pType=0x29b6bf4*=8, plFlavor=0x29b6bf8*=0) returned 0x0 [0181.622] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Reference Assemblies\\leechftp.exe\" ") returned 0x76 [0181.622] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Reference Assemblies\\leechftp.exe\" ") returned 0x76 [0181.623] IWbemClassObject:Get (in: This=0x5269f18, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b6bf4*=8, plFlavor=0x29b6bf8*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Reference Assemblies\\leechftp.exe\" ", varVal2=0x0), pType=0x29b6bf4*=8, plFlavor=0x29b6bf8*=0) returned 0x0 [0181.623] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Reference Assemblies\\leechftp.exe\" ") returned 0x76 [0181.623] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Reference Assemblies\\leechftp.exe\" ") returned 0x76 [0181.623] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.623] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5269a50, puReturned=0x2995760*=0x1) returned 0x0 [0181.624] IUnknown:QueryInterface (in: This=0x5269a50, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5269a50) returned 0x0 [0181.624] IUnknown:QueryInterface (in: This=0x5269a50, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.624] IUnknown:QueryInterface (in: This=0x5269a50, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.624] IUnknown:QueryInterface (in: This=0x5269a50, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.624] IUnknown:AddRef (This=0x5269a50) returned 0x3 [0181.625] IUnknown:QueryInterface (in: This=0x5269a50, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.625] IUnknown:QueryInterface (in: This=0x5269a50, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.625] IUnknown:QueryInterface (in: This=0x5269a50, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5269a54) returned 0x0 [0181.625] IMarshal:GetUnmarshalClass (in: This=0x5269a54, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.625] IUnknown:Release (This=0x5269a54) returned 0x3 [0181.625] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.625] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.625] IUnknown:QueryInterface (in: This=0x5269a50, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.625] IUnknown:Release (This=0x5269a50) returned 0x2 [0181.625] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.625] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.625] IUnknown:QueryInterface (in: This=0x5269a50, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5269a50) returned 0x0 [0181.625] IUnknown:AddRef (This=0x5269a50) returned 0x4 [0181.625] IUnknown:Release (This=0x5269a50) returned 0x3 [0181.625] IUnknown:Release (This=0x5269a50) returned 0x2 [0181.625] CoTaskMemFree (pv=0x71d200) [0181.625] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.625] IUnknown:AddRef (This=0x5269a50) returned 0x3 [0181.625] IWbemClassObject:Get (in: This=0x5269a50, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.626] IWbemClassObject:Get (in: This=0x5269a50, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3632\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.626] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3632\"") returned 0x5e [0181.626] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3632\"") returned 0x5e [0181.626] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x94c [0181.626] SetEvent (hEvent=0x638) returned 1 [0181.626] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x94c, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.628] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.628] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.628] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261050, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5261050) returned 0x0 [0181.629] WbemDefPath:IUnknown:AddRef (This=0x5261050) returned 0x3 [0181.629] WbemDefPath:IUnknown:Release (This=0x5261050) returned 0x2 [0181.629] WbemDefPath:IWbemPath:SetText (This=0x5261050, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3632\"") returned 0x0 [0181.629] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.629] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.629] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.629] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.629] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.629] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.629] IWbemClassObject:Get (in: This=0x5269a50, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b76c0*=0, plFlavor=0x29b76c4*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe30, varVal2=0x0), pType=0x29b76c0*=19, plFlavor=0x29b76c4*=0) returned 0x0 [0181.629] IWbemClassObject:Get (in: This=0x5269a50, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b76c0*=19, plFlavor=0x29b76c4*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe30, varVal2=0x0), pType=0x29b76c0*=19, plFlavor=0x29b76c4*=0) returned 0x0 [0181.629] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.629] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.629] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.629] IWbemClassObject:Get (in: This=0x5269a50, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b77c4*=0, plFlavor=0x29b77c8*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ncftp.exe", varVal2=0x0), pType=0x29b77c4*=8, plFlavor=0x29b77c8*=0) returned 0x0 [0181.630] SysStringByteLen (bstr="ncftp.exe") returned 0x12 [0181.630] SysStringByteLen (bstr="ncftp.exe") returned 0x12 [0181.630] IWbemClassObject:Get (in: This=0x5269a50, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b77c4*=8, plFlavor=0x29b77c8*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ncftp.exe", varVal2=0x0), pType=0x29b77c4*=8, plFlavor=0x29b77c8*=0) returned 0x0 [0181.630] SysStringByteLen (bstr="ncftp.exe") returned 0x12 [0181.630] SysStringByteLen (bstr="ncftp.exe") returned 0x12 [0181.630] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.630] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.630] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.630] IWbemClassObject:Get (in: This=0x5269a50, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b78f8*=0, plFlavor=0x29b78fc*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft SQL Server\\ncftp.exe\" ", varVal2=0x0), pType=0x29b78f8*=8, plFlavor=0x29b78fc*=0) returned 0x0 [0181.630] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft SQL Server\\ncftp.exe\" ") returned 0x70 [0181.630] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft SQL Server\\ncftp.exe\" ") returned 0x70 [0181.630] IWbemClassObject:Get (in: This=0x5269a50, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b78f8*=8, plFlavor=0x29b78fc*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft SQL Server\\ncftp.exe\" ", varVal2=0x0), pType=0x29b78f8*=8, plFlavor=0x29b78fc*=0) returned 0x0 [0181.630] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft SQL Server\\ncftp.exe\" ") returned 0x70 [0181.630] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft SQL Server\\ncftp.exe\" ") returned 0x70 [0181.630] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.631] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x526a0b0, puReturned=0x2995760*=0x1) returned 0x0 [0181.633] IUnknown:QueryInterface (in: This=0x526a0b0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x526a0b0) returned 0x0 [0181.633] IUnknown:QueryInterface (in: This=0x526a0b0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.633] IUnknown:QueryInterface (in: This=0x526a0b0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.633] IUnknown:QueryInterface (in: This=0x526a0b0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.633] IUnknown:AddRef (This=0x526a0b0) returned 0x3 [0181.633] IUnknown:QueryInterface (in: This=0x526a0b0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.633] IUnknown:QueryInterface (in: This=0x526a0b0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.633] IUnknown:QueryInterface (in: This=0x526a0b0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x526a0b4) returned 0x0 [0181.633] IMarshal:GetUnmarshalClass (in: This=0x526a0b4, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.633] IUnknown:Release (This=0x526a0b4) returned 0x3 [0181.633] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.633] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.633] IUnknown:QueryInterface (in: This=0x526a0b0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.633] IUnknown:Release (This=0x526a0b0) returned 0x2 [0181.634] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.634] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.634] IUnknown:QueryInterface (in: This=0x526a0b0, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x526a0b0) returned 0x0 [0181.634] IUnknown:AddRef (This=0x526a0b0) returned 0x4 [0181.634] IUnknown:Release (This=0x526a0b0) returned 0x3 [0181.634] IUnknown:Release (This=0x526a0b0) returned 0x2 [0181.634] CoTaskMemFree (pv=0x71d200) [0181.634] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.634] IUnknown:AddRef (This=0x526a0b0) returned 0x3 [0181.634] IWbemClassObject:Get (in: This=0x526a0b0, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.634] IWbemClassObject:Get (in: This=0x526a0b0, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3640\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.634] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3640\"") returned 0x5e [0181.634] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3640\"") returned 0x5e [0181.634] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x950 [0181.634] SetEvent (hEvent=0x638) returned 1 [0181.634] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x950, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.637] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.637] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.637] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260e20, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5260e20) returned 0x0 [0181.637] WbemDefPath:IUnknown:AddRef (This=0x5260e20) returned 0x3 [0181.637] WbemDefPath:IUnknown:Release (This=0x5260e20) returned 0x2 [0181.637] WbemDefPath:IWbemPath:SetText (This=0x5260e20, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3640\"") returned 0x0 [0181.637] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.637] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.637] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.637] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.637] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.637] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.638] IWbemClassObject:Get (in: This=0x526a0b0, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b83b0*=0, plFlavor=0x29b83b4*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe38, varVal2=0x0), pType=0x29b83b0*=19, plFlavor=0x29b83b4*=0) returned 0x0 [0181.638] IWbemClassObject:Get (in: This=0x526a0b0, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b83b0*=19, plFlavor=0x29b83b4*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe38, varVal2=0x0), pType=0x29b83b0*=19, plFlavor=0x29b83b4*=0) returned 0x0 [0181.638] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.638] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.638] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.638] IWbemClassObject:Get (in: This=0x526a0b0, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b84b4*=0, plFlavor=0x29b84b8*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="notepad.exe", varVal2=0x0), pType=0x29b84b4*=8, plFlavor=0x29b84b8*=0) returned 0x0 [0181.638] SysStringByteLen (bstr="notepad.exe") returned 0x16 [0181.638] SysStringByteLen (bstr="notepad.exe") returned 0x16 [0181.638] IWbemClassObject:Get (in: This=0x526a0b0, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b84b4*=8, plFlavor=0x29b84b8*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="notepad.exe", varVal2=0x0), pType=0x29b84b4*=8, plFlavor=0x29b84b8*=0) returned 0x0 [0181.638] SysStringByteLen (bstr="notepad.exe") returned 0x16 [0181.638] SysStringByteLen (bstr="notepad.exe") returned 0x16 [0181.638] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.638] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.638] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.639] IWbemClassObject:Get (in: This=0x526a0b0, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b85f0*=0, plFlavor=0x29b85f4*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Photo Viewer\\notepad.exe\" ", varVal2=0x0), pType=0x29b85f0*=8, plFlavor=0x29b85f4*=0) returned 0x0 [0181.639] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Photo Viewer\\notepad.exe\" ") returned 0x74 [0181.639] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Photo Viewer\\notepad.exe\" ") returned 0x74 [0181.639] IWbemClassObject:Get (in: This=0x526a0b0, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b85f0*=8, plFlavor=0x29b85f4*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Photo Viewer\\notepad.exe\" ", varVal2=0x0), pType=0x29b85f0*=8, plFlavor=0x29b85f4*=0) returned 0x0 [0181.639] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Photo Viewer\\notepad.exe\" ") returned 0x74 [0181.639] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Photo Viewer\\notepad.exe\" ") returned 0x74 [0181.639] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.639] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5268730, puReturned=0x2995760*=0x1) returned 0x0 [0181.640] IUnknown:QueryInterface (in: This=0x5268730, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5268730) returned 0x0 [0181.640] IUnknown:QueryInterface (in: This=0x5268730, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.640] IUnknown:QueryInterface (in: This=0x5268730, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.640] IUnknown:QueryInterface (in: This=0x5268730, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.641] IUnknown:AddRef (This=0x5268730) returned 0x3 [0181.641] IUnknown:QueryInterface (in: This=0x5268730, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.641] IUnknown:QueryInterface (in: This=0x5268730, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.641] IUnknown:QueryInterface (in: This=0x5268730, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5268734) returned 0x0 [0181.641] IMarshal:GetUnmarshalClass (in: This=0x5268734, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.642] IUnknown:Release (This=0x5268734) returned 0x3 [0181.642] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.642] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.642] IUnknown:QueryInterface (in: This=0x5268730, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.642] IUnknown:Release (This=0x5268730) returned 0x2 [0181.642] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.642] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.642] IUnknown:QueryInterface (in: This=0x5268730, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5268730) returned 0x0 [0181.642] IUnknown:AddRef (This=0x5268730) returned 0x4 [0181.642] IUnknown:Release (This=0x5268730) returned 0x3 [0181.642] IUnknown:Release (This=0x5268730) returned 0x2 [0181.642] CoTaskMemFree (pv=0x71d200) [0181.642] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.642] IUnknown:AddRef (This=0x5268730) returned 0x3 [0181.642] IWbemClassObject:Get (in: This=0x5268730, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.642] IWbemClassObject:Get (in: This=0x5268730, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3648\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.642] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3648\"") returned 0x5e [0181.642] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3648\"") returned 0x5e [0181.643] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x954 [0181.643] SetEvent (hEvent=0x638) returned 1 [0181.643] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x954, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.646] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.646] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.646] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261280, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5261280) returned 0x0 [0181.646] WbemDefPath:IUnknown:AddRef (This=0x5261280) returned 0x3 [0181.646] WbemDefPath:IUnknown:Release (This=0x5261280) returned 0x2 [0181.646] WbemDefPath:IWbemPath:SetText (This=0x5261280, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3648\"") returned 0x0 [0181.646] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.646] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.646] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.646] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.646] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.646] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.646] IWbemClassObject:Get (in: This=0x5268730, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b90b8*=0, plFlavor=0x29b90bc*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe40, varVal2=0x0), pType=0x29b90b8*=19, plFlavor=0x29b90bc*=0) returned 0x0 [0181.646] IWbemClassObject:Get (in: This=0x5268730, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b90b8*=19, plFlavor=0x29b90bc*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe40, varVal2=0x0), pType=0x29b90b8*=19, plFlavor=0x29b90bc*=0) returned 0x0 [0181.646] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.647] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.647] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.647] IWbemClassObject:Get (in: This=0x5268730, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b91bc*=0, plFlavor=0x29b91c0*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="operamail.exe", varVal2=0x0), pType=0x29b91bc*=8, plFlavor=0x29b91c0*=0) returned 0x0 [0181.647] SysStringByteLen (bstr="operamail.exe") returned 0x1a [0181.647] SysStringByteLen (bstr="operamail.exe") returned 0x1a [0181.647] IWbemClassObject:Get (in: This=0x5268730, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b91bc*=8, plFlavor=0x29b91c0*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="operamail.exe", varVal2=0x0), pType=0x29b91bc*=8, plFlavor=0x29b91c0*=0) returned 0x0 [0181.647] SysStringByteLen (bstr="operamail.exe") returned 0x1a [0181.647] SysStringByteLen (bstr="operamail.exe") returned 0x1a [0181.647] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.647] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.647] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.647] IWbemClassObject:Get (in: This=0x5268730, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b9300*=0, plFlavor=0x29b9304*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Sidebar\\operamail.exe\" ", varVal2=0x0), pType=0x29b9300*=8, plFlavor=0x29b9304*=0) returned 0x0 [0181.647] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Sidebar\\operamail.exe\" ") returned 0x62 [0181.647] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Sidebar\\operamail.exe\" ") returned 0x62 [0181.647] IWbemClassObject:Get (in: This=0x5268730, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b9300*=8, plFlavor=0x29b9304*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Sidebar\\operamail.exe\" ", varVal2=0x0), pType=0x29b9300*=8, plFlavor=0x29b9304*=0) returned 0x0 [0181.648] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Sidebar\\operamail.exe\" ") returned 0x62 [0181.648] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Sidebar\\operamail.exe\" ") returned 0x62 [0181.648] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.648] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x52688c8, puReturned=0x2995760*=0x1) returned 0x0 [0181.649] IUnknown:QueryInterface (in: This=0x52688c8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x52688c8) returned 0x0 [0181.649] IUnknown:QueryInterface (in: This=0x52688c8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.649] IUnknown:QueryInterface (in: This=0x52688c8, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.649] IUnknown:QueryInterface (in: This=0x52688c8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.649] IUnknown:AddRef (This=0x52688c8) returned 0x3 [0181.649] IUnknown:QueryInterface (in: This=0x52688c8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.649] IUnknown:QueryInterface (in: This=0x52688c8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.649] IUnknown:QueryInterface (in: This=0x52688c8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x52688cc) returned 0x0 [0181.649] IMarshal:GetUnmarshalClass (in: This=0x52688cc, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.649] IUnknown:Release (This=0x52688cc) returned 0x3 [0181.650] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.650] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.650] IUnknown:QueryInterface (in: This=0x52688c8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.650] IUnknown:Release (This=0x52688c8) returned 0x2 [0181.650] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.650] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.650] IUnknown:QueryInterface (in: This=0x52688c8, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x52688c8) returned 0x0 [0181.650] IUnknown:AddRef (This=0x52688c8) returned 0x4 [0181.650] IUnknown:Release (This=0x52688c8) returned 0x3 [0181.650] IUnknown:Release (This=0x52688c8) returned 0x2 [0181.650] CoTaskMemFree (pv=0x71d200) [0181.650] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.650] IUnknown:AddRef (This=0x52688c8) returned 0x3 [0181.650] IWbemClassObject:Get (in: This=0x52688c8, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.650] IWbemClassObject:Get (in: This=0x52688c8, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3656\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.650] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3656\"") returned 0x5e [0181.650] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3656\"") returned 0x5e [0181.651] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x958 [0181.651] SetEvent (hEvent=0x638) returned 1 [0181.651] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x958, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.654] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.654] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.654] WbemDefPath:IUnknown:QueryInterface (in: This=0x52616e0, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x52616e0) returned 0x0 [0181.654] WbemDefPath:IUnknown:AddRef (This=0x52616e0) returned 0x3 [0181.654] WbemDefPath:IUnknown:Release (This=0x52616e0) returned 0x2 [0181.654] WbemDefPath:IWbemPath:SetText (This=0x52616e0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3656\"") returned 0x0 [0181.654] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.654] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.654] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.655] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.655] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.655] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.655] IWbemClassObject:Get (in: This=0x52688c8, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b9d90*=0, plFlavor=0x29b9d94*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe48, varVal2=0x0), pType=0x29b9d90*=19, plFlavor=0x29b9d94*=0) returned 0x0 [0181.655] IWbemClassObject:Get (in: This=0x52688c8, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b9d90*=19, plFlavor=0x29b9d94*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe48, varVal2=0x0), pType=0x29b9d90*=19, plFlavor=0x29b9d94*=0) returned 0x0 [0181.655] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.655] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.655] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.655] IWbemClassObject:Get (in: This=0x52688c8, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b9e94*=0, plFlavor=0x29b9e98*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="outlook.exe", varVal2=0x0), pType=0x29b9e94*=8, plFlavor=0x29b9e98*=0) returned 0x0 [0181.655] SysStringByteLen (bstr="outlook.exe") returned 0x16 [0181.655] SysStringByteLen (bstr="outlook.exe") returned 0x16 [0181.655] IWbemClassObject:Get (in: This=0x52688c8, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b9e94*=8, plFlavor=0x29b9e98*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="outlook.exe", varVal2=0x0), pType=0x29b9e94*=8, plFlavor=0x29b9e98*=0) returned 0x0 [0181.655] SysStringByteLen (bstr="outlook.exe") returned 0x16 [0181.655] SysStringByteLen (bstr="outlook.exe") returned 0x16 [0181.656] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.656] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.656] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.656] IWbemClassObject:Get (in: This=0x52688c8, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b9fd0*=0, plFlavor=0x29b9fd4*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Journal\\outlook.exe\" ", varVal2=0x0), pType=0x29b9fd0*=8, plFlavor=0x29b9fd4*=0) returned 0x0 [0181.656] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Journal\\outlook.exe\" ") returned 0x5e [0181.656] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Journal\\outlook.exe\" ") returned 0x5e [0181.656] IWbemClassObject:Get (in: This=0x52688c8, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b9fd0*=8, plFlavor=0x29b9fd4*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Journal\\outlook.exe\" ", varVal2=0x0), pType=0x29b9fd0*=8, plFlavor=0x29b9fd4*=0) returned 0x0 [0181.656] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Journal\\outlook.exe\" ") returned 0x5e [0181.656] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Journal\\outlook.exe\" ") returned 0x5e [0181.656] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.656] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5269720, puReturned=0x2995760*=0x1) returned 0x0 [0181.657] IUnknown:QueryInterface (in: This=0x5269720, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5269720) returned 0x0 [0181.658] IUnknown:QueryInterface (in: This=0x5269720, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.658] IUnknown:QueryInterface (in: This=0x5269720, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.658] IUnknown:QueryInterface (in: This=0x5269720, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.658] IUnknown:AddRef (This=0x5269720) returned 0x3 [0181.658] IUnknown:QueryInterface (in: This=0x5269720, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.658] IUnknown:QueryInterface (in: This=0x5269720, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.658] IUnknown:QueryInterface (in: This=0x5269720, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5269724) returned 0x0 [0181.658] IMarshal:GetUnmarshalClass (in: This=0x5269724, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.658] IUnknown:Release (This=0x5269724) returned 0x3 [0181.658] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.658] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.658] IUnknown:QueryInterface (in: This=0x5269720, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.658] IUnknown:Release (This=0x5269720) returned 0x2 [0181.658] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.658] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.658] IUnknown:QueryInterface (in: This=0x5269720, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5269720) returned 0x0 [0181.658] IUnknown:AddRef (This=0x5269720) returned 0x4 [0181.659] IUnknown:Release (This=0x5269720) returned 0x3 [0181.659] IUnknown:Release (This=0x5269720) returned 0x2 [0181.659] CoTaskMemFree (pv=0x71d200) [0181.659] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.659] IUnknown:AddRef (This=0x5269720) returned 0x3 [0181.659] IWbemClassObject:Get (in: This=0x5269720, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.659] IWbemClassObject:Get (in: This=0x5269720, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3664\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.659] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3664\"") returned 0x5e [0181.659] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x95c [0181.659] SetEvent (hEvent=0x638) returned 1 [0181.659] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x95c, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.665] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.665] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.665] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261750, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5261750) returned 0x0 [0181.665] WbemDefPath:IUnknown:AddRef (This=0x5261750) returned 0x3 [0181.665] WbemDefPath:IUnknown:Release (This=0x5261750) returned 0x2 [0181.665] WbemDefPath:IWbemPath:SetText (This=0x5261750, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3664\"") returned 0x0 [0181.665] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.665] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.665] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.665] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.665] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.665] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.665] IWbemClassObject:Get (in: This=0x5269720, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29baa50*=0, plFlavor=0x29baa54*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe50, varVal2=0x0), pType=0x29baa50*=19, plFlavor=0x29baa54*=0) returned 0x0 [0181.665] IWbemClassObject:Get (in: This=0x5269720, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29baa50*=19, plFlavor=0x29baa54*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe50, varVal2=0x0), pType=0x29baa50*=19, plFlavor=0x29baa54*=0) returned 0x0 [0181.666] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.666] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.666] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.666] IWbemClassObject:Get (in: This=0x5269720, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bab54*=0, plFlavor=0x29bab58*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="pidgin.exe", varVal2=0x0), pType=0x29bab54*=8, plFlavor=0x29bab58*=0) returned 0x0 [0181.666] IWbemClassObject:Get (in: This=0x5269720, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bab54*=8, plFlavor=0x29bab58*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="pidgin.exe", varVal2=0x0), pType=0x29bab54*=8, plFlavor=0x29bab58*=0) returned 0x0 [0181.666] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.666] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.666] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.666] IWbemClassObject:Get (in: This=0x5269720, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bac90*=0, plFlavor=0x29bac94*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Sidebar\\pidgin.exe\" ", varVal2=0x0), pType=0x29bac90*=8, plFlavor=0x29bac94*=0) returned 0x0 [0181.666] IWbemClassObject:Get (in: This=0x5269720, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bac90*=8, plFlavor=0x29bac94*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Sidebar\\pidgin.exe\" ", varVal2=0x0), pType=0x29bac90*=8, plFlavor=0x29bac94*=0) returned 0x0 [0181.666] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.667] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x52693f0, puReturned=0x2995760*=0x1) returned 0x0 [0181.668] IUnknown:QueryInterface (in: This=0x52693f0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x52693f0) returned 0x0 [0181.668] IUnknown:QueryInterface (in: This=0x52693f0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.668] IUnknown:QueryInterface (in: This=0x52693f0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.668] IUnknown:QueryInterface (in: This=0x52693f0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.668] IUnknown:AddRef (This=0x52693f0) returned 0x3 [0181.668] IUnknown:QueryInterface (in: This=0x52693f0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.668] IUnknown:QueryInterface (in: This=0x52693f0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.668] IUnknown:QueryInterface (in: This=0x52693f0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x52693f4) returned 0x0 [0181.669] IMarshal:GetUnmarshalClass (in: This=0x52693f4, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.669] IUnknown:Release (This=0x52693f4) returned 0x3 [0181.669] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.669] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.669] IUnknown:QueryInterface (in: This=0x52693f0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.669] IUnknown:Release (This=0x52693f0) returned 0x2 [0181.669] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.669] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.669] IUnknown:QueryInterface (in: This=0x52693f0, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x52693f0) returned 0x0 [0181.669] IUnknown:AddRef (This=0x52693f0) returned 0x4 [0181.669] IUnknown:Release (This=0x52693f0) returned 0x3 [0181.669] IUnknown:Release (This=0x52693f0) returned 0x2 [0181.669] CoTaskMemFree (pv=0x71d200) [0181.669] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.669] IUnknown:AddRef (This=0x52693f0) returned 0x3 [0181.669] IWbemClassObject:Get (in: This=0x52693f0, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.669] IWbemClassObject:Get (in: This=0x52693f0, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3672\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.670] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x960 [0181.670] SetEvent (hEvent=0x638) returned 1 [0181.670] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x960, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.672] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.672] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.672] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261130, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5261130) returned 0x0 [0181.672] WbemDefPath:IUnknown:AddRef (This=0x5261130) returned 0x3 [0181.672] WbemDefPath:IUnknown:Release (This=0x5261130) returned 0x2 [0181.673] WbemDefPath:IWbemPath:SetText (This=0x5261130, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3672\"") returned 0x0 [0181.673] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.673] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.673] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.673] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.673] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.674] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.674] IWbemClassObject:Get (in: This=0x52693f0, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bb730*=0, plFlavor=0x29bb734*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe58, varVal2=0x0), pType=0x29bb730*=19, plFlavor=0x29bb734*=0) returned 0x0 [0181.674] IWbemClassObject:Get (in: This=0x52693f0, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bb730*=19, plFlavor=0x29bb734*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe58, varVal2=0x0), pType=0x29bb730*=19, plFlavor=0x29bb734*=0) returned 0x0 [0181.674] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.674] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.674] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.674] IWbemClassObject:Get (in: This=0x52693f0, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bb834*=0, plFlavor=0x29bb838*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="scriptftp.exe", varVal2=0x0), pType=0x29bb834*=8, plFlavor=0x29bb838*=0) returned 0x0 [0181.674] IWbemClassObject:Get (in: This=0x52693f0, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bb834*=8, plFlavor=0x29bb838*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="scriptftp.exe", varVal2=0x0), pType=0x29bb834*=8, plFlavor=0x29bb838*=0) returned 0x0 [0181.674] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.674] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.674] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.675] IWbemClassObject:Get (in: This=0x52693f0, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bb978*=0, plFlavor=0x29bb97c*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Internet Explorer\\scriptftp.exe\" ", varVal2=0x0), pType=0x29bb978*=8, plFlavor=0x29bb97c*=0) returned 0x0 [0181.675] IWbemClassObject:Get (in: This=0x52693f0, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bb978*=8, plFlavor=0x29bb97c*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Internet Explorer\\scriptftp.exe\" ", varVal2=0x0), pType=0x29bb978*=8, plFlavor=0x29bb97c*=0) returned 0x0 [0181.675] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.675] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5269258, puReturned=0x2995760*=0x1) returned 0x0 [0181.677] IUnknown:QueryInterface (in: This=0x5269258, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5269258) returned 0x0 [0181.677] IUnknown:QueryInterface (in: This=0x5269258, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.677] IUnknown:QueryInterface (in: This=0x5269258, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.677] IUnknown:QueryInterface (in: This=0x5269258, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.677] IUnknown:AddRef (This=0x5269258) returned 0x3 [0181.677] IUnknown:QueryInterface (in: This=0x5269258, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.678] IUnknown:QueryInterface (in: This=0x5269258, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.678] IUnknown:QueryInterface (in: This=0x5269258, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x526925c) returned 0x0 [0181.678] IMarshal:GetUnmarshalClass (in: This=0x526925c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.678] IUnknown:Release (This=0x526925c) returned 0x3 [0181.678] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.678] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.678] IUnknown:QueryInterface (in: This=0x5269258, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.678] IUnknown:Release (This=0x5269258) returned 0x2 [0181.678] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.678] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.678] IUnknown:QueryInterface (in: This=0x5269258, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5269258) returned 0x0 [0181.678] IUnknown:AddRef (This=0x5269258) returned 0x4 [0181.678] IUnknown:Release (This=0x5269258) returned 0x3 [0181.678] IUnknown:Release (This=0x5269258) returned 0x2 [0181.678] CoTaskMemFree (pv=0x71d200) [0181.678] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.678] IUnknown:AddRef (This=0x5269258) returned 0x3 [0181.678] IWbemClassObject:Get (in: This=0x5269258, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.678] IWbemClassObject:Get (in: This=0x5269258, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3680\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.679] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x964 [0181.679] SetEvent (hEvent=0x638) returned 1 [0181.679] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x964, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.681] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.681] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.681] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261210, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5261210) returned 0x0 [0181.681] WbemDefPath:IUnknown:AddRef (This=0x5261210) returned 0x3 [0181.681] WbemDefPath:IUnknown:Release (This=0x5261210) returned 0x2 [0181.681] WbemDefPath:IWbemPath:SetText (This=0x5261210, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3680\"") returned 0x0 [0181.681] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.681] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.681] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.681] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.681] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.681] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.681] IWbemClassObject:Get (in: This=0x5269258, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bc414*=0, plFlavor=0x29bc418*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe60, varVal2=0x0), pType=0x29bc414*=19, plFlavor=0x29bc418*=0) returned 0x0 [0181.681] IWbemClassObject:Get (in: This=0x5269258, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bc414*=19, plFlavor=0x29bc418*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe60, varVal2=0x0), pType=0x29bc414*=19, plFlavor=0x29bc418*=0) returned 0x0 [0181.682] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.682] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.682] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.682] IWbemClassObject:Get (in: This=0x5269258, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bc518*=0, plFlavor=0x29bc51c*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="skype.exe", varVal2=0x0), pType=0x29bc518*=8, plFlavor=0x29bc51c*=0) returned 0x0 [0181.682] IWbemClassObject:Get (in: This=0x5269258, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bc518*=8, plFlavor=0x29bc51c*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="skype.exe", varVal2=0x0), pType=0x29bc518*=8, plFlavor=0x29bc51c*=0) returned 0x0 [0181.682] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.682] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.682] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.682] IWbemClassObject:Get (in: This=0x5269258, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bc64c*=0, plFlavor=0x29bc650*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Internet Explorer\\skype.exe\" ", varVal2=0x0), pType=0x29bc64c*=8, plFlavor=0x29bc650*=0) returned 0x0 [0181.682] IWbemClassObject:Get (in: This=0x5269258, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bc64c*=8, plFlavor=0x29bc650*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Internet Explorer\\skype.exe\" ", varVal2=0x0), pType=0x29bc64c*=8, plFlavor=0x29bc650*=0) returned 0x0 [0181.682] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.682] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5268bf8, puReturned=0x2995760*=0x1) returned 0x0 [0181.684] IUnknown:QueryInterface (in: This=0x5268bf8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5268bf8) returned 0x0 [0181.684] IUnknown:QueryInterface (in: This=0x5268bf8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.684] IUnknown:QueryInterface (in: This=0x5268bf8, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.684] IUnknown:QueryInterface (in: This=0x5268bf8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.684] IUnknown:AddRef (This=0x5268bf8) returned 0x3 [0181.684] IUnknown:QueryInterface (in: This=0x5268bf8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.684] IUnknown:QueryInterface (in: This=0x5268bf8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.684] IUnknown:QueryInterface (in: This=0x5268bf8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5268bfc) returned 0x0 [0181.685] IMarshal:GetUnmarshalClass (in: This=0x5268bfc, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.685] IUnknown:Release (This=0x5268bfc) returned 0x3 [0181.685] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.685] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.685] IUnknown:QueryInterface (in: This=0x5268bf8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.685] IUnknown:Release (This=0x5268bf8) returned 0x2 [0181.685] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.685] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.685] IUnknown:QueryInterface (in: This=0x5268bf8, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5268bf8) returned 0x0 [0181.685] IUnknown:AddRef (This=0x5268bf8) returned 0x4 [0181.685] IUnknown:Release (This=0x5268bf8) returned 0x3 [0181.685] IUnknown:Release (This=0x5268bf8) returned 0x2 [0181.685] CoTaskMemFree (pv=0x71d200) [0181.685] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.685] IUnknown:AddRef (This=0x5268bf8) returned 0x3 [0181.685] IWbemClassObject:Get (in: This=0x5268bf8, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.685] IWbemClassObject:Get (in: This=0x5268bf8, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3688\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.685] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x968 [0181.685] SetEvent (hEvent=0x638) returned 1 [0181.686] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x968, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.688] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.688] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.688] WbemDefPath:IUnknown:QueryInterface (in: This=0x52617c0, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x52617c0) returned 0x0 [0181.688] WbemDefPath:IUnknown:AddRef (This=0x52617c0) returned 0x3 [0181.688] WbemDefPath:IUnknown:Release (This=0x52617c0) returned 0x2 [0181.688] WbemDefPath:IWbemPath:SetText (This=0x52617c0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3688\"") returned 0x0 [0181.688] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.688] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.688] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.688] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.688] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.688] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.688] IWbemClassObject:Get (in: This=0x5268bf8, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bd0c8*=0, plFlavor=0x29bd0cc*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe68, varVal2=0x0), pType=0x29bd0c8*=19, plFlavor=0x29bd0cc*=0) returned 0x0 [0181.688] IWbemClassObject:Get (in: This=0x5268bf8, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bd0c8*=19, plFlavor=0x29bd0cc*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe68, varVal2=0x0), pType=0x29bd0c8*=19, plFlavor=0x29bd0cc*=0) returned 0x0 [0181.688] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.688] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.688] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.689] IWbemClassObject:Get (in: This=0x5268bf8, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bd1cc*=0, plFlavor=0x29bd1d0*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="smartftp.exe", varVal2=0x0), pType=0x29bd1cc*=8, plFlavor=0x29bd1d0*=0) returned 0x0 [0181.689] IWbemClassObject:Get (in: This=0x5268bf8, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bd1cc*=8, plFlavor=0x29bd1d0*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="smartftp.exe", varVal2=0x0), pType=0x29bd1cc*=8, plFlavor=0x29bd1d0*=0) returned 0x0 [0181.689] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.689] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.689] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.689] IWbemClassObject:Get (in: This=0x5268bf8, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bd310*=0, plFlavor=0x29bd314*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Defender\\smartftp.exe\" ", varVal2=0x0), pType=0x29bd310*=8, plFlavor=0x29bd314*=0) returned 0x0 [0181.689] IWbemClassObject:Get (in: This=0x5268bf8, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bd310*=8, plFlavor=0x29bd314*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Defender\\smartftp.exe\" ", varVal2=0x0), pType=0x29bd310*=8, plFlavor=0x29bd314*=0) returned 0x0 [0181.689] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.689] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5269be8, puReturned=0x2995760*=0x1) returned 0x0 [0181.690] IUnknown:QueryInterface (in: This=0x5269be8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5269be8) returned 0x0 [0181.690] IUnknown:QueryInterface (in: This=0x5269be8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.690] IUnknown:QueryInterface (in: This=0x5269be8, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.690] IUnknown:QueryInterface (in: This=0x5269be8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.690] IUnknown:AddRef (This=0x5269be8) returned 0x3 [0181.690] IUnknown:QueryInterface (in: This=0x5269be8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.690] IUnknown:QueryInterface (in: This=0x5269be8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.691] IUnknown:QueryInterface (in: This=0x5269be8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5269bec) returned 0x0 [0181.691] IMarshal:GetUnmarshalClass (in: This=0x5269bec, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.691] IUnknown:Release (This=0x5269bec) returned 0x3 [0181.691] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.691] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.691] IUnknown:QueryInterface (in: This=0x5269be8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.691] IUnknown:Release (This=0x5269be8) returned 0x2 [0181.691] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.691] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.691] IUnknown:QueryInterface (in: This=0x5269be8, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5269be8) returned 0x0 [0181.691] IUnknown:AddRef (This=0x5269be8) returned 0x4 [0181.691] IUnknown:Release (This=0x5269be8) returned 0x3 [0181.691] IUnknown:Release (This=0x5269be8) returned 0x2 [0181.691] CoTaskMemFree (pv=0x71d200) [0181.691] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.691] IUnknown:AddRef (This=0x5269be8) returned 0x3 [0181.691] IWbemClassObject:Get (in: This=0x5269be8, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.691] IWbemClassObject:Get (in: This=0x5269be8, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3696\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.692] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x96c [0181.692] SetEvent (hEvent=0x638) returned 1 [0181.692] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x96c, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.694] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.694] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261c90, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5261c90) returned 0x0 [0181.694] WbemDefPath:IUnknown:AddRef (This=0x5261c90) returned 0x3 [0181.694] WbemDefPath:IUnknown:Release (This=0x5261c90) returned 0x2 [0181.694] WbemDefPath:IWbemPath:SetText (This=0x5261c90, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3696\"") returned 0x0 [0181.694] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.694] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.694] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.694] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.694] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.694] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.694] IWbemClassObject:Get (in: This=0x5269be8, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bddc4*=0, plFlavor=0x29bddc8*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe70, varVal2=0x0), pType=0x29bddc4*=19, plFlavor=0x29bddc8*=0) returned 0x0 [0181.694] IWbemClassObject:Get (in: This=0x5269be8, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bddc4*=19, plFlavor=0x29bddc8*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe70, varVal2=0x0), pType=0x29bddc4*=19, plFlavor=0x29bddc8*=0) returned 0x0 [0181.694] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.694] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.695] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.695] IWbemClassObject:Get (in: This=0x5269be8, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bdec8*=0, plFlavor=0x29bdecc*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="thunderbird.exe", varVal2=0x0), pType=0x29bdec8*=8, plFlavor=0x29bdecc*=0) returned 0x0 [0181.695] IWbemClassObject:Get (in: This=0x5269be8, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bdec8*=8, plFlavor=0x29bdecc*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="thunderbird.exe", varVal2=0x0), pType=0x29bdec8*=8, plFlavor=0x29bdecc*=0) returned 0x0 [0181.695] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.695] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.695] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.695] IWbemClassObject:Get (in: This=0x5269be8, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29be014*=0, plFlavor=0x29be018*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Mail\\thunderbird.exe\" ", varVal2=0x0), pType=0x29be014*=8, plFlavor=0x29be018*=0) returned 0x0 [0181.695] IWbemClassObject:Get (in: This=0x5269be8, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29be014*=8, plFlavor=0x29be018*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Mail\\thunderbird.exe\" ", varVal2=0x0), pType=0x29be014*=8, plFlavor=0x29be018*=0) returned 0x0 [0181.695] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.695] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5269588, puReturned=0x2995760*=0x1) returned 0x0 [0181.697] IUnknown:QueryInterface (in: This=0x5269588, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5269588) returned 0x0 [0181.697] IUnknown:QueryInterface (in: This=0x5269588, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.697] IUnknown:QueryInterface (in: This=0x5269588, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.698] IUnknown:QueryInterface (in: This=0x5269588, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.698] IUnknown:AddRef (This=0x5269588) returned 0x3 [0181.698] IUnknown:QueryInterface (in: This=0x5269588, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.698] IUnknown:QueryInterface (in: This=0x5269588, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.698] IUnknown:QueryInterface (in: This=0x5269588, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x526958c) returned 0x0 [0181.698] IMarshal:GetUnmarshalClass (in: This=0x526958c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.698] IUnknown:Release (This=0x526958c) returned 0x3 [0181.698] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.698] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.698] IUnknown:QueryInterface (in: This=0x5269588, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.698] IUnknown:Release (This=0x5269588) returned 0x2 [0181.698] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.698] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.698] IUnknown:QueryInterface (in: This=0x5269588, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5269588) returned 0x0 [0181.698] IUnknown:AddRef (This=0x5269588) returned 0x4 [0181.698] IUnknown:Release (This=0x5269588) returned 0x3 [0181.698] IUnknown:Release (This=0x5269588) returned 0x2 [0181.698] CoTaskMemFree (pv=0x71d200) [0181.698] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.698] IUnknown:AddRef (This=0x5269588) returned 0x3 [0181.698] IWbemClassObject:Get (in: This=0x5269588, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.699] IWbemClassObject:Get (in: This=0x5269588, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3704\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.699] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x970 [0181.699] SetEvent (hEvent=0x638) returned 1 [0181.699] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x970, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.701] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.701] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.701] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261c20, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5261c20) returned 0x0 [0181.701] WbemDefPath:IUnknown:AddRef (This=0x5261c20) returned 0x3 [0181.701] WbemDefPath:IUnknown:Release (This=0x5261c20) returned 0x2 [0181.701] WbemDefPath:IWbemPath:SetText (This=0x5261c20, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3704\"") returned 0x0 [0181.701] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.701] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.701] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.701] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.701] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.701] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.701] IWbemClassObject:Get (in: This=0x5269588, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29beacc*=0, plFlavor=0x29bead0*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe78, varVal2=0x0), pType=0x29beacc*=19, plFlavor=0x29bead0*=0) returned 0x0 [0181.702] IWbemClassObject:Get (in: This=0x5269588, wszName="ProcessId", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29beacc*=19, plFlavor=0x29bead0*=0 | out: pVal=0x19bd68*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe78, varVal2=0x0), pType=0x29beacc*=19, plFlavor=0x29bead0*=0) returned 0x0 [0181.702] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.702] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.702] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.702] IWbemClassObject:Get (in: This=0x5269588, wszName="Name", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bebd0*=0, plFlavor=0x29bebd4*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="trillian.exe", varVal2=0x0), pType=0x29bebd0*=8, plFlavor=0x29bebd4*=0) returned 0x0 [0181.702] IWbemClassObject:Get (in: This=0x5269588, wszName="Name", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bebd0*=8, plFlavor=0x29bebd4*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="trillian.exe", varVal2=0x0), pType=0x29bebd0*=8, plFlavor=0x29bebd4*=0) returned 0x0 [0181.702] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.702] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.702] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.702] IWbemClassObject:Get (in: This=0x5269588, wszName="CommandLine", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bed14*=0, plFlavor=0x29bed18*=0 | out: pVal=0x19bd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Common Files\\trillian.exe\" ", varVal2=0x0), pType=0x29bed14*=8, plFlavor=0x29bed18*=0) returned 0x0 [0181.702] IWbemClassObject:Get (in: This=0x5269588, wszName="CommandLine", lFlags=0, pVal=0x19bd68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bed14*=8, plFlavor=0x29bed18*=0 | out: pVal=0x19bd68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Common Files\\trillian.exe\" ", varVal2=0x0), pType=0x29bed14*=8, plFlavor=0x29bed18*=0) returned 0x0 [0181.702] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.703] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5268598, puReturned=0x2995760*=0x1) returned 0x0 [0181.704] IUnknown:QueryInterface (in: This=0x5268598, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5268598) returned 0x0 [0181.704] IUnknown:QueryInterface (in: This=0x5268598, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.704] IUnknown:QueryInterface (in: This=0x5268598, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.704] IUnknown:QueryInterface (in: This=0x5268598, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.704] IUnknown:AddRef (This=0x5268598) returned 0x3 [0181.704] IUnknown:QueryInterface (in: This=0x5268598, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.704] IUnknown:QueryInterface (in: This=0x5268598, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.704] IUnknown:QueryInterface (in: This=0x5268598, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x526859c) returned 0x0 [0181.704] IMarshal:GetUnmarshalClass (in: This=0x526859c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.704] IUnknown:Release (This=0x526859c) returned 0x3 [0181.704] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.704] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.704] IUnknown:QueryInterface (in: This=0x5268598, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.704] IUnknown:Release (This=0x5268598) returned 0x2 [0181.704] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.705] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.705] IUnknown:QueryInterface (in: This=0x5268598, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5268598) returned 0x0 [0181.705] IUnknown:AddRef (This=0x5268598) returned 0x4 [0181.705] IUnknown:Release (This=0x5268598) returned 0x3 [0181.705] IUnknown:Release (This=0x5268598) returned 0x2 [0181.705] CoTaskMemFree (pv=0x71d200) [0181.705] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.705] IUnknown:AddRef (This=0x5268598) returned 0x3 [0181.705] IWbemClassObject:Get (in: This=0x5268598, wszName="__GENUS", lFlags=0, pVal=0x19bd5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bddc*=0, plFlavor=0x19bdd8*=0 | out: pVal=0x19bd5c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bddc*=3, plFlavor=0x19bdd8*=64) returned 0x0 [0181.705] IWbemClassObject:Get (in: This=0x5268598, wszName="__PATH", lFlags=0, pVal=0x19bd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bdc4*=0, plFlavor=0x19bdc0*=0 | out: pVal=0x19bd40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3712\"", varVal2=0x0), pType=0x19bdc4*=8, plFlavor=0x19bdc0*=64) returned 0x0 [0181.705] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x974 [0181.705] SetEvent (hEvent=0x638) returned 1 [0181.705] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x974, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.708] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.708] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.708] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261bb0, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5261bb0) returned 0x0 [0181.708] WbemDefPath:IUnknown:AddRef (This=0x5261bb0) returned 0x3 [0181.708] WbemDefPath:IUnknown:Release (This=0x5261bb0) returned 0x2 [0181.708] WbemDefPath:IWbemPath:SetText (This=0x5261bb0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3712\"") returned 0x0 [0181.709] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.709] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.709] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.709] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.709] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.709] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.709] IWbemClassObject:Get (in: This=0x5268598, wszName="ProcessId", lFlags=0, pVal=0x19bd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29bf7b0*=0, plFlavor=0x29bf7b4*=0 | out: pVal=0x19bd60*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe80, varVal2=0x0), pType=0x29bf7b0*=19, plFlavor=0x29bf7b4*=0) returned 0x0 [0181.710] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.710] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.710] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.710] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.710] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.710] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.710] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.710] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5269d80, puReturned=0x2995760*=0x1) returned 0x0 [0181.711] IUnknown:QueryInterface (in: This=0x5269d80, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5269d80) returned 0x0 [0181.711] IUnknown:QueryInterface (in: This=0x5269d80, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.712] IUnknown:QueryInterface (in: This=0x5269d80, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.712] IUnknown:QueryInterface (in: This=0x5269d80, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.712] IUnknown:AddRef (This=0x5269d80) returned 0x3 [0181.712] IUnknown:QueryInterface (in: This=0x5269d80, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.712] IUnknown:QueryInterface (in: This=0x5269d80, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.712] IUnknown:QueryInterface (in: This=0x5269d80, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5269d84) returned 0x0 [0181.712] IMarshal:GetUnmarshalClass (in: This=0x5269d84, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.712] IUnknown:Release (This=0x5269d84) returned 0x3 [0181.712] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.712] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.712] IUnknown:QueryInterface (in: This=0x5269d80, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.712] IUnknown:Release (This=0x5269d80) returned 0x2 [0181.712] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.712] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.712] IUnknown:QueryInterface (in: This=0x5269d80, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5269d80) returned 0x0 [0181.712] IUnknown:AddRef (This=0x5269d80) returned 0x4 [0181.712] IUnknown:Release (This=0x5269d80) returned 0x3 [0181.712] IUnknown:Release (This=0x5269d80) returned 0x2 [0181.712] CoTaskMemFree (pv=0x71d200) [0181.712] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.712] IUnknown:AddRef (This=0x5269d80) returned 0x3 [0181.713] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x978 [0181.713] SetEvent (hEvent=0x638) returned 1 [0181.713] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x978, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.715] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.715] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.715] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261b40, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5261b40) returned 0x0 [0181.715] WbemDefPath:IUnknown:AddRef (This=0x5261b40) returned 0x3 [0181.715] WbemDefPath:IUnknown:Release (This=0x5261b40) returned 0x2 [0181.715] WbemDefPath:IWbemPath:SetText (This=0x5261b40, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3720\"") returned 0x0 [0181.715] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.715] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.715] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd94*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.716] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.716] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.716] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.716] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.716] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.716] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.716] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.716] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0181.716] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.716] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.716] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x52698b8, puReturned=0x2995760*=0x1) returned 0x0 [0181.717] IUnknown:QueryInterface (in: This=0x52698b8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x52698b8) returned 0x0 [0181.717] IUnknown:QueryInterface (in: This=0x52698b8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.717] IUnknown:QueryInterface (in: This=0x52698b8, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.717] IUnknown:QueryInterface (in: This=0x52698b8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.718] IUnknown:AddRef (This=0x52698b8) returned 0x3 [0181.718] IUnknown:QueryInterface (in: This=0x52698b8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.718] IUnknown:QueryInterface (in: This=0x52698b8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.718] IUnknown:QueryInterface (in: This=0x52698b8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x52698bc) returned 0x0 [0181.718] IMarshal:GetUnmarshalClass (in: This=0x52698bc, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.718] IUnknown:Release (This=0x52698bc) returned 0x3 [0181.718] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.718] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.718] IUnknown:QueryInterface (in: This=0x52698b8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.718] IUnknown:Release (This=0x52698b8) returned 0x2 [0181.718] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.718] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.718] IUnknown:QueryInterface (in: This=0x52698b8, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x52698b8) returned 0x0 [0181.718] IUnknown:AddRef (This=0x52698b8) returned 0x4 [0181.718] IUnknown:Release (This=0x52698b8) returned 0x3 [0181.718] IUnknown:Release (This=0x52698b8) returned 0x2 [0181.718] CoTaskMemFree (pv=0x71d200) [0181.718] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.718] IUnknown:AddRef (This=0x52698b8) returned 0x3 [0181.718] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x97c [0181.719] SetEvent (hEvent=0x638) returned 1 [0181.719] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x97c, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.721] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.721] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.721] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277c88, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5277c88) returned 0x0 [0181.721] WbemDefPath:IUnknown:AddRef (This=0x5277c88) returned 0x3 [0181.721] WbemDefPath:IUnknown:Release (This=0x5277c88) returned 0x2 [0181.721] WbemDefPath:IWbemPath:SetText (This=0x5277c88, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3728\"") returned 0x0 [0181.721] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.721] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd94*=0x0, pszText=0x0 | out: puBuffLength=0x19bd94*=0xf, pszText=0x0) returned 0x0 [0181.721] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.722] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.722] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x526a248, puReturned=0x2995760*=0x1) returned 0x0 [0181.723] IUnknown:QueryInterface (in: This=0x526a248, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x526a248) returned 0x0 [0181.723] IUnknown:QueryInterface (in: This=0x526a248, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.723] IUnknown:QueryInterface (in: This=0x526a248, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.723] IUnknown:QueryInterface (in: This=0x526a248, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.723] IUnknown:AddRef (This=0x526a248) returned 0x3 [0181.723] IUnknown:QueryInterface (in: This=0x526a248, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.723] IUnknown:QueryInterface (in: This=0x526a248, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.723] IUnknown:QueryInterface (in: This=0x526a248, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x526a24c) returned 0x0 [0181.723] IMarshal:GetUnmarshalClass (in: This=0x526a24c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.723] IUnknown:Release (This=0x526a24c) returned 0x3 [0181.723] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.723] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.723] IUnknown:QueryInterface (in: This=0x526a248, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.724] IUnknown:Release (This=0x526a248) returned 0x2 [0181.724] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.724] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.724] IUnknown:QueryInterface (in: This=0x526a248, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x526a248) returned 0x0 [0181.724] IUnknown:AddRef (This=0x526a248) returned 0x4 [0181.724] IUnknown:Release (This=0x526a248) returned 0x3 [0181.724] IUnknown:Release (This=0x526a248) returned 0x2 [0181.724] CoTaskMemFree (pv=0x71d200) [0181.724] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.724] IUnknown:AddRef (This=0x526a248) returned 0x3 [0181.724] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x980 [0181.724] SetEvent (hEvent=0x638) returned 1 [0181.724] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x980, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.726] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.726] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.726] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277d68, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5277d68) returned 0x0 [0181.726] WbemDefPath:IUnknown:AddRef (This=0x5277d68) returned 0x3 [0181.726] WbemDefPath:IUnknown:Release (This=0x5277d68) returned 0x2 [0181.726] WbemDefPath:IWbemPath:SetText (This=0x5277d68, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3736\"") returned 0x0 [0181.726] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.727] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.728] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.728] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5268400, puReturned=0x2995760*=0x1) returned 0x0 [0181.732] IUnknown:QueryInterface (in: This=0x5268400, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5268400) returned 0x0 [0181.732] IUnknown:QueryInterface (in: This=0x5268400, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.732] IUnknown:QueryInterface (in: This=0x5268400, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.732] IUnknown:QueryInterface (in: This=0x5268400, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.732] IUnknown:AddRef (This=0x5268400) returned 0x3 [0181.732] IUnknown:QueryInterface (in: This=0x5268400, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.732] IUnknown:QueryInterface (in: This=0x5268400, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.732] IUnknown:QueryInterface (in: This=0x5268400, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5268404) returned 0x0 [0181.733] IMarshal:GetUnmarshalClass (in: This=0x5268404, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.733] IUnknown:Release (This=0x5268404) returned 0x3 [0181.733] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.733] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.733] IUnknown:QueryInterface (in: This=0x5268400, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.733] IUnknown:Release (This=0x5268400) returned 0x2 [0181.733] CoGetContextToken (in: pToken=0x19b6d8 | out: pToken=0x19b6d8) returned 0x0 [0181.733] CoGetContextToken (in: pToken=0x19b638 | out: pToken=0x19b638) returned 0x0 [0181.733] IUnknown:QueryInterface (in: This=0x5268400, riid=0x19b708*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x5268400) returned 0x0 [0181.733] IUnknown:AddRef (This=0x5268400) returned 0x4 [0181.733] IUnknown:Release (This=0x5268400) returned 0x3 [0181.733] IUnknown:Release (This=0x5268400) returned 0x2 [0181.733] CoTaskMemFree (pv=0x71d200) [0181.733] CoGetContextToken (in: pToken=0x19ba48 | out: pToken=0x19ba48) returned 0x0 [0181.733] IUnknown:AddRef (This=0x5268400) returned 0x3 [0181.733] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x984 [0181.733] SetEvent (hEvent=0x638) returned 1 [0181.733] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x984, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.735] CoGetContextToken (in: pToken=0x19bbe8 | out: pToken=0x19bbe8) returned 0x0 [0181.735] CoGetContextToken (in: pToken=0x19bb48 | out: pToken=0x19bb48) returned 0x0 [0181.735] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277a58, riid=0x19bc18*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bc14 | out: ppvObject=0x19bc14*=0x5277a58) returned 0x0 [0181.736] WbemDefPath:IUnknown:AddRef (This=0x5277a58) returned 0x3 [0181.736] WbemDefPath:IUnknown:Release (This=0x5277a58) returned 0x2 [0181.736] WbemDefPath:IWbemPath:SetText (This=0x5277a58, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3744\"") returned 0x0 [0181.736] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd98 | out: puCount=0x19bd98*=0x2) returned 0x0 [0181.736] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.736] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.736] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5268a60, puReturned=0x2995760*=0x1) returned 0x0 [0181.737] IUnknown:QueryInterface (in: This=0x5268a60, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5268a60) returned 0x0 [0181.737] IUnknown:QueryInterface (in: This=0x5268a60, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.737] IUnknown:QueryInterface (in: This=0x5268a60, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.737] IUnknown:QueryInterface (in: This=0x5268a60, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.737] IUnknown:AddRef (This=0x5268a60) returned 0x3 [0181.737] IUnknown:QueryInterface (in: This=0x5268a60, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.737] IUnknown:QueryInterface (in: This=0x5268a60, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.738] IUnknown:QueryInterface (in: This=0x5268a60, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5268a64) returned 0x0 [0181.738] IMarshal:GetUnmarshalClass (in: This=0x5268a64, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.738] IUnknown:Release (This=0x5268a64) returned 0x3 [0181.738] CoGetContextToken (in: pToken=0x19acf8 | out: pToken=0x19acf8) returned 0x0 [0181.738] CoGetContextToken (in: pToken=0x19b100 | out: pToken=0x19b100) returned 0x0 [0181.738] IUnknown:QueryInterface (in: This=0x5268a60, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b18c | out: ppvObject=0x19b18c*=0x0) returned 0x80004002 [0181.738] IUnknown:Release (This=0x5268a60) returned 0x2 [0181.738] CoTaskMemFree (pv=0x71d200) [0181.738] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x988 [0181.738] SetEvent (hEvent=0x638) returned 1 [0181.739] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x988, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.741] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.741] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.741] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5268d90, puReturned=0x2995760*=0x1) returned 0x0 [0181.743] IUnknown:QueryInterface (in: This=0x5268d90, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5268d90) returned 0x0 [0181.743] IUnknown:QueryInterface (in: This=0x5268d90, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.743] IUnknown:QueryInterface (in: This=0x5268d90, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.744] IUnknown:QueryInterface (in: This=0x5268d90, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.744] IUnknown:AddRef (This=0x5268d90) returned 0x3 [0181.744] IUnknown:QueryInterface (in: This=0x5268d90, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.744] IUnknown:QueryInterface (in: This=0x5268d90, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.744] IUnknown:QueryInterface (in: This=0x5268d90, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5268d94) returned 0x0 [0181.744] IMarshal:GetUnmarshalClass (in: This=0x5268d94, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.744] IUnknown:Release (This=0x5268d94) returned 0x3 [0181.744] CoTaskMemFree (pv=0x71d200) [0181.744] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x98c [0181.744] SetEvent (hEvent=0x638) returned 1 [0181.744] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x98c, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.747] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.747] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.747] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x5268f28, puReturned=0x2995760*=0x1) returned 0x0 [0181.748] IUnknown:QueryInterface (in: This=0x5268f28, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5268f28) returned 0x0 [0181.748] IUnknown:QueryInterface (in: This=0x5268f28, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.748] IUnknown:QueryInterface (in: This=0x5268f28, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.748] IUnknown:QueryInterface (in: This=0x5268f28, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.748] IUnknown:AddRef (This=0x5268f28) returned 0x3 [0181.748] IUnknown:QueryInterface (in: This=0x5268f28, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.748] IUnknown:QueryInterface (in: This=0x5268f28, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.748] IUnknown:QueryInterface (in: This=0x5268f28, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5268f2c) returned 0x0 [0181.748] IMarshal:GetUnmarshalClass (in: This=0x5268f2c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.748] IUnknown:Release (This=0x5268f2c) returned 0x3 [0181.748] CoTaskMemFree (pv=0x71d200) [0181.749] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x990 [0181.749] SetEvent (hEvent=0x638) returned 1 [0181.749] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x990, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.751] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.751] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.751] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x52690c0, puReturned=0x2995760*=0x1) returned 0x0 [0181.754] IUnknown:QueryInterface (in: This=0x52690c0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x52690c0) returned 0x0 [0181.754] IUnknown:QueryInterface (in: This=0x52690c0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.754] IUnknown:QueryInterface (in: This=0x52690c0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.754] IUnknown:QueryInterface (in: This=0x52690c0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.754] IUnknown:AddRef (This=0x52690c0) returned 0x3 [0181.754] IUnknown:QueryInterface (in: This=0x52690c0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.754] IUnknown:QueryInterface (in: This=0x52690c0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.754] IUnknown:QueryInterface (in: This=0x52690c0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x52690c4) returned 0x0 [0181.754] IMarshal:GetUnmarshalClass (in: This=0x52690c4, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.754] IUnknown:Release (This=0x52690c4) returned 0x3 [0181.754] CoTaskMemFree (pv=0x71d200) [0181.754] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x994 [0181.755] SetEvent (hEvent=0x638) returned 1 [0181.755] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x994, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.757] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.757] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.757] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x52794a8, puReturned=0x2995760*=0x1) returned 0x0 [0181.760] IUnknown:QueryInterface (in: This=0x52794a8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x52794a8) returned 0x0 [0181.760] IUnknown:QueryInterface (in: This=0x52794a8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.760] IUnknown:QueryInterface (in: This=0x52794a8, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.760] IUnknown:QueryInterface (in: This=0x52794a8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.760] IUnknown:AddRef (This=0x52794a8) returned 0x3 [0181.760] IUnknown:QueryInterface (in: This=0x52794a8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.760] IUnknown:QueryInterface (in: This=0x52794a8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.760] IUnknown:QueryInterface (in: This=0x52794a8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x52794ac) returned 0x0 [0181.760] IMarshal:GetUnmarshalClass (in: This=0x52794ac, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.760] IUnknown:Release (This=0x52794ac) returned 0x3 [0181.760] CoTaskMemFree (pv=0x71d200) [0181.761] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x998 [0181.761] SetEvent (hEvent=0x638) returned 1 [0181.761] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x998, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.763] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.763] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.763] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x527a7c8, puReturned=0x2995760*=0x1) returned 0x0 [0181.764] IUnknown:QueryInterface (in: This=0x527a7c8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x527a7c8) returned 0x0 [0181.765] IUnknown:QueryInterface (in: This=0x527a7c8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.765] IUnknown:QueryInterface (in: This=0x527a7c8, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.765] IUnknown:QueryInterface (in: This=0x527a7c8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.765] IUnknown:AddRef (This=0x527a7c8) returned 0x3 [0181.765] IUnknown:QueryInterface (in: This=0x527a7c8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.765] IUnknown:QueryInterface (in: This=0x527a7c8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.765] IUnknown:QueryInterface (in: This=0x527a7c8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x527a7cc) returned 0x0 [0181.765] IMarshal:GetUnmarshalClass (in: This=0x527a7cc, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.765] IUnknown:Release (This=0x527a7cc) returned 0x3 [0181.765] CoTaskMemFree (pv=0x71d200) [0181.765] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x99c [0181.765] SetEvent (hEvent=0x638) returned 1 [0181.766] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x99c, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.768] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.768] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.768] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x2995760 | out: apObjects=0x71d200*=0x527a630, puReturned=0x2995760*=0x1) returned 0x0 [0181.769] IUnknown:QueryInterface (in: This=0x527a630, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x527a630) returned 0x0 [0181.770] IUnknown:QueryInterface (in: This=0x527a630, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.770] IUnknown:QueryInterface (in: This=0x527a630, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.770] IUnknown:QueryInterface (in: This=0x527a630, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.770] IUnknown:AddRef (This=0x527a630) returned 0x3 [0181.770] IUnknown:QueryInterface (in: This=0x527a630, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.770] IUnknown:QueryInterface (in: This=0x527a630, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.770] IUnknown:QueryInterface (in: This=0x527a630, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x527a634) returned 0x0 [0181.770] IMarshal:GetUnmarshalClass (in: This=0x527a634, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.770] IUnknown:Release (This=0x527a634) returned 0x3 [0181.770] CoTaskMemFree (pv=0x71d200) [0181.777] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x9a0 [0181.778] SetEvent (hEvent=0x638) returned 1 [0181.796] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x9a0, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.805] WbemLocator:IUnknown:Release (This=0x717450) returned 0x1 [0181.805] WbemLocator:IUnknown:Release (This=0x51f1878) returned 0x0 [0181.806] WbemLocator:IUnknown:Release (This=0x717b50) returned 0x1 [0181.806] WbemLocator:IUnknown:Release (This=0x51f1148) returned 0x0 [0181.807] WbemLocator:IUnknown:Release (This=0x717d50) returned 0x1 [0181.807] WbemLocator:IUnknown:Release (This=0x51f1328) returned 0x0 [0181.808] WbemLocator:IUnknown:Release (This=0x520c5e0) returned 0x1 [0181.808] WbemLocator:IUnknown:Release (This=0x51f13c8) returned 0x0 [0181.808] WbemLocator:IUnknown:Release (This=0x520c6e0) returned 0x1 [0181.809] WbemLocator:IUnknown:Release (This=0x51f15f8) returned 0x0 [0181.809] WbemLocator:IUnknown:Release (This=0x520b9e0) returned 0x1 [0181.809] WbemLocator:IUnknown:Release (This=0x51f1c38) returned 0x0 [0181.810] WbemLocator:IUnknown:Release (This=0x520c8e0) returned 0x1 [0181.810] WbemLocator:IUnknown:Release (This=0x51f1d28) returned 0x0 [0181.810] WbemLocator:IUnknown:Release (This=0x520cce0) returned 0x1 [0181.810] WbemLocator:IUnknown:Release (This=0x52483c0) returned 0x0 [0181.857] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.857] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.857] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x28282b4 | out: apObjects=0x71d200*=0x5252078, puReturned=0x28282b4*=0x1) returned 0x0 [0181.858] IUnknown:QueryInterface (in: This=0x5252078, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5252078) returned 0x0 [0181.858] IUnknown:QueryInterface (in: This=0x5252078, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.858] IUnknown:QueryInterface (in: This=0x5252078, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.858] IUnknown:QueryInterface (in: This=0x5252078, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.858] IUnknown:AddRef (This=0x5252078) returned 0x3 [0181.858] IUnknown:QueryInterface (in: This=0x5252078, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.858] IUnknown:QueryInterface (in: This=0x5252078, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.858] IUnknown:QueryInterface (in: This=0x5252078, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x525207c) returned 0x0 [0181.859] IMarshal:GetUnmarshalClass (in: This=0x525207c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.859] IUnknown:Release (This=0x525207c) returned 0x3 [0181.860] CoTaskMemFree (pv=0x71d200) [0181.860] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x8a0 [0181.860] SetEvent (hEvent=0x638) returned 1 [0181.860] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x8a0, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.863] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.863] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.863] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x28282b4 | out: apObjects=0x71d200*=0x5251d48, puReturned=0x28282b4*=0x1) returned 0x0 [0181.864] IUnknown:QueryInterface (in: This=0x5251d48, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5251d48) returned 0x0 [0181.864] IUnknown:QueryInterface (in: This=0x5251d48, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.864] IUnknown:QueryInterface (in: This=0x5251d48, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b1a4 | out: ppvObject=0x19b1a4*=0x0) returned 0x80004002 [0181.864] IUnknown:QueryInterface (in: This=0x5251d48, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af7c | out: ppvObject=0x19af7c*=0x0) returned 0x80004002 [0181.864] IUnknown:AddRef (This=0x5251d48) returned 0x3 [0181.864] IUnknown:QueryInterface (in: This=0x5251d48, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.864] IUnknown:QueryInterface (in: This=0x5251d48, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.864] IUnknown:QueryInterface (in: This=0x5251d48, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5251d4c) returned 0x0 [0181.865] IMarshal:GetUnmarshalClass (in: This=0x5251d4c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.865] IUnknown:Release (This=0x5251d4c) returned 0x3 [0181.865] CoTaskMemFree (pv=0x71d200) [0181.865] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x89c [0181.865] SetEvent (hEvent=0x638) returned 1 [0181.865] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x89c, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.867] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.867] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.868] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.868] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x28282b4 | out: apObjects=0x71d200*=0x5252ba0, puReturned=0x28282b4*=0x1) returned 0x0 [0181.869] IUnknown:QueryInterface (in: This=0x5252ba0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b3c8 | out: ppvObject=0x19b3c8*=0x5252ba0) returned 0x0 [0181.869] IUnknown:QueryInterface (in: This=0x5252ba0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b384 | out: ppvObject=0x19b384*=0x0) returned 0x80004002 [0181.869] IUnknown:AddRef (This=0x5252ba0) returned 0x3 [0181.869] IUnknown:QueryInterface (in: This=0x5252ba0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.869] IUnknown:QueryInterface (in: This=0x5252ba0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.869] IUnknown:QueryInterface (in: This=0x5252ba0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5252ba4) returned 0x0 [0181.869] IMarshal:GetUnmarshalClass (in: This=0x5252ba4, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.869] IUnknown:Release (This=0x5252ba4) returned 0x3 [0181.869] CoTaskMemFree (pv=0x71d200) [0181.870] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x898 [0181.870] SetEvent (hEvent=0x638) returned 1 [0181.870] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x898, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.872] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.873] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.873] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x28282b4 | out: apObjects=0x71d200*=0x5251880, puReturned=0x28282b4*=0x1) returned 0x0 [0181.874] IUnknown:AddRef (This=0x5251880) returned 0x3 [0181.874] IUnknown:QueryInterface (in: This=0x5251880, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.874] IUnknown:QueryInterface (in: This=0x5251880, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.874] IUnknown:QueryInterface (in: This=0x5251880, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5251884) returned 0x0 [0181.874] IMarshal:GetUnmarshalClass (in: This=0x5251884, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.874] IUnknown:Release (This=0x5251884) returned 0x3 [0181.874] CoTaskMemFree (pv=0x71d200) [0181.875] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x890 [0181.875] SetEvent (hEvent=0x638) returned 1 [0181.875] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x890, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.877] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.878] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.878] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.878] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x28282b4 | out: apObjects=0x71d200*=0x5251a18, puReturned=0x28282b4*=0x1) returned 0x0 [0181.879] IUnknown:AddRef (This=0x5251a18) returned 0x3 [0181.879] IUnknown:QueryInterface (in: This=0x5251a18, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.879] IUnknown:QueryInterface (in: This=0x5251a18, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.879] IUnknown:QueryInterface (in: This=0x5251a18, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5251a1c) returned 0x0 [0181.880] IMarshal:GetUnmarshalClass (in: This=0x5251a1c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.880] IUnknown:Release (This=0x5251a1c) returned 0x3 [0181.880] CoTaskMemFree (pv=0x71d200) [0181.880] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x8a4 [0181.880] SetEvent (hEvent=0x638) returned 1 [0181.880] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x8a4, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.883] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.883] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.883] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x28282b4 | out: apObjects=0x71d200*=0x5251220, puReturned=0x28282b4*=0x1) returned 0x0 [0181.884] IUnknown:AddRef (This=0x5251220) returned 0x3 [0181.884] IUnknown:QueryInterface (in: This=0x5251220, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.884] IUnknown:QueryInterface (in: This=0x5251220, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.884] IUnknown:QueryInterface (in: This=0x5251220, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5251224) returned 0x0 [0181.884] IMarshal:GetUnmarshalClass (in: This=0x5251224, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.884] IUnknown:Release (This=0x5251224) returned 0x3 [0181.885] CoTaskMemFree (pv=0x71d200) [0181.885] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x754 [0181.885] SetEvent (hEvent=0x638) returned 1 [0181.885] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x754, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.887] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.887] CoTaskMemAlloc (cb=0x4) returned 0x71d200 [0181.887] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d200, puReturned=0x28282b4 | out: apObjects=0x71d200*=0x52513b8, puReturned=0x28282b4*=0x1) returned 0x0 [0181.888] IUnknown:AddRef (This=0x52513b8) returned 0x3 [0181.888] IUnknown:QueryInterface (in: This=0x52513b8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.888] IUnknown:QueryInterface (in: This=0x52513b8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.888] IUnknown:QueryInterface (in: This=0x52513b8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x52513bc) returned 0x0 [0181.888] IMarshal:GetUnmarshalClass (in: This=0x52513bc, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.888] IUnknown:Release (This=0x52513bc) returned 0x3 [0181.889] CoTaskMemFree (pv=0x71d200) [0181.889] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x74c [0181.889] SetEvent (hEvent=0x638) returned 1 [0181.889] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x74c, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.891] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0181.891] CoTaskMemAlloc (cb=0x4) returned 0x71d050 [0181.891] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d050, puReturned=0x28282b4 | out: apObjects=0x71d050*=0x5251ee0, puReturned=0x28282b4*=0x1) returned 0x0 [0181.892] IUnknown:AddRef (This=0x5251ee0) returned 0x3 [0181.892] IUnknown:QueryInterface (in: This=0x5251ee0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.892] IUnknown:QueryInterface (in: This=0x5251ee0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.892] IUnknown:QueryInterface (in: This=0x5251ee0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5251ee4) returned 0x0 [0181.892] IMarshal:GetUnmarshalClass (in: This=0x5251ee4, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.892] IUnknown:Release (This=0x5251ee4) returned 0x3 [0181.892] CoTaskMemFree (pv=0x71d050) [0181.893] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x748 [0181.893] SetEvent (hEvent=0x638) returned 1 [0181.893] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x748, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.895] CoTaskMemAlloc (cb=0x4) returned 0x71d050 [0181.895] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d050, puReturned=0x28282b4 | out: apObjects=0x71d050*=0x5251bb0, puReturned=0x28282b4*=0x1) returned 0x0 [0181.898] IUnknown:AddRef (This=0x5251bb0) returned 0x3 [0181.898] IUnknown:QueryInterface (in: This=0x5251bb0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.898] IUnknown:QueryInterface (in: This=0x5251bb0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.898] IUnknown:QueryInterface (in: This=0x5251bb0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5251bb4) returned 0x0 [0181.898] IMarshal:GetUnmarshalClass (in: This=0x5251bb4, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.898] IUnknown:Release (This=0x5251bb4) returned 0x3 [0181.898] CoTaskMemFree (pv=0x71d050) [0181.898] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x744 [0181.898] SetEvent (hEvent=0x638) returned 1 [0181.898] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x744, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.901] CoTaskMemAlloc (cb=0x4) returned 0x71d070 [0181.901] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d070, puReturned=0x28282b4 | out: apObjects=0x71d070*=0x5251550, puReturned=0x28282b4*=0x1) returned 0x0 [0181.902] IUnknown:AddRef (This=0x5251550) returned 0x3 [0181.902] IUnknown:QueryInterface (in: This=0x5251550, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.902] IUnknown:QueryInterface (in: This=0x5251550, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.902] IUnknown:QueryInterface (in: This=0x5251550, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x5251554) returned 0x0 [0181.902] IMarshal:GetUnmarshalClass (in: This=0x5251554, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.902] IUnknown:Release (This=0x5251554) returned 0x3 [0181.902] CoTaskMemFree (pv=0x71d070) [0181.902] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x750 [0181.902] SetEvent (hEvent=0x638) returned 1 [0181.903] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x750, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.905] CoTaskMemAlloc (cb=0x4) returned 0x71d050 [0181.905] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d050, puReturned=0x28282b4 | out: apObjects=0x71d050*=0x52516e8, puReturned=0x28282b4*=0x1) returned 0x0 [0181.907] IUnknown:AddRef (This=0x52516e8) returned 0x3 [0181.907] IUnknown:QueryInterface (in: This=0x52516e8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19acdc | out: ppvObject=0x19acdc*=0x0) returned 0x80004002 [0181.907] IUnknown:QueryInterface (in: This=0x52516e8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0181.907] IUnknown:QueryInterface (in: This=0x52516e8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac98 | out: ppvObject=0x19ac98*=0x52516ec) returned 0x0 [0181.908] IMarshal:GetUnmarshalClass (in: This=0x52516ec, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19aca0 | out: pCid=0x19aca0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0181.908] IUnknown:Release (This=0x52516ec) returned 0x3 [0181.908] CoTaskMemFree (pv=0x71d050) [0181.908] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x73c [0181.908] SetEvent (hEvent=0x638) returned 1 [0181.908] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bd18*=0x73c, lpdwindex=0x19bb34 | out: lpdwindex=0x19bb34) returned 0x0 [0181.911] CoTaskMemAlloc (cb=0x4) returned 0x71d050 [0181.911] IEnumWbemClassObject:Next (in: This=0x6d24c0, lTimeout=-1, uCount=0x1, apObjects=0x71d050, puReturned=0x28282b4 | out: apObjects=0x71d050*=0x0, puReturned=0x28282b4*=0x0) returned 0x1 [0181.915] CoTaskMemFree (pv=0x71d050) [0181.915] WbemLocator:IUnknown:Release (This=0x520c3e0) returned 0x1 [0181.915] IUnknown:Release (This=0x6d24c0) returned 0x0 [0181.916] WbemLocator:IUnknown:Release (This=0x520b2e0) returned 0x1 [0181.916] IUnknown:Release (This=0x6d2650) returned 0x0 [0181.949] ExpandEnvironmentStringsW (in: lpSrc="%AWS_ACCESS_KEY_ID%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%AWS_ACCESS_KEY_ID%") returned 0x14 [0181.949] ExpandEnvironmentStringsW (in: lpSrc="%AWS_ACCESS_KEY_ID%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%AWS_ACCESS_KEY_ID%") returned 0x14 [0181.949] ExpandEnvironmentStringsW (in: lpSrc="%AWS_SECRET_ACCESS_KEY%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%AWS_SECRET_ACCESS_KEY%") returned 0x18 [0181.949] ExpandEnvironmentStringsW (in: lpSrc="%AWS_SECRET_ACCESS_KEY%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%AWS_SECRET_ACCESS_KEY%") returned 0x18 [0181.949] ExpandEnvironmentStringsW (in: lpSrc="%AMAZON_AWS_ACCESS_KEY_ID%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%AMAZON_AWS_ACCESS_KEY_ID%") returned 0x1b [0181.949] ExpandEnvironmentStringsW (in: lpSrc="%AMAZON_AWS_ACCESS_KEY_ID%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%AMAZON_AWS_ACCESS_KEY_ID%") returned 0x1b [0181.949] ExpandEnvironmentStringsW (in: lpSrc="%AMAZON_AWS_SECRET_ACCESS_KEY%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%AMAZON_AWS_SECRET_ACCESS_KEY%") returned 0x1f [0181.949] ExpandEnvironmentStringsW (in: lpSrc="%AMAZON_AWS_SECRET_ACCESS_KEY%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%AMAZON_AWS_SECRET_ACCESS_KEY%") returned 0x1f [0181.949] ExpandEnvironmentStringsW (in: lpSrc="%ALGOLIA_API_KEY%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%ALGOLIA_API_KEY%") returned 0x12 [0181.950] ExpandEnvironmentStringsW (in: lpSrc="%ALGOLIA_API_KEY%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%ALGOLIA_API_KEY%") returned 0x12 [0181.950] ExpandEnvironmentStringsW (in: lpSrc="%AZURE_CLIENT_ID%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%AZURE_CLIENT_ID%") returned 0x12 [0181.950] ExpandEnvironmentStringsW (in: lpSrc="%AZURE_CLIENT_ID%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%AZURE_CLIENT_ID%") returned 0x12 [0181.950] ExpandEnvironmentStringsW (in: lpSrc="%AZURE_CLIENT_SECRET%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%AZURE_CLIENT_SECRET%") returned 0x16 [0181.950] ExpandEnvironmentStringsW (in: lpSrc="%AZURE_CLIENT_SECRET%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%AZURE_CLIENT_SECRET%") returned 0x16 [0181.950] ExpandEnvironmentStringsW (in: lpSrc="%AZURE_USERNAME%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%AZURE_USERNAME%") returned 0x11 [0181.950] ExpandEnvironmentStringsW (in: lpSrc="%AZURE_USERNAME%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%AZURE_USERNAME%") returned 0x11 [0181.950] ExpandEnvironmentStringsW (in: lpSrc="%AZURE_PASSWORD%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%AZURE_PASSWORD%") returned 0x11 [0181.950] ExpandEnvironmentStringsW (in: lpSrc="%AZURE_PASSWORD%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%AZURE_PASSWORD%") returned 0x11 [0181.950] ExpandEnvironmentStringsW (in: lpSrc="%MSI_ENDPOINT%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%MSI_ENDPOINT%") returned 0xf [0181.950] ExpandEnvironmentStringsW (in: lpSrc="%MSI_ENDPOINT%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%MSI_ENDPOINT%") returned 0xf [0181.951] ExpandEnvironmentStringsW (in: lpSrc="%MSI_SECRET%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%MSI_SECRET%") returned 0xd [0181.951] ExpandEnvironmentStringsW (in: lpSrc="%MSI_SECRET%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%MSI_SECRET%") returned 0xd [0181.951] ExpandEnvironmentStringsW (in: lpSrc="%binance_api%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%binance_api%") returned 0xe [0181.951] ExpandEnvironmentStringsW (in: lpSrc="%binance_api%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%binance_api%") returned 0xe [0181.951] ExpandEnvironmentStringsW (in: lpSrc="%binance_secret%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%binance_secret%") returned 0x11 [0181.951] ExpandEnvironmentStringsW (in: lpSrc="%binance_secret%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%binance_secret%") returned 0x11 [0181.951] ExpandEnvironmentStringsW (in: lpSrc="%BITTREX_API_KEY%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%BITTREX_API_KEY%") returned 0x12 [0181.951] ExpandEnvironmentStringsW (in: lpSrc="%BITTREX_API_KEY%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%BITTREX_API_KEY%") returned 0x12 [0181.951] ExpandEnvironmentStringsW (in: lpSrc="%BITTREX_API_SECRET%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%BITTREX_API_SECRET%") returned 0x15 [0181.951] ExpandEnvironmentStringsW (in: lpSrc="%BITTREX_API_SECRET%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%BITTREX_API_SECRET%") returned 0x15 [0181.951] ExpandEnvironmentStringsW (in: lpSrc="%CF_PASSWORD%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%CF_PASSWORD%") returned 0xe [0181.952] ExpandEnvironmentStringsW (in: lpSrc="%CF_PASSWORD%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%CF_PASSWORD%") returned 0xe [0181.952] ExpandEnvironmentStringsW (in: lpSrc="%CF_USERNAME%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%CF_USERNAME%") returned 0xe [0181.952] ExpandEnvironmentStringsW (in: lpSrc="%CF_USERNAME%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%CF_USERNAME%") returned 0xe [0181.952] ExpandEnvironmentStringsW (in: lpSrc="%CODECLIMATE_REPO_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%CODECLIMATE_REPO_TOKEN%") returned 0x19 [0181.952] ExpandEnvironmentStringsW (in: lpSrc="%CODECLIMATE_REPO_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%CODECLIMATE_REPO_TOKEN%") returned 0x19 [0181.952] ExpandEnvironmentStringsW (in: lpSrc="%COVERALLS_REPO_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%COVERALLS_REPO_TOKEN%") returned 0x17 [0181.952] ExpandEnvironmentStringsW (in: lpSrc="%COVERALLS_REPO_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%COVERALLS_REPO_TOKEN%") returned 0x17 [0181.952] ExpandEnvironmentStringsW (in: lpSrc="%CIRCLE_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%CIRCLE_TOKEN%") returned 0xf [0181.952] ExpandEnvironmentStringsW (in: lpSrc="%CIRCLE_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%CIRCLE_TOKEN%") returned 0xf [0181.952] ExpandEnvironmentStringsW (in: lpSrc="%DIGITALOCEAN_ACCESS_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%DIGITALOCEAN_ACCESS_TOKEN%") returned 0x1c [0181.952] ExpandEnvironmentStringsW (in: lpSrc="%DIGITALOCEAN_ACCESS_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%DIGITALOCEAN_ACCESS_TOKEN%") returned 0x1c [0181.953] ExpandEnvironmentStringsW (in: lpSrc="%DOCKER_EMAIL%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%DOCKER_EMAIL%") returned 0xf [0181.953] ExpandEnvironmentStringsW (in: lpSrc="%DOCKER_EMAIL%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%DOCKER_EMAIL%") returned 0xf [0181.953] ExpandEnvironmentStringsW (in: lpSrc="%DOCKER_PASSWORD%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%DOCKER_PASSWORD%") returned 0x12 [0181.953] ExpandEnvironmentStringsW (in: lpSrc="%DOCKER_PASSWORD%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%DOCKER_PASSWORD%") returned 0x12 [0181.953] ExpandEnvironmentStringsW (in: lpSrc="%DOCKER_USERNAME%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%DOCKER_USERNAME%") returned 0x12 [0181.953] ExpandEnvironmentStringsW (in: lpSrc="%DOCKER_USERNAME%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%DOCKER_USERNAME%") returned 0x12 [0181.953] ExpandEnvironmentStringsW (in: lpSrc="%DOCKERHUB_PASSWORD%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%DOCKERHUB_PASSWORD%") returned 0x15 [0181.953] ExpandEnvironmentStringsW (in: lpSrc="%DOCKERHUB_PASSWORD%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%DOCKERHUB_PASSWORD%") returned 0x15 [0181.953] ExpandEnvironmentStringsW (in: lpSrc="%FACEBOOK_APP_ID%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%FACEBOOK_APP_ID%") returned 0x12 [0181.953] ExpandEnvironmentStringsW (in: lpSrc="%FACEBOOK_APP_ID%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%FACEBOOK_APP_ID%") returned 0x12 [0181.954] ExpandEnvironmentStringsW (in: lpSrc="%FACEBOOK_APP_SECRET%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%FACEBOOK_APP_SECRET%") returned 0x16 [0181.954] ExpandEnvironmentStringsW (in: lpSrc="%FACEBOOK_APP_SECRET%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%FACEBOOK_APP_SECRET%") returned 0x16 [0181.954] ExpandEnvironmentStringsW (in: lpSrc="%FACEBOOK_ACCESS_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%FACEBOOK_ACCESS_TOKEN%") returned 0x18 [0181.954] ExpandEnvironmentStringsW (in: lpSrc="%FACEBOOK_ACCESS_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%FACEBOOK_ACCESS_TOKEN%") returned 0x18 [0181.954] ExpandEnvironmentStringsW (in: lpSrc="%FIREBASE_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%FIREBASE_TOKEN%") returned 0x11 [0181.954] ExpandEnvironmentStringsW (in: lpSrc="%FIREBASE_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%FIREBASE_TOKEN%") returned 0x11 [0181.954] ExpandEnvironmentStringsW (in: lpSrc="%FOSSA_API_KEY%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%FOSSA_API_KEY%") returned 0x10 [0181.954] ExpandEnvironmentStringsW (in: lpSrc="%FOSSA_API_KEY%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%FOSSA_API_KEY%") returned 0x10 [0181.954] ExpandEnvironmentStringsW (in: lpSrc="%GH_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%GH_TOKEN%") returned 0xb [0181.954] ExpandEnvironmentStringsW (in: lpSrc="%GH_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%GH_TOKEN%") returned 0xb [0181.954] ExpandEnvironmentStringsW (in: lpSrc="%GH_ENTERPRISE_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%GH_ENTERPRISE_TOKEN%") returned 0x16 [0181.955] ExpandEnvironmentStringsW (in: lpSrc="%GH_ENTERPRISE_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%GH_ENTERPRISE_TOKEN%") returned 0x16 [0181.955] ExpandEnvironmentStringsW (in: lpSrc="%CI_DEPLOY_PASSWORD%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%CI_DEPLOY_PASSWORD%") returned 0x15 [0181.955] ExpandEnvironmentStringsW (in: lpSrc="%CI_DEPLOY_PASSWORD%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%CI_DEPLOY_PASSWORD%") returned 0x15 [0181.955] ExpandEnvironmentStringsW (in: lpSrc="%CI_DEPLOY_USER%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%CI_DEPLOY_USER%") returned 0x11 [0181.955] ExpandEnvironmentStringsW (in: lpSrc="%CI_DEPLOY_USER%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%CI_DEPLOY_USER%") returned 0x11 [0181.955] ExpandEnvironmentStringsW (in: lpSrc="%GOOGLE_APPLICATION_CREDENTIALS%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%GOOGLE_APPLICATION_CREDENTIALS%") returned 0x21 [0181.955] ExpandEnvironmentStringsW (in: lpSrc="%GOOGLE_APPLICATION_CREDENTIALS%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%GOOGLE_APPLICATION_CREDENTIALS%") returned 0x21 [0181.955] ExpandEnvironmentStringsW (in: lpSrc="%GOOGLE_API_KEY%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%GOOGLE_API_KEY%") returned 0x11 [0181.955] ExpandEnvironmentStringsW (in: lpSrc="%GOOGLE_API_KEY%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%GOOGLE_API_KEY%") returned 0x11 [0181.955] ExpandEnvironmentStringsW (in: lpSrc="%CI_DEPLOY_USER%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%CI_DEPLOY_USER%") returned 0x11 [0181.955] ExpandEnvironmentStringsW (in: lpSrc="%CI_DEPLOY_USER%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%CI_DEPLOY_USER%") returned 0x11 [0181.955] ExpandEnvironmentStringsW (in: lpSrc="%CI_DEPLOY_PASSWORD%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%CI_DEPLOY_PASSWORD%") returned 0x15 [0181.956] ExpandEnvironmentStringsW (in: lpSrc="%CI_DEPLOY_PASSWORD%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%CI_DEPLOY_PASSWORD%") returned 0x15 [0181.956] ExpandEnvironmentStringsW (in: lpSrc="%GITLAB_USER_LOGIN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%GITLAB_USER_LOGIN%") returned 0x14 [0181.956] ExpandEnvironmentStringsW (in: lpSrc="%GITLAB_USER_LOGIN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%GITLAB_USER_LOGIN%") returned 0x14 [0181.956] ExpandEnvironmentStringsW (in: lpSrc="%CI_JOB_JWT%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%CI_JOB_JWT%") returned 0xd [0181.956] ExpandEnvironmentStringsW (in: lpSrc="%CI_JOB_JWT%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%CI_JOB_JWT%") returned 0xd [0181.956] ExpandEnvironmentStringsW (in: lpSrc="%CI_JOB_JWT_V2%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%CI_JOB_JWT_V2%") returned 0x10 [0181.956] ExpandEnvironmentStringsW (in: lpSrc="%CI_JOB_JWT_V2%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%CI_JOB_JWT_V2%") returned 0x10 [0181.958] ExpandEnvironmentStringsW (in: lpSrc="%CI_JOB_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%CI_JOB_TOKEN%") returned 0xf [0181.959] ExpandEnvironmentStringsW (in: lpSrc="%CI_JOB_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%CI_JOB_TOKEN%") returned 0xf [0181.959] ExpandEnvironmentStringsW (in: lpSrc="%HEROKU_API_KEY%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%HEROKU_API_KEY%") returned 0x11 [0181.959] ExpandEnvironmentStringsW (in: lpSrc="%HEROKU_API_KEY%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%HEROKU_API_KEY%") returned 0x11 [0181.959] ExpandEnvironmentStringsW (in: lpSrc="%HEROKU_API_USER%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%HEROKU_API_USER%") returned 0x12 [0181.959] ExpandEnvironmentStringsW (in: lpSrc="%HEROKU_API_USER%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%HEROKU_API_USER%") returned 0x12 [0181.959] ExpandEnvironmentStringsW (in: lpSrc="%MAILGUN_API_KEY%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%MAILGUN_API_KEY%") returned 0x12 [0181.959] ExpandEnvironmentStringsW (in: lpSrc="%MAILGUN_API_KEY%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%MAILGUN_API_KEY%") returned 0x12 [0181.959] ExpandEnvironmentStringsW (in: lpSrc="%MCLI_PRIVATE_API_KEY%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%MCLI_PRIVATE_API_KEY%") returned 0x17 [0181.959] ExpandEnvironmentStringsW (in: lpSrc="%MCLI_PRIVATE_API_KEY%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%MCLI_PRIVATE_API_KEY%") returned 0x17 [0181.959] ExpandEnvironmentStringsW (in: lpSrc="%MCLI_PUBLIC_API_KEY%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%MCLI_PUBLIC_API_KEY%") returned 0x16 [0181.959] ExpandEnvironmentStringsW (in: lpSrc="%MCLI_PUBLIC_API_KEY%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%MCLI_PUBLIC_API_KEY%") returned 0x16 [0181.959] ExpandEnvironmentStringsW (in: lpSrc="%NGROK_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%NGROK_TOKEN%") returned 0xe [0181.959] ExpandEnvironmentStringsW (in: lpSrc="%NGROK_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%NGROK_TOKEN%") returned 0xe [0181.959] ExpandEnvironmentStringsW (in: lpSrc="%NGROK_AUTH_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%NGROK_AUTH_TOKEN%") returned 0x13 [0181.960] ExpandEnvironmentStringsW (in: lpSrc="%NGROK_AUTH_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%NGROK_AUTH_TOKEN%") returned 0x13 [0181.960] ExpandEnvironmentStringsW (in: lpSrc="%NPM_AUTH_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%NPM_AUTH_TOKEN%") returned 0x11 [0181.960] ExpandEnvironmentStringsW (in: lpSrc="%NPM_AUTH_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%NPM_AUTH_TOKEN%") returned 0x11 [0181.960] ExpandEnvironmentStringsW (in: lpSrc="%OKTA_CLIENT_ORGURL%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%OKTA_CLIENT_ORGURL%") returned 0x15 [0181.960] ExpandEnvironmentStringsW (in: lpSrc="%OKTA_CLIENT_ORGURL%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%OKTA_CLIENT_ORGURL%") returned 0x15 [0181.960] ExpandEnvironmentStringsW (in: lpSrc="%OKTA_CLIENT_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%OKTA_CLIENT_TOKEN%") returned 0x14 [0181.960] ExpandEnvironmentStringsW (in: lpSrc="%OKTA_CLIENT_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%OKTA_CLIENT_TOKEN%") returned 0x14 [0181.960] ExpandEnvironmentStringsW (in: lpSrc="%OKTA_OAUTH2_CLIENTSECRET%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%OKTA_OAUTH2_CLIENTSECRET%") returned 0x1b [0181.960] ExpandEnvironmentStringsW (in: lpSrc="%OKTA_OAUTH2_CLIENTSECRET%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%OKTA_OAUTH2_CLIENTSECRET%") returned 0x1b [0181.960] ExpandEnvironmentStringsW (in: lpSrc="%OKTA_OAUTH2_CLIENTID%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%OKTA_OAUTH2_CLIENTID%") returned 0x17 [0181.960] ExpandEnvironmentStringsW (in: lpSrc="%OKTA_OAUTH2_CLIENTID%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%OKTA_OAUTH2_CLIENTID%") returned 0x17 [0181.960] ExpandEnvironmentStringsW (in: lpSrc="%OKTA_AUTHN_GROUPID%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%OKTA_AUTHN_GROUPID%") returned 0x15 [0181.960] ExpandEnvironmentStringsW (in: lpSrc="%OKTA_AUTHN_GROUPID%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%OKTA_AUTHN_GROUPID%") returned 0x15 [0181.960] ExpandEnvironmentStringsW (in: lpSrc="%OS_USERNAME%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%OS_USERNAME%") returned 0xe [0181.961] ExpandEnvironmentStringsW (in: lpSrc="%OS_USERNAME%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%OS_USERNAME%") returned 0xe [0181.961] ExpandEnvironmentStringsW (in: lpSrc="%OS_PASSWORD%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%OS_PASSWORD%") returned 0xe [0181.961] ExpandEnvironmentStringsW (in: lpSrc="%OS_PASSWORD%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%OS_PASSWORD%") returned 0xe [0181.961] ExpandEnvironmentStringsW (in: lpSrc="%PERCY_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%PERCY_TOKEN%") returned 0xe [0181.961] ExpandEnvironmentStringsW (in: lpSrc="%PERCY_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%PERCY_TOKEN%") returned 0xe [0181.961] ExpandEnvironmentStringsW (in: lpSrc="%SAUCE_ACCESS_KEY%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%SAUCE_ACCESS_KEY%") returned 0x13 [0181.961] ExpandEnvironmentStringsW (in: lpSrc="%SAUCE_ACCESS_KEY%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%SAUCE_ACCESS_KEY%") returned 0x13 [0181.961] ExpandEnvironmentStringsW (in: lpSrc="%SAUCE_USERNAME%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%SAUCE_USERNAME%") returned 0x11 [0181.961] ExpandEnvironmentStringsW (in: lpSrc="%SAUCE_USERNAME%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%SAUCE_USERNAME%") returned 0x11 [0181.961] ExpandEnvironmentStringsW (in: lpSrc="%SENTRY_AUTH_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%SENTRY_AUTH_TOKEN%") returned 0x14 [0181.961] ExpandEnvironmentStringsW (in: lpSrc="%SENTRY_AUTH_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%SENTRY_AUTH_TOKEN%") returned 0x14 [0181.961] ExpandEnvironmentStringsW (in: lpSrc="%SLACK_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%SLACK_TOKEN%") returned 0xe [0181.961] ExpandEnvironmentStringsW (in: lpSrc="%SLACK_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%SLACK_TOKEN%") returned 0xe [0181.961] ExpandEnvironmentStringsW (in: lpSrc="%square_access_token%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%square_access_token%") returned 0x16 [0181.962] ExpandEnvironmentStringsW (in: lpSrc="%square_access_token%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%square_access_token%") returned 0x16 [0181.962] ExpandEnvironmentStringsW (in: lpSrc="%square_oauth_secret%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%square_oauth_secret%") returned 0x16 [0181.962] ExpandEnvironmentStringsW (in: lpSrc="%square_oauth_secret%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%square_oauth_secret%") returned 0x16 [0181.962] ExpandEnvironmentStringsW (in: lpSrc="%STRIPE_API_KEY%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%STRIPE_API_KEY%") returned 0x11 [0181.962] ExpandEnvironmentStringsW (in: lpSrc="%STRIPE_API_KEY%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%STRIPE_API_KEY%") returned 0x11 [0181.962] ExpandEnvironmentStringsW (in: lpSrc="%STRIPE_DEVICE_NAME%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%STRIPE_DEVICE_NAME%") returned 0x15 [0181.962] ExpandEnvironmentStringsW (in: lpSrc="%STRIPE_DEVICE_NAME%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%STRIPE_DEVICE_NAME%") returned 0x15 [0181.962] ExpandEnvironmentStringsW (in: lpSrc="%SURGE_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%SURGE_TOKEN%") returned 0xe [0181.962] ExpandEnvironmentStringsW (in: lpSrc="%SURGE_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%SURGE_TOKEN%") returned 0xe [0181.962] ExpandEnvironmentStringsW (in: lpSrc="%SURGE_LOGIN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%SURGE_LOGIN%") returned 0xe [0181.962] ExpandEnvironmentStringsW (in: lpSrc="%SURGE_LOGIN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%SURGE_LOGIN%") returned 0xe [0181.962] ExpandEnvironmentStringsW (in: lpSrc="%TWILIO_ACCOUNT_SID%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%TWILIO_ACCOUNT_SID%") returned 0x15 [0181.962] ExpandEnvironmentStringsW (in: lpSrc="%TWILIO_ACCOUNT_SID%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%TWILIO_ACCOUNT_SID%") returned 0x15 [0181.963] ExpandEnvironmentStringsW (in: lpSrc="%CONSUMER_KEY%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%CONSUMER_KEY%") returned 0xf [0181.963] ExpandEnvironmentStringsW (in: lpSrc="%CONSUMER_KEY%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%CONSUMER_KEY%") returned 0xf [0181.963] ExpandEnvironmentStringsW (in: lpSrc="%CONSUMER_SECRET%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%CONSUMER_SECRET%") returned 0x12 [0181.963] ExpandEnvironmentStringsW (in: lpSrc="%CONSUMER_SECRET%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%CONSUMER_SECRET%") returned 0x12 [0181.963] ExpandEnvironmentStringsW (in: lpSrc="%TRAVIS_SUDO%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%TRAVIS_SUDO%") returned 0xe [0181.963] ExpandEnvironmentStringsW (in: lpSrc="%TRAVIS_SUDO%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%TRAVIS_SUDO%") returned 0xe [0181.963] ExpandEnvironmentStringsW (in: lpSrc="%TRAVIS_OS_NAME%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%TRAVIS_OS_NAME%") returned 0x11 [0181.963] ExpandEnvironmentStringsW (in: lpSrc="%TRAVIS_OS_NAME%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%TRAVIS_OS_NAME%") returned 0x11 [0181.963] ExpandEnvironmentStringsW (in: lpSrc="%TRAVIS_SECURE_ENV_VARS%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%TRAVIS_SECURE_ENV_VARS%") returned 0x19 [0181.963] ExpandEnvironmentStringsW (in: lpSrc="%TRAVIS_SECURE_ENV_VARS%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%TRAVIS_SECURE_ENV_VARS%") returned 0x19 [0181.963] ExpandEnvironmentStringsW (in: lpSrc="%VAULT_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%VAULT_TOKEN%") returned 0xe [0181.963] ExpandEnvironmentStringsW (in: lpSrc="%VAULT_TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%VAULT_TOKEN%") returned 0xe [0181.963] ExpandEnvironmentStringsW (in: lpSrc="%VAULT_CLIENT_KEY%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%VAULT_CLIENT_KEY%") returned 0x13 [0181.963] ExpandEnvironmentStringsW (in: lpSrc="%VAULT_CLIENT_KEY%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%VAULT_CLIENT_KEY%") returned 0x13 [0181.964] ExpandEnvironmentStringsW (in: lpSrc="%TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%TOKEN%") returned 0x8 [0181.964] ExpandEnvironmentStringsW (in: lpSrc="%TOKEN%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%TOKEN%") returned 0x8 [0181.964] ExpandEnvironmentStringsW (in: lpSrc="%VULTR_ACCESS%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%VULTR_ACCESS%") returned 0xf [0181.964] ExpandEnvironmentStringsW (in: lpSrc="%VULTR_ACCESS%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%VULTR_ACCESS%") returned 0xf [0181.964] ExpandEnvironmentStringsW (in: lpSrc="%VULTR_SECRET%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%VULTR_SECRET%") returned 0xf [0181.964] ExpandEnvironmentStringsW (in: lpSrc="%VULTR_SECRET%", lpDst=0x19bc9c, nSize=0x64 | out: lpDst="%VULTR_SECRET%") returned 0xf [0181.983] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd5c | out: puCount=0x19bd5c*=0x2) returned 0x0 [0181.983] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd58*=0x0, pszText=0x0 | out: puBuffLength=0x19bd58*=0xf, pszText=0x0) returned 0x0 [0181.983] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd58*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd58*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.995] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc04*=0x3c0, lpdwindex=0x19bab4 | out: lpdwindex=0x19bab4) returned 0x0 [0182.022] CoGetContextToken (in: pToken=0x19b9c8 | out: pToken=0x19b9c8) returned 0x0 [0182.022] CoGetContextToken (in: pToken=0x19b970 | out: pToken=0x19b970) returned 0x0 [0182.022] IUnknown:QueryInterface (in: This=0x66f9c0, riid=0x6f12da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b94c | out: ppvObject=0x19b94c*=0x66f9d0) returned 0x0 [0182.023] CObjectContext::ContextCallback () returned 0x0 [0182.024] IUnknown:Release (This=0x66f9d0) returned 0x1 [0182.024] CoUnmarshalInterface (in: pStm=0x52098a0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19b9bc | out: ppv=0x19b9bc*=0x520cae0) returned 0x0 [0182.025] CoMarshalInterface (pStm=0x52098a0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x520cae0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0182.025] WbemLocator:IUnknown:QueryInterface (in: This=0x520cae0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b85c | out: ppvObject=0x19b85c*=0x520cae0) returned 0x0 [0182.025] WbemLocator:IUnknown:QueryInterface (in: This=0x520cae0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b818 | out: ppvObject=0x19b818*=0x0) returned 0x80004002 [0182.026] WbemLocator:IUnknown:QueryInterface (in: This=0x520cae0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b634 | out: ppvObject=0x19b634*=0x0) returned 0x80004002 [0182.026] WbemLocator:IUnknown:QueryInterface (in: This=0x520cae0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b40c | out: ppvObject=0x19b40c*=0x0) returned 0x80004002 [0182.027] WbemLocator:IUnknown:AddRef (This=0x520cae0) returned 0x3 [0182.027] WbemLocator:IUnknown:QueryInterface (in: This=0x520cae0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b16c | out: ppvObject=0x19b16c*=0x0) returned 0x80004002 [0182.027] WbemLocator:IUnknown:QueryInterface (in: This=0x520cae0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19b11c | out: ppvObject=0x19b11c*=0x0) returned 0x80004002 [0182.027] WbemLocator:IUnknown:QueryInterface (in: This=0x520cae0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b128 | out: ppvObject=0x19b128*=0x520ca3c) returned 0x0 [0182.027] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520ca3c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b130 | out: pCid=0x19b130*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0182.027] WbemLocator:IUnknown:Release (This=0x520ca3c) returned 0x3 [0182.027] CoGetContextToken (in: pToken=0x19b188 | out: pToken=0x19b188) returned 0x0 [0182.027] CoGetContextToken (in: pToken=0x19b590 | out: pToken=0x19b590) returned 0x0 [0182.027] WbemLocator:IUnknown:QueryInterface (in: This=0x520cae0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b61c | out: ppvObject=0x19b61c*=0x520cac4) returned 0x0 [0182.027] WbemLocator:IRpcOptions:Query (in: This=0x520cac4, pPrx=0x520cae0, dwProperty=2, pdwValue=0x19b628 | out: pdwValue=0x19b628) returned 0x0 [0182.027] WbemLocator:IUnknown:Release (This=0x520cac4) returned 0x3 [0182.028] WbemLocator:IUnknown:Release (This=0x520cae0) returned 0x2 [0182.028] WbemLocator:IUnknown:Release (This=0x520cae0) returned 0x1 [0182.028] CoGetContextToken (in: pToken=0x19b908 | out: pToken=0x19b908) returned 0x0 [0182.028] WbemLocator:IUnknown:AddRef (This=0x520cae0) returned 0x2 [0182.028] WbemLocator:IUnknown:QueryInterface (in: This=0x520cae0, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbbc | out: ppvObject=0x19bbbc*=0x520cabc) returned 0x0 [0182.028] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x520cabc, pProxy=0x520cae0, pAuthnSvc=0x19bc0c, pAuthzSvc=0x19bc08, pServerPrincName=0x19bc00, pAuthnLevel=0x19bc04, pImpLevel=0x19bbf4, pAuthInfo=0x19bbf8, pCapabilites=0x19bbfc | out: pAuthnSvc=0x19bc0c*=0xa, pAuthzSvc=0x19bc08*=0x0, pServerPrincName=0x19bc00, pAuthnLevel=0x19bc04*=0x6, pImpLevel=0x19bbf4*=0x2, pAuthInfo=0x19bbf8, pCapabilites=0x19bbfc*=0x1) returned 0x0 [0182.028] WbemLocator:IUnknown:Release (This=0x520cabc) returned 0x2 [0182.028] WbemLocator:IUnknown:QueryInterface (in: This=0x520cae0, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbb0 | out: ppvObject=0x19bbb0*=0x520cae0) returned 0x0 [0182.028] WbemLocator:IUnknown:QueryInterface (in: This=0x520cae0, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb9c | out: ppvObject=0x19bb9c*=0x520cabc) returned 0x0 [0182.028] WbemLocator:IClientSecurity:SetBlanket (This=0x520cabc, pProxy=0x520cae0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0182.028] WbemLocator:IUnknown:Release (This=0x520cabc) returned 0x3 [0182.028] WbemLocator:IUnknown:Release (This=0x520cae0) returned 0x2 [0182.028] CoTaskMemFree (pv=0x51f8f78) [0182.029] WbemLocator:IUnknown:Release (This=0x520cae0) returned 0x1 [0182.029] SysStringLen (param_1=0x0) returned 0x0 [0182.029] CoGetContextToken (in: pToken=0x19bb78 | out: pToken=0x19bb78) returned 0x0 [0182.029] CoGetContextToken (in: pToken=0x19bad8 | out: pToken=0x19bad8) returned 0x0 [0182.029] WbemLocator:IUnknown:QueryInterface (in: This=0x520cae0, riid=0x19bba8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19bba4 | out: ppvObject=0x19bba4*=0x526e5f8) returned 0x0 [0182.029] WbemLocator:IUnknown:AddRef (This=0x526e5f8) returned 0x3 [0182.030] WbemLocator:IUnknown:Release (This=0x526e5f8) returned 0x2 [0182.030] CoGetContextToken (in: pToken=0x19bb38 | out: pToken=0x19bb38) returned 0x0 [0182.030] WbemLocator:IUnknown:AddRef (This=0x526e5f8) returned 0x3 [0182.030] WbemLocator:IUnknown:QueryInterface (in: This=0x526e5f8, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbbc | out: ppvObject=0x19bbbc*=0x520cabc) returned 0x0 [0182.030] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x520cabc, pProxy=0x526e5f8, pAuthnSvc=0x19bc0c, pAuthzSvc=0x19bc08, pServerPrincName=0x19bc00, pAuthnLevel=0x19bc04, pImpLevel=0x19bbf4, pAuthInfo=0x19bbf8, pCapabilites=0x19bbfc | out: pAuthnSvc=0x19bc0c*=0xa, pAuthzSvc=0x19bc08*=0x0, pServerPrincName=0x19bc00, pAuthnLevel=0x19bc04*=0x6, pImpLevel=0x19bbf4*=0x2, pAuthInfo=0x19bbf8, pCapabilites=0x19bbfc*=0x1) returned 0x0 [0182.030] WbemLocator:IUnknown:Release (This=0x520cabc) returned 0x3 [0182.030] WbemLocator:IUnknown:QueryInterface (in: This=0x526e5f8, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbb0 | out: ppvObject=0x19bbb0*=0x520cae0) returned 0x0 [0182.030] WbemLocator:IUnknown:QueryInterface (in: This=0x526e5f8, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb9c | out: ppvObject=0x19bb9c*=0x520cabc) returned 0x0 [0182.030] WbemLocator:IClientSecurity:SetBlanket (This=0x520cabc, pProxy=0x526e5f8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0182.030] WbemLocator:IUnknown:Release (This=0x520cabc) returned 0x4 [0182.030] WbemLocator:IUnknown:Release (This=0x520cae0) returned 0x3 [0182.030] CoTaskMemFree (pv=0x51f8f78) [0182.031] WbemLocator:IUnknown:Release (This=0x526e5f8) returned 0x2 [0182.031] SysStringLen (param_1=0x0) returned 0x0 [0182.031] CoGetContextToken (in: pToken=0x19bac0 | out: pToken=0x19bac0) returned 0x0 [0182.031] WbemLocator:IUnknown:AddRef (This=0x526e5f8) returned 0x3 [0182.031] IWbemServices:ExecQuery (in: This=0x526e5f8, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_Processor", lFlags=16, pCtx=0x0, ppEnum=0x19bccc | out: ppEnum=0x19bccc*=0x6d24c0) returned 0x0 [0182.067] IUnknown:QueryInterface (in: This=0x6d24c0, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb28 | out: ppvObject=0x19bb28*=0x6d24c4) returned 0x0 [0182.067] IClientSecurity:QueryBlanket (in: This=0x6d24c4, pProxy=0x6d24c0, pAuthnSvc=0x19bb78, pAuthzSvc=0x19bb74, pServerPrincName=0x19bb6c, pAuthnLevel=0x19bb70, pImpLevel=0x19bb60, pAuthInfo=0x19bb64, pCapabilites=0x19bb68 | out: pAuthnSvc=0x19bb78*=0xa, pAuthzSvc=0x19bb74*=0x0, pServerPrincName=0x19bb6c, pAuthnLevel=0x19bb70*=0x6, pImpLevel=0x19bb60*=0x2, pAuthInfo=0x19bb64, pCapabilites=0x19bb68*=0x1) returned 0x0 [0182.067] IUnknown:Release (This=0x6d24c4) returned 0x1 [0182.067] IUnknown:QueryInterface (in: This=0x6d24c0, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb1c | out: ppvObject=0x19bb1c*=0x520c3e0) returned 0x0 [0182.067] IUnknown:QueryInterface (in: This=0x6d24c0, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb08 | out: ppvObject=0x19bb08*=0x6d24c4) returned 0x0 [0182.068] IClientSecurity:SetBlanket (This=0x6d24c4, pProxy=0x6d24c0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0182.069] IUnknown:Release (This=0x6d24c4) returned 0x2 [0182.069] WbemLocator:IUnknown:Release (This=0x520c3e0) returned 0x1 [0182.069] CoTaskMemFree (pv=0x51f8f78) [0182.069] IUnknown:QueryInterface (in: This=0x6d24c0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b714 | out: ppvObject=0x19b714*=0x520c3e0) returned 0x0 [0182.070] WbemLocator:IUnknown:QueryInterface (in: This=0x520c3e0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b6d0 | out: ppvObject=0x19b6d0*=0x0) returned 0x80004002 [0182.070] WbemLocator:IUnknown:QueryInterface (in: This=0x520c3e0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b4ec | out: ppvObject=0x19b4ec*=0x0) returned 0x80004002 [0182.070] IUnknown:QueryInterface (in: This=0x6d24c0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b2c4 | out: ppvObject=0x19b2c4*=0x0) returned 0x80004002 [0182.071] WbemLocator:IUnknown:AddRef (This=0x520c3e0) returned 0x3 [0182.071] WbemLocator:IUnknown:QueryInterface (in: This=0x520c3e0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b024 | out: ppvObject=0x19b024*=0x0) returned 0x80004002 [0182.071] WbemLocator:IUnknown:QueryInterface (in: This=0x520c3e0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19afd4 | out: ppvObject=0x19afd4*=0x0) returned 0x80004002 [0182.071] WbemLocator:IUnknown:QueryInterface (in: This=0x520c3e0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19afe0 | out: ppvObject=0x19afe0*=0x520c33c) returned 0x0 [0182.071] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520c33c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19afe8 | out: pCid=0x19afe8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0182.071] WbemLocator:IUnknown:Release (This=0x520c33c) returned 0x3 [0182.071] CoGetContextToken (in: pToken=0x19b040 | out: pToken=0x19b040) returned 0x0 [0182.071] CoGetContextToken (in: pToken=0x19b448 | out: pToken=0x19b448) returned 0x0 [0182.071] WbemLocator:IUnknown:QueryInterface (in: This=0x520c3e0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b4d4 | out: ppvObject=0x19b4d4*=0x520c3c4) returned 0x0 [0182.071] WbemLocator:IRpcOptions:Query (in: This=0x520c3c4, pPrx=0x520c3e0, dwProperty=2, pdwValue=0x19b4e0 | out: pdwValue=0x19b4e0) returned 0x80004002 [0182.072] WbemLocator:IUnknown:Release (This=0x520c3c4) returned 0x3 [0182.072] WbemLocator:IUnknown:Release (This=0x520c3e0) returned 0x2 [0182.072] CoGetContextToken (in: pToken=0x19ba28 | out: pToken=0x19ba28) returned 0x0 [0182.072] CoGetContextToken (in: pToken=0x19b988 | out: pToken=0x19b988) returned 0x0 [0182.072] WbemLocator:IUnknown:QueryInterface (in: This=0x520c3e0, riid=0x19ba58*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19ba54 | out: ppvObject=0x19ba54*=0x6d24c0) returned 0x0 [0182.072] IUnknown:AddRef (This=0x6d24c0) returned 0x4 [0182.072] IUnknown:Release (This=0x6d24c0) returned 0x3 [0182.072] IUnknown:Release (This=0x6d24c0) returned 0x2 [0182.072] WbemLocator:IUnknown:Release (This=0x526e5f8) returned 0x2 [0182.072] SysStringLen (param_1=0x0) returned 0x0 [0182.072] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd18 | out: puCount=0x19bd18*=0x2) returned 0x0 [0182.072] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd14*=0x0, pszText=0x0 | out: puBuffLength=0x19bd14*=0xf, pszText=0x0) returned 0x0 [0182.072] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd14*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd14*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0182.072] CoGetContextToken (in: pToken=0x19bb68 | out: pToken=0x19bb68) returned 0x0 [0182.072] IUnknown:AddRef (This=0x6d24c0) returned 0x3 [0182.072] IEnumWbemClassObject:Clone (in: This=0x6d24c0, ppEnum=0x19bd24 | out: ppEnum=0x19bd24*=0x6d28a8) returned 0x0 [0182.073] IUnknown:QueryInterface (in: This=0x6d28a8, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbe0 | out: ppvObject=0x19bbe0*=0x6d28ac) returned 0x0 [0182.073] IClientSecurity:QueryBlanket (in: This=0x6d28ac, pProxy=0x6d28a8, pAuthnSvc=0x19bc30, pAuthzSvc=0x19bc2c, pServerPrincName=0x19bc24, pAuthnLevel=0x19bc28, pImpLevel=0x19bc18, pAuthInfo=0x19bc1c, pCapabilites=0x19bc20 | out: pAuthnSvc=0x19bc30*=0xa, pAuthzSvc=0x19bc2c*=0x0, pServerPrincName=0x19bc24, pAuthnLevel=0x19bc28*=0x6, pImpLevel=0x19bc18*=0x2, pAuthInfo=0x19bc1c, pCapabilites=0x19bc20*=0x1) returned 0x0 [0182.073] IUnknown:Release (This=0x6d28ac) returned 0x1 [0182.073] IUnknown:QueryInterface (in: This=0x6d28a8, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbd4 | out: ppvObject=0x19bbd4*=0x520c2e0) returned 0x0 [0182.073] IUnknown:QueryInterface (in: This=0x6d28a8, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbc0 | out: ppvObject=0x19bbc0*=0x6d28ac) returned 0x0 [0182.073] IClientSecurity:SetBlanket (This=0x6d28ac, pProxy=0x6d28a8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0182.075] IUnknown:Release (This=0x6d28ac) returned 0x2 [0182.075] WbemLocator:IUnknown:Release (This=0x520c2e0) returned 0x1 [0182.075] CoTaskMemFree (pv=0x51f8c48) [0182.075] IUnknown:QueryInterface (in: This=0x6d28a8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b7bc | out: ppvObject=0x19b7bc*=0x520c2e0) returned 0x0 [0182.075] WbemLocator:IUnknown:QueryInterface (in: This=0x520c2e0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b778 | out: ppvObject=0x19b778*=0x0) returned 0x80004002 [0182.075] WbemLocator:IUnknown:QueryInterface (in: This=0x520c2e0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b594 | out: ppvObject=0x19b594*=0x0) returned 0x80004002 [0182.076] IUnknown:QueryInterface (in: This=0x6d28a8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b36c | out: ppvObject=0x19b36c*=0x0) returned 0x80004002 [0182.076] WbemLocator:IUnknown:AddRef (This=0x520c2e0) returned 0x3 [0182.076] WbemLocator:IUnknown:QueryInterface (in: This=0x520c2e0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b0cc | out: ppvObject=0x19b0cc*=0x0) returned 0x80004002 [0182.076] WbemLocator:IUnknown:QueryInterface (in: This=0x520c2e0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19b07c | out: ppvObject=0x19b07c*=0x0) returned 0x80004002 [0182.076] WbemLocator:IUnknown:QueryInterface (in: This=0x520c2e0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b088 | out: ppvObject=0x19b088*=0x520c23c) returned 0x0 [0182.076] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520c23c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b090 | out: pCid=0x19b090*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0182.076] WbemLocator:IUnknown:Release (This=0x520c23c) returned 0x3 [0182.076] CoGetContextToken (in: pToken=0x19b0e8 | out: pToken=0x19b0e8) returned 0x0 [0182.077] CoGetContextToken (in: pToken=0x19b4f0 | out: pToken=0x19b4f0) returned 0x0 [0182.077] WbemLocator:IUnknown:QueryInterface (in: This=0x520c2e0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b57c | out: ppvObject=0x19b57c*=0x520c2c4) returned 0x0 [0182.077] WbemLocator:IRpcOptions:Query (in: This=0x520c2c4, pPrx=0x520c2e0, dwProperty=2, pdwValue=0x19b588 | out: pdwValue=0x19b588) returned 0x80004002 [0182.077] WbemLocator:IUnknown:Release (This=0x520c2c4) returned 0x3 [0182.077] WbemLocator:IUnknown:Release (This=0x520c2e0) returned 0x2 [0182.077] CoGetContextToken (in: pToken=0x19bad0 | out: pToken=0x19bad0) returned 0x0 [0182.077] CoGetContextToken (in: pToken=0x19ba30 | out: pToken=0x19ba30) returned 0x0 [0182.077] WbemLocator:IUnknown:QueryInterface (in: This=0x520c2e0, riid=0x19bb00*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19bafc | out: ppvObject=0x19bafc*=0x6d28a8) returned 0x0 [0182.077] IUnknown:AddRef (This=0x6d28a8) returned 0x4 [0182.077] IUnknown:Release (This=0x6d28a8) returned 0x3 [0182.077] IUnknown:Release (This=0x6d28a8) returned 0x2 [0182.077] IUnknown:Release (This=0x6d24c0) returned 0x2 [0182.077] SysStringLen (param_1=0x0) returned 0x0 [0182.077] IEnumWbemClassObject:Reset (This=0x6d28a8) returned 0x0 [0182.078] CoTaskMemAlloc (cb=0x4) returned 0x51de8f8 [0182.078] IEnumWbemClassObject:Next (in: This=0x6d28a8, lTimeout=-1, uCount=0x1, apObjects=0x51de8f8, puReturned=0x2853a3c | out: apObjects=0x51de8f8*=0x5252210, puReturned=0x2853a3c*=0x1) returned 0x0 [0188.189] IUnknown:QueryInterface (in: This=0x5252210, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b380 | out: ppvObject=0x19b380*=0x5252210) returned 0x0 [0188.190] IUnknown:QueryInterface (in: This=0x5252210, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b33c | out: ppvObject=0x19b33c*=0x0) returned 0x80004002 [0188.190] IUnknown:QueryInterface (in: This=0x5252210, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b15c | out: ppvObject=0x19b15c*=0x0) returned 0x80004002 [0188.190] IUnknown:QueryInterface (in: This=0x5252210, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af34 | out: ppvObject=0x19af34*=0x0) returned 0x80004002 [0188.190] IUnknown:AddRef (This=0x5252210) returned 0x3 [0188.190] IUnknown:QueryInterface (in: This=0x5252210, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac94 | out: ppvObject=0x19ac94*=0x0) returned 0x80004002 [0188.190] IUnknown:QueryInterface (in: This=0x5252210, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac44 | out: ppvObject=0x19ac44*=0x0) returned 0x80004002 [0188.190] IUnknown:QueryInterface (in: This=0x5252210, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac50 | out: ppvObject=0x19ac50*=0x5252214) returned 0x0 [0188.191] IMarshal:GetUnmarshalClass (in: This=0x5252214, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19ac58 | out: pCid=0x19ac58*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0188.191] IUnknown:Release (This=0x5252214) returned 0x3 [0188.191] CoGetContextToken (in: pToken=0x19acb0 | out: pToken=0x19acb0) returned 0x0 [0188.191] CoGetContextToken (in: pToken=0x19b0b8 | out: pToken=0x19b0b8) returned 0x0 [0188.191] IUnknown:QueryInterface (in: This=0x5252210, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b144 | out: ppvObject=0x19b144*=0x0) returned 0x80004002 [0188.191] IUnknown:Release (This=0x5252210) returned 0x2 [0188.191] CoGetContextToken (in: pToken=0x19b690 | out: pToken=0x19b690) returned 0x0 [0188.191] CoGetContextToken (in: pToken=0x19b5f0 | out: pToken=0x19b5f0) returned 0x0 [0188.191] IUnknown:QueryInterface (in: This=0x5252210, riid=0x19b6c0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b6bc | out: ppvObject=0x19b6bc*=0x5252210) returned 0x0 [0188.191] IUnknown:AddRef (This=0x5252210) returned 0x4 [0188.191] IUnknown:Release (This=0x5252210) returned 0x3 [0188.192] IUnknown:Release (This=0x5252210) returned 0x2 [0188.192] CoTaskMemFree (pv=0x51de8f8) [0188.192] CoGetContextToken (in: pToken=0x19ba00 | out: pToken=0x19ba00) returned 0x0 [0188.192] IUnknown:AddRef (This=0x5252210) returned 0x3 [0188.192] IWbemClassObject:Get (in: This=0x5252210, wszName="__GENUS", lFlags=0, pVal=0x19bd14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd94*=0, plFlavor=0x19bd90*=0 | out: pVal=0x19bd14*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd94*=3, plFlavor=0x19bd90*=64) returned 0x0 [0188.193] IWbemClassObject:Get (in: This=0x5252210, wszName="__PATH", lFlags=0, pVal=0x19bcf8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd7c*=0, plFlavor=0x19bd78*=0 | out: pVal=0x19bcf8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"", varVal2=0x0), pType=0x19bd7c*=8, plFlavor=0x19bd78*=64) returned 0x0 [0188.193] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x66 [0188.193] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x66 [0188.194] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3b8 [0188.194] SetEvent (hEvent=0x638) returned 1 [0188.195] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bcd0*=0x3b8, lpdwindex=0x19baec | out: lpdwindex=0x19baec) returned 0x0 [0188.204] CoGetContextToken (in: pToken=0x19bba0 | out: pToken=0x19bba0) returned 0x0 [0188.204] CoGetContextToken (in: pToken=0x19bb00 | out: pToken=0x19bb00) returned 0x0 [0188.204] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278238, riid=0x19bbd0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bbcc | out: ppvObject=0x19bbcc*=0x5278238) returned 0x0 [0188.204] WbemDefPath:IUnknown:AddRef (This=0x5278238) returned 0x3 [0188.204] WbemDefPath:IUnknown:Release (This=0x5278238) returned 0x2 [0188.204] WbemDefPath:IWbemPath:SetText (This=0x5278238, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x0 [0188.204] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd50 | out: puCount=0x19bd50*=0x2) returned 0x0 [0188.204] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd4c*=0x0, pszText=0x0 | out: puBuffLength=0x19bd4c*=0xf, pszText=0x0) returned 0x0 [0188.204] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd4c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd4c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0188.236] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd1c | out: puCount=0x19bd1c*=0x2) returned 0x0 [0188.236] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd18*=0x0, pszText=0x0 | out: puBuffLength=0x19bd18*=0xf, pszText=0x0) returned 0x0 [0188.236] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd18*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0188.237] IWbemClassObject:Get (in: This=0x5252210, wszName="Name", lFlags=0, pVal=0x19bd18*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28542a0*=0, plFlavor=0x28542a4*=0 | out: pVal=0x19bd18*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", varVal2=0x0), pType=0x28542a0*=8, plFlavor=0x28542a4*=0) returned 0x0 [0188.237] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0188.237] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0188.237] IWbemClassObject:Get (in: This=0x5252210, wszName="Name", lFlags=0, pVal=0x19bd20*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28542a0*=8, plFlavor=0x28542a4*=0 | out: pVal=0x19bd20*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", varVal2=0x0), pType=0x28542a0*=8, plFlavor=0x28542a4*=0) returned 0x0 [0188.237] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0188.237] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0188.241] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd1c | out: puCount=0x19bd1c*=0x2) returned 0x0 [0188.241] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd18*=0x0, pszText=0x0 | out: puBuffLength=0x19bd18*=0xf, pszText=0x0) returned 0x0 [0188.241] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd18*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0188.241] IWbemClassObject:Get (in: This=0x5252210, wszName="NumberOfCores", lFlags=0, pVal=0x19bd18*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28543ac*=0, plFlavor=0x28543b0*=0 | out: pVal=0x19bd18*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), pType=0x28543ac*=19, plFlavor=0x28543b0*=0) returned 0x0 [0188.241] IWbemClassObject:Get (in: This=0x5252210, wszName="NumberOfCores", lFlags=0, pVal=0x19bd20*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28543ac*=19, plFlavor=0x28543b0*=0 | out: pVal=0x19bd20*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), pType=0x28543ac*=19, plFlavor=0x28543b0*=0) returned 0x0 [0188.246] CoTaskMemAlloc (cb=0x4) returned 0x51de7c8 [0188.246] IEnumWbemClassObject:Next (in: This=0x6d28a8, lTimeout=-1, uCount=0x1, apObjects=0x51de7c8, puReturned=0x2853a3c | out: apObjects=0x51de7c8*=0x0, puReturned=0x2853a3c*=0x0) returned 0x1 [0188.248] CoTaskMemFree (pv=0x51de7c8) [0188.248] CoGetContextToken (in: pToken=0x19bc48 | out: pToken=0x19bc48) returned 0x0 [0188.248] WbemLocator:IUnknown:Release (This=0x520c2e0) returned 0x1 [0188.248] IUnknown:Release (This=0x6d28a8) returned 0x0 [0188.253] CoGetContextToken (in: pToken=0x19bc48 | out: pToken=0x19bc48) returned 0x0 [0188.253] WbemLocator:IUnknown:Release (This=0x520c3e0) returned 0x1 [0188.253] IUnknown:Release (This=0x6d24c0) returned 0x0 [0188.277] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3bc [0188.278] SetEvent (hEvent=0x638) returned 1 [0188.278] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bce8*=0x3bc, lpdwindex=0x19bb04 | out: lpdwindex=0x19bb04) returned 0x0 [0188.280] CoGetContextToken (in: pToken=0x19bbb8 | out: pToken=0x19bbb8) returned 0x0 [0188.280] CoGetContextToken (in: pToken=0x19bb18 | out: pToken=0x19bb18) returned 0x0 [0188.281] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278158, riid=0x19bbe8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bbe4 | out: ppvObject=0x19bbe4*=0x5278158) returned 0x0 [0188.281] WbemDefPath:IUnknown:AddRef (This=0x5278158) returned 0x3 [0188.281] WbemDefPath:IUnknown:Release (This=0x5278158) returned 0x2 [0188.281] WbemDefPath:IWbemPath:SetText (This=0x5278158, uMode=0x4, pszPath="root\\CIMV2") returned 0x0 [0188.281] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5278158, puCount=0x19bd64 | out: puCount=0x19bd64*=0x2) returned 0x0 [0188.281] WbemDefPath:IWbemPath:GetText (in: This=0x5278158, lFlags=4, puBuffLength=0x19bd60*=0x0, pszText=0x0 | out: puBuffLength=0x19bd60*=0xf, pszText=0x0) returned 0x0 [0188.281] WbemDefPath:IWbemPath:GetText (in: This=0x5278158, lFlags=4, puBuffLength=0x19bd60*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd60*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0188.281] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5278158, puCount=0x19bd50 | out: puCount=0x19bd50*=0x2) returned 0x0 [0188.281] WbemDefPath:IWbemPath:GetText (in: This=0x5278158, lFlags=4, puBuffLength=0x19bd4c*=0x0, pszText=0x0 | out: puBuffLength=0x19bd4c*=0xf, pszText=0x0) returned 0x0 [0188.281] WbemDefPath:IWbemPath:GetText (in: This=0x5278158, lFlags=4, puBuffLength=0x19bd4c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd4c*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0188.298] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bc00*=0x6ec, lpdwindex=0x19bab4 | out: lpdwindex=0x19bab4) returned 0x0 [0188.343] CoGetContextToken (in: pToken=0x19b9c0 | out: pToken=0x19b9c0) returned 0x0 [0188.343] CoGetContextToken (in: pToken=0x19b968 | out: pToken=0x19b968) returned 0x0 [0188.343] IUnknown:QueryInterface (in: This=0x66f9c0, riid=0x6f12da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b944 | out: ppvObject=0x19b944*=0x66f9d0) returned 0x0 [0188.343] CObjectContext::ContextCallback () returned 0x0 [0188.345] IUnknown:Release (This=0x66f9d0) returned 0x1 [0188.345] CoUnmarshalInterface (in: pStm=0x52099c0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19b9b4 | out: ppv=0x19b9b4*=0x520c5e0) returned 0x0 [0188.346] CoMarshalInterface (pStm=0x52099c0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x520c5e0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0188.346] WbemLocator:IUnknown:QueryInterface (in: This=0x520c5e0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b854 | out: ppvObject=0x19b854*=0x520c5e0) returned 0x0 [0188.346] WbemLocator:IUnknown:QueryInterface (in: This=0x520c5e0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b810 | out: ppvObject=0x19b810*=0x0) returned 0x80004002 [0188.347] WbemLocator:IUnknown:QueryInterface (in: This=0x520c5e0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b62c | out: ppvObject=0x19b62c*=0x0) returned 0x80004002 [0188.347] WbemLocator:IUnknown:QueryInterface (in: This=0x520c5e0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b404 | out: ppvObject=0x19b404*=0x0) returned 0x80004002 [0188.347] WbemLocator:IUnknown:AddRef (This=0x520c5e0) returned 0x3 [0188.347] WbemLocator:IUnknown:QueryInterface (in: This=0x520c5e0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b164 | out: ppvObject=0x19b164*=0x0) returned 0x80004002 [0188.347] WbemLocator:IUnknown:QueryInterface (in: This=0x520c5e0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19b114 | out: ppvObject=0x19b114*=0x0) returned 0x80004002 [0188.348] WbemLocator:IUnknown:QueryInterface (in: This=0x520c5e0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b120 | out: ppvObject=0x19b120*=0x520c53c) returned 0x0 [0188.348] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520c53c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b128 | out: pCid=0x19b128*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0188.348] WbemLocator:IUnknown:Release (This=0x520c53c) returned 0x3 [0188.348] CoGetContextToken (in: pToken=0x19b180 | out: pToken=0x19b180) returned 0x0 [0188.348] CoGetContextToken (in: pToken=0x19b588 | out: pToken=0x19b588) returned 0x0 [0188.348] WbemLocator:IUnknown:QueryInterface (in: This=0x520c5e0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b614 | out: ppvObject=0x19b614*=0x520c5c4) returned 0x0 [0188.348] WbemLocator:IRpcOptions:Query (in: This=0x520c5c4, pPrx=0x520c5e0, dwProperty=2, pdwValue=0x19b620 | out: pdwValue=0x19b620) returned 0x0 [0188.348] WbemLocator:IUnknown:Release (This=0x520c5c4) returned 0x3 [0188.348] WbemLocator:IUnknown:Release (This=0x520c5e0) returned 0x2 [0188.348] WbemLocator:IUnknown:Release (This=0x520c5e0) returned 0x1 [0188.348] CoGetContextToken (in: pToken=0x19b900 | out: pToken=0x19b900) returned 0x0 [0188.348] WbemLocator:IUnknown:AddRef (This=0x520c5e0) returned 0x2 [0188.348] WbemLocator:IUnknown:QueryInterface (in: This=0x520c5e0, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbb8 | out: ppvObject=0x19bbb8*=0x520c5bc) returned 0x0 [0188.348] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x520c5bc, pProxy=0x520c5e0, pAuthnSvc=0x19bc08, pAuthzSvc=0x19bc04, pServerPrincName=0x19bbfc, pAuthnLevel=0x19bc00, pImpLevel=0x19bbf0, pAuthInfo=0x19bbf4, pCapabilites=0x19bbf8 | out: pAuthnSvc=0x19bc08*=0xa, pAuthzSvc=0x19bc04*=0x0, pServerPrincName=0x19bbfc, pAuthnLevel=0x19bc00*=0x6, pImpLevel=0x19bbf0*=0x2, pAuthInfo=0x19bbf4, pCapabilites=0x19bbf8*=0x1) returned 0x0 [0188.349] WbemLocator:IUnknown:Release (This=0x520c5bc) returned 0x2 [0188.349] WbemLocator:IUnknown:QueryInterface (in: This=0x520c5e0, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbac | out: ppvObject=0x19bbac*=0x520c5e0) returned 0x0 [0188.349] WbemLocator:IUnknown:QueryInterface (in: This=0x520c5e0, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb98 | out: ppvObject=0x19bb98*=0x520c5bc) returned 0x0 [0188.349] WbemLocator:IClientSecurity:SetBlanket (This=0x520c5bc, pProxy=0x520c5e0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0188.349] WbemLocator:IUnknown:Release (This=0x520c5bc) returned 0x3 [0188.349] WbemLocator:IUnknown:Release (This=0x520c5e0) returned 0x2 [0188.349] CoTaskMemFree (pv=0x51f8fd8) [0188.349] WbemLocator:IUnknown:Release (This=0x520c5e0) returned 0x1 [0188.349] SysStringLen (param_1=0x0) returned 0x0 [0188.349] CoGetContextToken (in: pToken=0x19bb78 | out: pToken=0x19bb78) returned 0x0 [0188.349] CoGetContextToken (in: pToken=0x19bad8 | out: pToken=0x19bad8) returned 0x0 [0188.349] WbemLocator:IUnknown:QueryInterface (in: This=0x520c5e0, riid=0x19bba8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19bba4 | out: ppvObject=0x19bba4*=0x526e0f8) returned 0x0 [0188.350] WbemLocator:IUnknown:AddRef (This=0x526e0f8) returned 0x3 [0188.350] WbemLocator:IUnknown:Release (This=0x526e0f8) returned 0x2 [0188.350] CoGetContextToken (in: pToken=0x19bb38 | out: pToken=0x19bb38) returned 0x0 [0188.350] WbemLocator:IUnknown:AddRef (This=0x526e0f8) returned 0x3 [0188.350] WbemLocator:IUnknown:QueryInterface (in: This=0x526e0f8, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbb8 | out: ppvObject=0x19bbb8*=0x520c5bc) returned 0x0 [0188.350] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x520c5bc, pProxy=0x526e0f8, pAuthnSvc=0x19bc08, pAuthzSvc=0x19bc04, pServerPrincName=0x19bbfc, pAuthnLevel=0x19bc00, pImpLevel=0x19bbf0, pAuthInfo=0x19bbf4, pCapabilites=0x19bbf8 | out: pAuthnSvc=0x19bc08*=0xa, pAuthzSvc=0x19bc04*=0x0, pServerPrincName=0x19bbfc, pAuthnLevel=0x19bc00*=0x6, pImpLevel=0x19bbf0*=0x2, pAuthInfo=0x19bbf4, pCapabilites=0x19bbf8*=0x1) returned 0x0 [0188.350] WbemLocator:IUnknown:Release (This=0x520c5bc) returned 0x3 [0188.350] WbemLocator:IUnknown:QueryInterface (in: This=0x526e0f8, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbac | out: ppvObject=0x19bbac*=0x520c5e0) returned 0x0 [0188.350] WbemLocator:IUnknown:QueryInterface (in: This=0x526e0f8, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb98 | out: ppvObject=0x19bb98*=0x520c5bc) returned 0x0 [0188.350] WbemLocator:IClientSecurity:SetBlanket (This=0x520c5bc, pProxy=0x526e0f8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0188.351] WbemLocator:IUnknown:Release (This=0x520c5bc) returned 0x4 [0188.351] WbemLocator:IUnknown:Release (This=0x520c5e0) returned 0x3 [0188.351] CoTaskMemFree (pv=0x51f8b58) [0188.351] WbemLocator:IUnknown:Release (This=0x526e0f8) returned 0x2 [0188.351] SysStringLen (param_1=0x0) returned 0x0 [0188.351] CoGetContextToken (in: pToken=0x19bab0 | out: pToken=0x19bab0) returned 0x0 [0188.351] WbemLocator:IUnknown:AddRef (This=0x526e0f8) returned 0x3 [0188.351] IWbemServices:ExecQuery (in: This=0x526e0f8, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_VideoController", lFlags=16, pCtx=0x0, ppEnum=0x19bcc8 | out: ppEnum=0x19bcc8*=0x6d2650) returned 0x0 [0188.401] IUnknown:QueryInterface (in: This=0x6d2650, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb18 | out: ppvObject=0x19bb18*=0x6d2654) returned 0x0 [0188.401] IClientSecurity:QueryBlanket (in: This=0x6d2654, pProxy=0x6d2650, pAuthnSvc=0x19bb68, pAuthzSvc=0x19bb64, pServerPrincName=0x19bb5c, pAuthnLevel=0x19bb60, pImpLevel=0x19bb50, pAuthInfo=0x19bb54, pCapabilites=0x19bb58 | out: pAuthnSvc=0x19bb68*=0xa, pAuthzSvc=0x19bb64*=0x0, pServerPrincName=0x19bb5c, pAuthnLevel=0x19bb60*=0x6, pImpLevel=0x19bb50*=0x2, pAuthInfo=0x19bb54, pCapabilites=0x19bb58*=0x1) returned 0x0 [0188.401] IUnknown:Release (This=0x6d2654) returned 0x1 [0188.401] IUnknown:QueryInterface (in: This=0x6d2650, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb0c | out: ppvObject=0x19bb0c*=0x520bce0) returned 0x0 [0188.401] IUnknown:QueryInterface (in: This=0x6d2650, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19baf8 | out: ppvObject=0x19baf8*=0x6d2654) returned 0x0 [0188.401] IClientSecurity:SetBlanket (This=0x6d2654, pProxy=0x6d2650, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0188.403] IUnknown:Release (This=0x6d2654) returned 0x2 [0188.403] WbemLocator:IUnknown:Release (This=0x520bce0) returned 0x1 [0188.403] CoTaskMemFree (pv=0x51f8a38) [0188.403] IUnknown:QueryInterface (in: This=0x6d2650, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b704 | out: ppvObject=0x19b704*=0x520bce0) returned 0x0 [0188.403] WbemLocator:IUnknown:QueryInterface (in: This=0x520bce0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b6c0 | out: ppvObject=0x19b6c0*=0x0) returned 0x80004002 [0188.404] WbemLocator:IUnknown:QueryInterface (in: This=0x520bce0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b4dc | out: ppvObject=0x19b4dc*=0x0) returned 0x80004002 [0188.405] IUnknown:QueryInterface (in: This=0x6d2650, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b2b4 | out: ppvObject=0x19b2b4*=0x0) returned 0x80004002 [0188.405] WbemLocator:IUnknown:AddRef (This=0x520bce0) returned 0x3 [0188.405] WbemLocator:IUnknown:QueryInterface (in: This=0x520bce0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b014 | out: ppvObject=0x19b014*=0x0) returned 0x80004002 [0188.405] WbemLocator:IUnknown:QueryInterface (in: This=0x520bce0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19afc4 | out: ppvObject=0x19afc4*=0x0) returned 0x80004002 [0188.405] WbemLocator:IUnknown:QueryInterface (in: This=0x520bce0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19afd0 | out: ppvObject=0x19afd0*=0x520bc3c) returned 0x0 [0188.405] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520bc3c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19afd8 | out: pCid=0x19afd8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0188.405] WbemLocator:IUnknown:Release (This=0x520bc3c) returned 0x3 [0188.405] CoGetContextToken (in: pToken=0x19b030 | out: pToken=0x19b030) returned 0x0 [0188.405] CoGetContextToken (in: pToken=0x19b438 | out: pToken=0x19b438) returned 0x0 [0188.405] WbemLocator:IUnknown:QueryInterface (in: This=0x520bce0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b4c4 | out: ppvObject=0x19b4c4*=0x520bcc4) returned 0x0 [0188.406] WbemLocator:IRpcOptions:Query (in: This=0x520bcc4, pPrx=0x520bce0, dwProperty=2, pdwValue=0x19b4d0 | out: pdwValue=0x19b4d0) returned 0x80004002 [0188.406] WbemLocator:IUnknown:Release (This=0x520bcc4) returned 0x3 [0188.406] WbemLocator:IUnknown:Release (This=0x520bce0) returned 0x2 [0188.406] CoGetContextToken (in: pToken=0x19ba18 | out: pToken=0x19ba18) returned 0x0 [0188.406] CoGetContextToken (in: pToken=0x19b978 | out: pToken=0x19b978) returned 0x0 [0188.406] WbemLocator:IUnknown:QueryInterface (in: This=0x520bce0, riid=0x19ba48*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19ba44 | out: ppvObject=0x19ba44*=0x6d2650) returned 0x0 [0188.406] IUnknown:AddRef (This=0x6d2650) returned 0x4 [0188.406] IUnknown:Release (This=0x6d2650) returned 0x3 [0188.406] IUnknown:Release (This=0x6d2650) returned 0x2 [0188.406] WbemLocator:IUnknown:Release (This=0x526e0f8) returned 0x2 [0188.406] SysStringLen (param_1=0x0) returned 0x0 [0188.406] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5278158, puCount=0x19bd14 | out: puCount=0x19bd14*=0x2) returned 0x0 [0188.406] WbemDefPath:IWbemPath:GetText (in: This=0x5278158, lFlags=4, puBuffLength=0x19bd10*=0x0, pszText=0x0 | out: puBuffLength=0x19bd10*=0xf, pszText=0x0) returned 0x0 [0188.406] WbemDefPath:IWbemPath:GetText (in: This=0x5278158, lFlags=4, puBuffLength=0x19bd10*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd10*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0188.406] CoGetContextToken (in: pToken=0x19bb60 | out: pToken=0x19bb60) returned 0x0 [0188.406] IUnknown:AddRef (This=0x6d2650) returned 0x3 [0188.406] IEnumWbemClassObject:Clone (in: This=0x6d2650, ppEnum=0x19bd20 | out: ppEnum=0x19bd20*=0x6d2268) returned 0x0 [0188.407] IUnknown:QueryInterface (in: This=0x6d2268, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbdc | out: ppvObject=0x19bbdc*=0x6d226c) returned 0x0 [0188.407] IClientSecurity:QueryBlanket (in: This=0x6d226c, pProxy=0x6d2268, pAuthnSvc=0x19bc2c, pAuthzSvc=0x19bc28, pServerPrincName=0x19bc20, pAuthnLevel=0x19bc24, pImpLevel=0x19bc14, pAuthInfo=0x19bc18, pCapabilites=0x19bc1c | out: pAuthnSvc=0x19bc2c*=0xa, pAuthzSvc=0x19bc28*=0x0, pServerPrincName=0x19bc20, pAuthnLevel=0x19bc24*=0x6, pImpLevel=0x19bc14*=0x2, pAuthInfo=0x19bc18, pCapabilites=0x19bc1c*=0x1) returned 0x0 [0188.407] IUnknown:Release (This=0x6d226c) returned 0x1 [0188.407] IUnknown:QueryInterface (in: This=0x6d2268, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbd0 | out: ppvObject=0x19bbd0*=0x520cbe0) returned 0x0 [0188.407] IUnknown:QueryInterface (in: This=0x6d2268, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbbc | out: ppvObject=0x19bbbc*=0x6d226c) returned 0x0 [0188.408] IClientSecurity:SetBlanket (This=0x6d226c, pProxy=0x6d2268, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0188.409] IUnknown:Release (This=0x6d226c) returned 0x2 [0188.409] WbemLocator:IUnknown:Release (This=0x520cbe0) returned 0x1 [0188.409] CoTaskMemFree (pv=0x51f8978) [0188.409] IUnknown:QueryInterface (in: This=0x6d2268, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b7b8 | out: ppvObject=0x19b7b8*=0x520cbe0) returned 0x0 [0188.409] WbemLocator:IUnknown:QueryInterface (in: This=0x520cbe0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b774 | out: ppvObject=0x19b774*=0x0) returned 0x80004002 [0188.410] WbemLocator:IUnknown:QueryInterface (in: This=0x520cbe0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b594 | out: ppvObject=0x19b594*=0x0) returned 0x80004002 [0188.410] IUnknown:QueryInterface (in: This=0x6d2268, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b36c | out: ppvObject=0x19b36c*=0x0) returned 0x80004002 [0188.451] WbemLocator:IUnknown:AddRef (This=0x520cbe0) returned 0x3 [0188.451] WbemLocator:IUnknown:QueryInterface (in: This=0x520cbe0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b0cc | out: ppvObject=0x19b0cc*=0x0) returned 0x80004002 [0188.451] WbemLocator:IUnknown:QueryInterface (in: This=0x520cbe0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19b07c | out: ppvObject=0x19b07c*=0x0) returned 0x80004002 [0188.451] WbemLocator:IUnknown:QueryInterface (in: This=0x520cbe0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b088 | out: ppvObject=0x19b088*=0x520cb3c) returned 0x0 [0188.451] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520cb3c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b090 | out: pCid=0x19b090*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0188.451] WbemLocator:IUnknown:Release (This=0x520cb3c) returned 0x3 [0188.451] CoGetContextToken (in: pToken=0x19b0e8 | out: pToken=0x19b0e8) returned 0x0 [0188.451] CoGetContextToken (in: pToken=0x19b4f0 | out: pToken=0x19b4f0) returned 0x0 [0188.451] WbemLocator:IUnknown:QueryInterface (in: This=0x520cbe0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b57c | out: ppvObject=0x19b57c*=0x520cbc4) returned 0x0 [0188.451] WbemLocator:IRpcOptions:Query (in: This=0x520cbc4, pPrx=0x520cbe0, dwProperty=2, pdwValue=0x19b588 | out: pdwValue=0x19b588) returned 0x80004002 [0188.452] WbemLocator:IUnknown:Release (This=0x520cbc4) returned 0x3 [0188.452] WbemLocator:IUnknown:Release (This=0x520cbe0) returned 0x2 [0188.452] CoGetContextToken (in: pToken=0x19bac8 | out: pToken=0x19bac8) returned 0x0 [0188.452] CoGetContextToken (in: pToken=0x19ba28 | out: pToken=0x19ba28) returned 0x0 [0188.452] WbemLocator:IUnknown:QueryInterface (in: This=0x520cbe0, riid=0x19baf8*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19baf4 | out: ppvObject=0x19baf4*=0x6d2268) returned 0x0 [0188.452] IUnknown:AddRef (This=0x6d2268) returned 0x4 [0188.452] IUnknown:Release (This=0x6d2268) returned 0x3 [0188.452] IUnknown:Release (This=0x6d2268) returned 0x2 [0188.452] IUnknown:Release (This=0x6d2650) returned 0x2 [0188.452] SysStringLen (param_1=0x0) returned 0x0 [0188.452] IEnumWbemClassObject:Reset (This=0x6d2268) returned 0x0 [0188.455] CoTaskMemAlloc (cb=0x4) returned 0x51de838 [0188.456] IEnumWbemClassObject:Next (in: This=0x6d2268, lTimeout=-1, uCount=0x1, apObjects=0x51de838, puReturned=0x28556b8 | out: apObjects=0x51de838*=0x5252540, puReturned=0x28556b8*=0x1) returned 0x0 [0188.468] IUnknown:QueryInterface (in: This=0x5252540, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b378 | out: ppvObject=0x19b378*=0x5252540) returned 0x0 [0188.469] IUnknown:QueryInterface (in: This=0x5252540, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b334 | out: ppvObject=0x19b334*=0x0) returned 0x80004002 [0188.469] IUnknown:QueryInterface (in: This=0x5252540, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b154 | out: ppvObject=0x19b154*=0x0) returned 0x80004002 [0188.469] IUnknown:QueryInterface (in: This=0x5252540, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af2c | out: ppvObject=0x19af2c*=0x0) returned 0x80004002 [0188.469] IUnknown:AddRef (This=0x5252540) returned 0x3 [0188.469] IUnknown:QueryInterface (in: This=0x5252540, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac8c | out: ppvObject=0x19ac8c*=0x0) returned 0x80004002 [0188.469] IUnknown:QueryInterface (in: This=0x5252540, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac3c | out: ppvObject=0x19ac3c*=0x0) returned 0x80004002 [0188.469] IUnknown:QueryInterface (in: This=0x5252540, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac48 | out: ppvObject=0x19ac48*=0x5252544) returned 0x0 [0188.469] IMarshal:GetUnmarshalClass (in: This=0x5252544, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19ac50 | out: pCid=0x19ac50*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0188.469] IUnknown:Release (This=0x5252544) returned 0x3 [0188.469] CoGetContextToken (in: pToken=0x19aca8 | out: pToken=0x19aca8) returned 0x0 [0188.469] CoGetContextToken (in: pToken=0x19b0b0 | out: pToken=0x19b0b0) returned 0x0 [0188.469] IUnknown:QueryInterface (in: This=0x5252540, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b13c | out: ppvObject=0x19b13c*=0x0) returned 0x80004002 [0188.469] IUnknown:Release (This=0x5252540) returned 0x2 [0188.469] CoGetContextToken (in: pToken=0x19b688 | out: pToken=0x19b688) returned 0x0 [0188.469] CoGetContextToken (in: pToken=0x19b5e8 | out: pToken=0x19b5e8) returned 0x0 [0188.469] IUnknown:QueryInterface (in: This=0x5252540, riid=0x19b6b8*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b6b4 | out: ppvObject=0x19b6b4*=0x5252540) returned 0x0 [0188.470] IUnknown:AddRef (This=0x5252540) returned 0x4 [0188.470] IUnknown:Release (This=0x5252540) returned 0x3 [0188.470] IUnknown:Release (This=0x5252540) returned 0x2 [0188.470] CoTaskMemFree (pv=0x51de838) [0188.470] CoGetContextToken (in: pToken=0x19ba00 | out: pToken=0x19ba00) returned 0x0 [0188.470] IUnknown:AddRef (This=0x5252540) returned 0x3 [0188.470] IWbemClassObject:Get (in: This=0x5252540, wszName="__GENUS", lFlags=0, pVal=0x19bd10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd90*=0, plFlavor=0x19bd8c*=0 | out: pVal=0x19bd10*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd90*=3, plFlavor=0x19bd8c*=64) returned 0x0 [0188.470] IWbemClassObject:Get (in: This=0x5252540, wszName="__PATH", lFlags=0, pVal=0x19bcf4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd78*=0, plFlavor=0x19bd74*=0 | out: pVal=0x19bcf4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_VideoController.DeviceID=\"VideoController1\"", varVal2=0x0), pType=0x19bd78*=8, plFlavor=0x19bd74*=64) returned 0x0 [0188.470] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_VideoController.DeviceID=\"VideoController1\"") returned 0x8a [0188.470] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_VideoController.DeviceID=\"VideoController1\"") returned 0x8a [0188.470] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x334 [0188.470] SetEvent (hEvent=0x638) returned 1 [0188.470] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bccc*=0x334, lpdwindex=0x19baec | out: lpdwindex=0x19baec) returned 0x0 [0188.473] CoGetContextToken (in: pToken=0x19bb98 | out: pToken=0x19bb98) returned 0x0 [0188.473] CoGetContextToken (in: pToken=0x19baf8 | out: pToken=0x19baf8) returned 0x0 [0188.473] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277ac8, riid=0x19bbc8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bbc4 | out: ppvObject=0x19bbc4*=0x5277ac8) returned 0x0 [0188.473] WbemDefPath:IUnknown:AddRef (This=0x5277ac8) returned 0x3 [0188.473] WbemDefPath:IUnknown:Release (This=0x5277ac8) returned 0x2 [0188.473] WbemDefPath:IWbemPath:SetText (This=0x5277ac8, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_VideoController.DeviceID=\"VideoController1\"") returned 0x0 [0188.473] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5278158, puCount=0x19bd4c | out: puCount=0x19bd4c*=0x2) returned 0x0 [0188.473] WbemDefPath:IWbemPath:GetText (in: This=0x5278158, lFlags=4, puBuffLength=0x19bd48*=0x0, pszText=0x0 | out: puBuffLength=0x19bd48*=0xf, pszText=0x0) returned 0x0 [0188.473] WbemDefPath:IWbemPath:GetText (in: This=0x5278158, lFlags=4, puBuffLength=0x19bd48*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd48*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0188.473] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5278158, puCount=0x19bd18 | out: puCount=0x19bd18*=0x2) returned 0x0 [0188.473] WbemDefPath:IWbemPath:GetText (in: This=0x5278158, lFlags=4, puBuffLength=0x19bd14*=0x0, pszText=0x0 | out: puBuffLength=0x19bd14*=0xf, pszText=0x0) returned 0x0 [0188.473] WbemDefPath:IWbemPath:GetText (in: This=0x5278158, lFlags=4, puBuffLength=0x19bd14*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd14*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0188.473] IWbemClassObject:Get (in: This=0x5252540, wszName="AdapterRAM", lFlags=0, pVal=0x19bd14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2855f2c*=0, plFlavor=0x2855f30*=0 | out: pVal=0x19bd14*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2855f2c*=19, plFlavor=0x2855f30*=0) returned 0x0 [0188.473] IWbemClassObject:Get (in: This=0x5252540, wszName="AdapterRAM", lFlags=0, pVal=0x19bd1c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2855f2c*=19, plFlavor=0x2855f30*=0 | out: pVal=0x19bd1c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2855f2c*=19, plFlavor=0x2855f30*=0) returned 0x0 [0188.474] CoTaskMemAlloc (cb=0x4) returned 0x51de8d8 [0188.474] IEnumWbemClassObject:Next (in: This=0x6d2268, lTimeout=-1, uCount=0x1, apObjects=0x51de8d8, puReturned=0x28556b8 | out: apObjects=0x51de8d8*=0x0, puReturned=0x28556b8*=0x0) returned 0x1 [0188.475] CoTaskMemFree (pv=0x51de8d8) [0188.475] CoGetContextToken (in: pToken=0x19bc40 | out: pToken=0x19bc40) returned 0x0 [0188.475] WbemLocator:IUnknown:Release (This=0x520cbe0) returned 0x1 [0188.475] IUnknown:Release (This=0x6d2268) returned 0x0 [0188.477] CoGetContextToken (in: pToken=0x19bc40 | out: pToken=0x19bc40) returned 0x0 [0188.477] WbemLocator:IUnknown:Release (This=0x520bce0) returned 0x1 [0188.477] IUnknown:Release (This=0x6d2650) returned 0x0 [0188.504] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd44 | out: puCount=0x19bd44*=0x2) returned 0x0 [0188.504] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd40*=0x0, pszText=0x0 | out: puBuffLength=0x19bd40*=0xf, pszText=0x0) returned 0x0 [0188.505] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd40*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0188.513] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bbec*=0x2ec, lpdwindex=0x19ba9c | out: lpdwindex=0x19ba9c) returned 0x0 [0188.537] CoGetContextToken (in: pToken=0x19b9b0 | out: pToken=0x19b9b0) returned 0x0 [0188.537] CoGetContextToken (in: pToken=0x19b958 | out: pToken=0x19b958) returned 0x0 [0188.537] IUnknown:QueryInterface (in: This=0x66f9c0, riid=0x6f12da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b934 | out: ppvObject=0x19b934*=0x66f9d0) returned 0x0 [0188.538] CObjectContext::ContextCallback () returned 0x0 [0188.539] IUnknown:Release (This=0x66f9d0) returned 0x1 [0188.539] CoUnmarshalInterface (in: pStm=0x52097e0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19b9a4 | out: ppv=0x19b9a4*=0x520b2e0) returned 0x0 [0188.539] CoMarshalInterface (pStm=0x52097e0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x520b2e0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0188.539] WbemLocator:IUnknown:QueryInterface (in: This=0x520b2e0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b844 | out: ppvObject=0x19b844*=0x520b2e0) returned 0x0 [0188.540] WbemLocator:IUnknown:QueryInterface (in: This=0x520b2e0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b800 | out: ppvObject=0x19b800*=0x0) returned 0x80004002 [0188.540] WbemLocator:IUnknown:QueryInterface (in: This=0x520b2e0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b61c | out: ppvObject=0x19b61c*=0x0) returned 0x80004002 [0188.541] WbemLocator:IUnknown:QueryInterface (in: This=0x520b2e0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b3f4 | out: ppvObject=0x19b3f4*=0x0) returned 0x80004002 [0188.541] WbemLocator:IUnknown:AddRef (This=0x520b2e0) returned 0x3 [0188.541] WbemLocator:IUnknown:QueryInterface (in: This=0x520b2e0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b154 | out: ppvObject=0x19b154*=0x0) returned 0x80004002 [0188.541] WbemLocator:IUnknown:QueryInterface (in: This=0x520b2e0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19b104 | out: ppvObject=0x19b104*=0x0) returned 0x80004002 [0188.541] WbemLocator:IUnknown:QueryInterface (in: This=0x520b2e0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b110 | out: ppvObject=0x19b110*=0x520b23c) returned 0x0 [0188.541] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520b23c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b118 | out: pCid=0x19b118*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0188.541] WbemLocator:IUnknown:Release (This=0x520b23c) returned 0x3 [0188.541] CoGetContextToken (in: pToken=0x19b170 | out: pToken=0x19b170) returned 0x0 [0188.541] CoGetContextToken (in: pToken=0x19b578 | out: pToken=0x19b578) returned 0x0 [0188.541] WbemLocator:IUnknown:QueryInterface (in: This=0x520b2e0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b604 | out: ppvObject=0x19b604*=0x520b2c4) returned 0x0 [0188.542] WbemLocator:IRpcOptions:Query (in: This=0x520b2c4, pPrx=0x520b2e0, dwProperty=2, pdwValue=0x19b610 | out: pdwValue=0x19b610) returned 0x0 [0188.542] WbemLocator:IUnknown:Release (This=0x520b2c4) returned 0x3 [0188.542] WbemLocator:IUnknown:Release (This=0x520b2e0) returned 0x2 [0188.542] WbemLocator:IUnknown:Release (This=0x520b2e0) returned 0x1 [0188.542] CoGetContextToken (in: pToken=0x19b8f0 | out: pToken=0x19b8f0) returned 0x0 [0188.542] WbemLocator:IUnknown:AddRef (This=0x520b2e0) returned 0x2 [0188.542] WbemLocator:IUnknown:QueryInterface (in: This=0x520b2e0, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bba4 | out: ppvObject=0x19bba4*=0x520b2bc) returned 0x0 [0188.542] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x520b2bc, pProxy=0x520b2e0, pAuthnSvc=0x19bbf4, pAuthzSvc=0x19bbf0, pServerPrincName=0x19bbe8, pAuthnLevel=0x19bbec, pImpLevel=0x19bbdc, pAuthInfo=0x19bbe0, pCapabilites=0x19bbe4 | out: pAuthnSvc=0x19bbf4*=0xa, pAuthzSvc=0x19bbf0*=0x0, pServerPrincName=0x19bbe8, pAuthnLevel=0x19bbec*=0x6, pImpLevel=0x19bbdc*=0x2, pAuthInfo=0x19bbe0, pCapabilites=0x19bbe4*=0x1) returned 0x0 [0188.542] WbemLocator:IUnknown:Release (This=0x520b2bc) returned 0x2 [0188.542] WbemLocator:IUnknown:QueryInterface (in: This=0x520b2e0, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb98 | out: ppvObject=0x19bb98*=0x520b2e0) returned 0x0 [0188.542] WbemLocator:IUnknown:QueryInterface (in: This=0x520b2e0, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb84 | out: ppvObject=0x19bb84*=0x520b2bc) returned 0x0 [0188.542] WbemLocator:IClientSecurity:SetBlanket (This=0x520b2bc, pProxy=0x520b2e0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0188.542] WbemLocator:IUnknown:Release (This=0x520b2bc) returned 0x3 [0188.543] WbemLocator:IUnknown:Release (This=0x520b2e0) returned 0x2 [0188.543] CoTaskMemFree (pv=0x51f8ac8) [0188.543] WbemLocator:IUnknown:Release (This=0x520b2e0) returned 0x1 [0188.543] SysStringLen (param_1=0x0) returned 0x0 [0188.543] CoGetContextToken (in: pToken=0x19bb60 | out: pToken=0x19bb60) returned 0x0 [0188.543] CoGetContextToken (in: pToken=0x19bac0 | out: pToken=0x19bac0) returned 0x0 [0188.543] WbemLocator:IUnknown:QueryInterface (in: This=0x520b2e0, riid=0x19bb90*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19bb8c | out: ppvObject=0x19bb8c*=0x526e198) returned 0x0 [0188.543] WbemLocator:IUnknown:AddRef (This=0x526e198) returned 0x3 [0188.543] WbemLocator:IUnknown:Release (This=0x526e198) returned 0x2 [0188.543] CoGetContextToken (in: pToken=0x19bb20 | out: pToken=0x19bb20) returned 0x0 [0188.544] WbemLocator:IUnknown:AddRef (This=0x526e198) returned 0x3 [0188.544] WbemLocator:IUnknown:QueryInterface (in: This=0x526e198, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bba4 | out: ppvObject=0x19bba4*=0x520b2bc) returned 0x0 [0188.544] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x520b2bc, pProxy=0x526e198, pAuthnSvc=0x19bbf4, pAuthzSvc=0x19bbf0, pServerPrincName=0x19bbe8, pAuthnLevel=0x19bbec, pImpLevel=0x19bbdc, pAuthInfo=0x19bbe0, pCapabilites=0x19bbe4 | out: pAuthnSvc=0x19bbf4*=0xa, pAuthzSvc=0x19bbf0*=0x0, pServerPrincName=0x19bbe8, pAuthnLevel=0x19bbec*=0x6, pImpLevel=0x19bbdc*=0x2, pAuthInfo=0x19bbe0, pCapabilites=0x19bbe4*=0x1) returned 0x0 [0188.544] WbemLocator:IUnknown:Release (This=0x520b2bc) returned 0x3 [0188.544] WbemLocator:IUnknown:QueryInterface (in: This=0x526e198, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb98 | out: ppvObject=0x19bb98*=0x520b2e0) returned 0x0 [0188.544] WbemLocator:IUnknown:QueryInterface (in: This=0x526e198, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb84 | out: ppvObject=0x19bb84*=0x520b2bc) returned 0x0 [0188.544] WbemLocator:IClientSecurity:SetBlanket (This=0x520b2bc, pProxy=0x526e198, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0188.544] WbemLocator:IUnknown:Release (This=0x520b2bc) returned 0x4 [0188.544] WbemLocator:IUnknown:Release (This=0x520b2e0) returned 0x3 [0188.544] CoTaskMemFree (pv=0x51f8e28) [0188.545] WbemLocator:IUnknown:Release (This=0x526e198) returned 0x2 [0188.545] SysStringLen (param_1=0x0) returned 0x0 [0188.545] CoGetContextToken (in: pToken=0x19ba98 | out: pToken=0x19ba98) returned 0x0 [0188.545] WbemLocator:IUnknown:AddRef (This=0x526e198) returned 0x3 [0188.545] IWbemServices:ExecQuery (in: This=0x526e198, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_OperatingSystem", lFlags=16, pCtx=0x0, ppEnum=0x19bcb4 | out: ppEnum=0x19bcb4*=0x6d2330) returned 0x0 [0188.584] IUnknown:QueryInterface (in: This=0x6d2330, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bb04 | out: ppvObject=0x19bb04*=0x6d2334) returned 0x0 [0188.584] IClientSecurity:QueryBlanket (in: This=0x6d2334, pProxy=0x6d2330, pAuthnSvc=0x19bb54, pAuthzSvc=0x19bb50, pServerPrincName=0x19bb48, pAuthnLevel=0x19bb4c, pImpLevel=0x19bb3c, pAuthInfo=0x19bb40, pCapabilites=0x19bb44 | out: pAuthnSvc=0x19bb54*=0xa, pAuthzSvc=0x19bb50*=0x0, pServerPrincName=0x19bb48, pAuthnLevel=0x19bb4c*=0x6, pImpLevel=0x19bb3c*=0x2, pAuthInfo=0x19bb40, pCapabilites=0x19bb44*=0x1) returned 0x0 [0188.584] IUnknown:Release (This=0x6d2334) returned 0x1 [0188.584] IUnknown:QueryInterface (in: This=0x6d2330, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19baf8 | out: ppvObject=0x19baf8*=0x520c6e0) returned 0x0 [0188.584] IUnknown:QueryInterface (in: This=0x6d2330, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bae4 | out: ppvObject=0x19bae4*=0x6d2334) returned 0x0 [0188.584] IClientSecurity:SetBlanket (This=0x6d2334, pProxy=0x6d2330, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0188.586] IUnknown:Release (This=0x6d2334) returned 0x2 [0188.586] WbemLocator:IUnknown:Release (This=0x520c6e0) returned 0x1 [0188.586] CoTaskMemFree (pv=0x51f8e28) [0188.586] IUnknown:QueryInterface (in: This=0x6d2330, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b6f0 | out: ppvObject=0x19b6f0*=0x520c6e0) returned 0x0 [0188.587] WbemLocator:IUnknown:QueryInterface (in: This=0x520c6e0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b6ac | out: ppvObject=0x19b6ac*=0x0) returned 0x80004002 [0188.588] WbemLocator:IUnknown:QueryInterface (in: This=0x520c6e0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b4cc | out: ppvObject=0x19b4cc*=0x0) returned 0x80004002 [0188.588] IUnknown:QueryInterface (in: This=0x6d2330, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b2a4 | out: ppvObject=0x19b2a4*=0x0) returned 0x80004002 [0188.589] WbemLocator:IUnknown:AddRef (This=0x520c6e0) returned 0x3 [0188.589] WbemLocator:IUnknown:QueryInterface (in: This=0x520c6e0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b004 | out: ppvObject=0x19b004*=0x0) returned 0x80004002 [0188.589] WbemLocator:IUnknown:QueryInterface (in: This=0x520c6e0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19afb4 | out: ppvObject=0x19afb4*=0x0) returned 0x80004002 [0188.589] WbemLocator:IUnknown:QueryInterface (in: This=0x520c6e0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19afc0 | out: ppvObject=0x19afc0*=0x520c63c) returned 0x0 [0188.589] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520c63c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19afc8 | out: pCid=0x19afc8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0188.589] WbemLocator:IUnknown:Release (This=0x520c63c) returned 0x3 [0188.589] CoGetContextToken (in: pToken=0x19b020 | out: pToken=0x19b020) returned 0x0 [0188.589] CoGetContextToken (in: pToken=0x19b428 | out: pToken=0x19b428) returned 0x0 [0188.589] WbemLocator:IUnknown:QueryInterface (in: This=0x520c6e0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b4b4 | out: ppvObject=0x19b4b4*=0x520c6c4) returned 0x0 [0188.589] WbemLocator:IRpcOptions:Query (in: This=0x520c6c4, pPrx=0x520c6e0, dwProperty=2, pdwValue=0x19b4c0 | out: pdwValue=0x19b4c0) returned 0x80004002 [0188.589] WbemLocator:IUnknown:Release (This=0x520c6c4) returned 0x3 [0188.589] WbemLocator:IUnknown:Release (This=0x520c6e0) returned 0x2 [0188.590] CoGetContextToken (in: pToken=0x19ba00 | out: pToken=0x19ba00) returned 0x0 [0188.590] CoGetContextToken (in: pToken=0x19b960 | out: pToken=0x19b960) returned 0x0 [0188.590] WbemLocator:IUnknown:QueryInterface (in: This=0x520c6e0, riid=0x19ba30*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19ba2c | out: ppvObject=0x19ba2c*=0x6d2330) returned 0x0 [0188.590] IUnknown:AddRef (This=0x6d2330) returned 0x4 [0188.590] IUnknown:Release (This=0x6d2330) returned 0x3 [0188.590] IUnknown:Release (This=0x6d2330) returned 0x2 [0188.590] WbemLocator:IUnknown:Release (This=0x526e198) returned 0x2 [0188.590] SysStringLen (param_1=0x0) returned 0x0 [0188.590] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd00 | out: puCount=0x19bd00*=0x2) returned 0x0 [0188.590] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcfc*=0x0, pszText=0x0 | out: puBuffLength=0x19bcfc*=0xf, pszText=0x0) returned 0x0 [0188.590] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bcfc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bcfc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0188.590] CoGetContextToken (in: pToken=0x19bb50 | out: pToken=0x19bb50) returned 0x0 [0188.590] IUnknown:AddRef (This=0x6d2330) returned 0x3 [0188.590] IEnumWbemClassObject:Clone (in: This=0x6d2330, ppEnum=0x19bd0c | out: ppEnum=0x19bd0c*=0x6d2268) returned 0x0 [0188.591] IUnknown:QueryInterface (in: This=0x6d2268, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbc8 | out: ppvObject=0x19bbc8*=0x6d226c) returned 0x0 [0188.591] IClientSecurity:QueryBlanket (in: This=0x6d226c, pProxy=0x6d2268, pAuthnSvc=0x19bc18, pAuthzSvc=0x19bc14, pServerPrincName=0x19bc0c, pAuthnLevel=0x19bc10, pImpLevel=0x19bc00, pAuthInfo=0x19bc04, pCapabilites=0x19bc08 | out: pAuthnSvc=0x19bc18*=0xa, pAuthzSvc=0x19bc14*=0x0, pServerPrincName=0x19bc0c, pAuthnLevel=0x19bc10*=0x6, pImpLevel=0x19bc00*=0x2, pAuthInfo=0x19bc04, pCapabilites=0x19bc08*=0x1) returned 0x0 [0188.591] IUnknown:Release (This=0x6d226c) returned 0x1 [0188.592] IUnknown:QueryInterface (in: This=0x6d2268, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bbbc | out: ppvObject=0x19bbbc*=0x520cce0) returned 0x0 [0188.592] IUnknown:QueryInterface (in: This=0x6d2268, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19bba8 | out: ppvObject=0x19bba8*=0x6d226c) returned 0x0 [0188.592] IClientSecurity:SetBlanket (This=0x6d226c, pProxy=0x6d2268, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0188.593] IUnknown:Release (This=0x6d226c) returned 0x2 [0188.593] WbemLocator:IUnknown:Release (This=0x520cce0) returned 0x1 [0188.593] CoTaskMemFree (pv=0x51f8b58) [0188.594] IUnknown:QueryInterface (in: This=0x6d2268, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b7a4 | out: ppvObject=0x19b7a4*=0x520cce0) returned 0x0 [0188.594] WbemLocator:IUnknown:QueryInterface (in: This=0x520cce0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b760 | out: ppvObject=0x19b760*=0x0) returned 0x80004002 [0188.594] WbemLocator:IUnknown:QueryInterface (in: This=0x520cce0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b57c | out: ppvObject=0x19b57c*=0x0) returned 0x80004002 [0188.595] IUnknown:QueryInterface (in: This=0x6d2268, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19b354 | out: ppvObject=0x19b354*=0x0) returned 0x80004002 [0188.595] WbemLocator:IUnknown:AddRef (This=0x520cce0) returned 0x3 [0188.595] WbemLocator:IUnknown:QueryInterface (in: This=0x520cce0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19b0b4 | out: ppvObject=0x19b0b4*=0x0) returned 0x80004002 [0188.595] WbemLocator:IUnknown:QueryInterface (in: This=0x520cce0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19b064 | out: ppvObject=0x19b064*=0x0) returned 0x80004002 [0188.595] WbemLocator:IUnknown:QueryInterface (in: This=0x520cce0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b070 | out: ppvObject=0x19b070*=0x520cc3c) returned 0x0 [0188.596] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520cc3c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19b078 | out: pCid=0x19b078*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0188.596] WbemLocator:IUnknown:Release (This=0x520cc3c) returned 0x3 [0188.596] CoGetContextToken (in: pToken=0x19b0d0 | out: pToken=0x19b0d0) returned 0x0 [0188.596] CoGetContextToken (in: pToken=0x19b4d8 | out: pToken=0x19b4d8) returned 0x0 [0188.596] WbemLocator:IUnknown:QueryInterface (in: This=0x520cce0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b564 | out: ppvObject=0x19b564*=0x520ccc4) returned 0x0 [0188.596] WbemLocator:IRpcOptions:Query (in: This=0x520ccc4, pPrx=0x520cce0, dwProperty=2, pdwValue=0x19b570 | out: pdwValue=0x19b570) returned 0x80004002 [0188.596] WbemLocator:IUnknown:Release (This=0x520ccc4) returned 0x3 [0188.596] WbemLocator:IUnknown:Release (This=0x520cce0) returned 0x2 [0188.596] CoGetContextToken (in: pToken=0x19bab8 | out: pToken=0x19bab8) returned 0x0 [0188.596] CoGetContextToken (in: pToken=0x19ba18 | out: pToken=0x19ba18) returned 0x0 [0188.596] WbemLocator:IUnknown:QueryInterface (in: This=0x520cce0, riid=0x19bae8*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19bae4 | out: ppvObject=0x19bae4*=0x6d2268) returned 0x0 [0188.596] IUnknown:AddRef (This=0x6d2268) returned 0x4 [0188.596] IUnknown:Release (This=0x6d2268) returned 0x3 [0188.596] IUnknown:Release (This=0x6d2268) returned 0x2 [0188.596] IUnknown:Release (This=0x6d2330) returned 0x2 [0188.596] SysStringLen (param_1=0x0) returned 0x0 [0188.596] IEnumWbemClassObject:Reset (This=0x6d2268) returned 0x0 [0188.635] CoTaskMemAlloc (cb=0x4) returned 0x51de918 [0188.635] IEnumWbemClassObject:Next (in: This=0x6d2268, lTimeout=-1, uCount=0x1, apObjects=0x51de918, puReturned=0x2856cd4 | out: apObjects=0x51de918*=0x5252870, puReturned=0x2856cd4*=0x1) returned 0x0 [0188.694] IUnknown:QueryInterface (in: This=0x5252870, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b368 | out: ppvObject=0x19b368*=0x5252870) returned 0x0 [0188.695] IUnknown:QueryInterface (in: This=0x5252870, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19b324 | out: ppvObject=0x19b324*=0x0) returned 0x80004002 [0188.695] IUnknown:QueryInterface (in: This=0x5252870, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19b144 | out: ppvObject=0x19b144*=0x0) returned 0x80004002 [0188.695] IUnknown:QueryInterface (in: This=0x5252870, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19af1c | out: ppvObject=0x19af1c*=0x0) returned 0x80004002 [0188.695] IUnknown:AddRef (This=0x5252870) returned 0x3 [0188.695] IUnknown:QueryInterface (in: This=0x5252870, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19ac7c | out: ppvObject=0x19ac7c*=0x0) returned 0x80004002 [0188.695] IUnknown:QueryInterface (in: This=0x5252870, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19ac2c | out: ppvObject=0x19ac2c*=0x0) returned 0x80004002 [0188.695] IUnknown:QueryInterface (in: This=0x5252870, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ac38 | out: ppvObject=0x19ac38*=0x5252874) returned 0x0 [0188.696] IMarshal:GetUnmarshalClass (in: This=0x5252874, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19ac40 | out: pCid=0x19ac40*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0188.696] IUnknown:Release (This=0x5252874) returned 0x3 [0188.696] CoGetContextToken (in: pToken=0x19ac98 | out: pToken=0x19ac98) returned 0x0 [0188.697] CoGetContextToken (in: pToken=0x19b0a0 | out: pToken=0x19b0a0) returned 0x0 [0188.697] IUnknown:QueryInterface (in: This=0x5252870, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19b12c | out: ppvObject=0x19b12c*=0x0) returned 0x80004002 [0188.697] IUnknown:Release (This=0x5252870) returned 0x2 [0188.697] CoGetContextToken (in: pToken=0x19b678 | out: pToken=0x19b678) returned 0x0 [0188.697] CoGetContextToken (in: pToken=0x19b5d8 | out: pToken=0x19b5d8) returned 0x0 [0188.697] IUnknown:QueryInterface (in: This=0x5252870, riid=0x19b6a8*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19b6a4 | out: ppvObject=0x19b6a4*=0x5252870) returned 0x0 [0188.697] IUnknown:AddRef (This=0x5252870) returned 0x4 [0188.697] IUnknown:Release (This=0x5252870) returned 0x3 [0188.698] IUnknown:Release (This=0x5252870) returned 0x2 [0188.698] CoTaskMemFree (pv=0x51de918) [0188.698] CoGetContextToken (in: pToken=0x19b9e8 | out: pToken=0x19b9e8) returned 0x0 [0188.698] IUnknown:AddRef (This=0x5252870) returned 0x3 [0188.698] IWbemClassObject:Get (in: This=0x5252870, wszName="__GENUS", lFlags=0, pVal=0x19bcfc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd7c*=0, plFlavor=0x19bd78*=0 | out: pVal=0x19bcfc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19bd7c*=3, plFlavor=0x19bd78*=64) returned 0x0 [0188.698] IWbemClassObject:Get (in: This=0x5252870, wszName="__PATH", lFlags=0, pVal=0x19bce0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19bd64*=0, plFlavor=0x19bd60*=0 | out: pVal=0x19bce0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"", varVal2=0x0), pType=0x19bd64*=8, plFlavor=0x19bd60*=64) returned 0x0 [0188.698] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0188.698] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0188.699] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x648 [0188.699] SetEvent (hEvent=0x638) returned 1 [0188.699] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19bcb8*=0x648, lpdwindex=0x19bad4 | out: lpdwindex=0x19bad4) returned 0x0 [0188.706] CoGetContextToken (in: pToken=0x19bb88 | out: pToken=0x19bb88) returned 0x0 [0188.706] CoGetContextToken (in: pToken=0x19bae8 | out: pToken=0x19bae8) returned 0x0 [0188.706] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277c18, riid=0x19bbb8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19bbb4 | out: ppvObject=0x19bbb4*=0x5277c18) returned 0x0 [0188.706] WbemDefPath:IUnknown:AddRef (This=0x5277c18) returned 0x3 [0188.707] WbemDefPath:IUnknown:Release (This=0x5277c18) returned 0x2 [0188.707] WbemDefPath:IWbemPath:SetText (This=0x5277c18, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x0 [0188.707] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd38 | out: puCount=0x19bd38*=0x2) returned 0x0 [0188.707] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd34*=0x0, pszText=0x0 | out: puBuffLength=0x19bd34*=0xf, pszText=0x0) returned 0x0 [0188.707] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd34*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd34*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0188.707] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x19bd04 | out: puCount=0x19bd04*=0x2) returned 0x0 [0188.707] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd00*=0x0, pszText=0x0 | out: puBuffLength=0x19bd00*=0xf, pszText=0x0) returned 0x0 [0188.707] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=4, puBuffLength=0x19bd00*=0xf, pszText="00000000000000" | out: puBuffLength=0x19bd00*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0188.707] IWbemClassObject:Get (in: This=0x5252870, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x19bd00*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28575a4*=0, plFlavor=0x28575a8*=0 | out: pVal=0x19bd00*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x28575a4*=21, plFlavor=0x28575a8*=0) returned 0x0 [0188.707] SysStringByteLen (bstr="2096620") returned 0xe [0188.707] SysStringByteLen (bstr="2096620") returned 0xe [0188.708] IWbemClassObject:Get (in: This=0x5252870, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x19bd08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28575a4*=21, plFlavor=0x28575a8*=0 | out: pVal=0x19bd08*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x28575a4*=21, plFlavor=0x28575a8*=0) returned 0x0 [0188.708] SysStringByteLen (bstr="2096620") returned 0xe [0188.708] SysStringByteLen (bstr="2096620") returned 0xe [0188.714] CoTaskMemAlloc (cb=0x4) returned 0x51de958 [0188.714] IEnumWbemClassObject:Next (in: This=0x6d2268, lTimeout=-1, uCount=0x1, apObjects=0x51de958, puReturned=0x2856cd4 | out: apObjects=0x51de958*=0x0, puReturned=0x2856cd4*=0x0) returned 0x1 [0188.715] CoTaskMemFree (pv=0x51de958) [0188.716] CoGetContextToken (in: pToken=0x19bc30 | out: pToken=0x19bc30) returned 0x0 [0188.716] WbemLocator:IUnknown:Release (This=0x520cce0) returned 0x1 [0188.716] IUnknown:Release (This=0x6d2268) returned 0x0 [0188.722] CoGetContextToken (in: pToken=0x19bc30 | out: pToken=0x19bc30) returned 0x0 [0188.722] WbemLocator:IUnknown:Release (This=0x520c6e0) returned 0x1 [0188.722] IUnknown:Release (This=0x6d2330) returned 0x0 [0188.738] CoCreateGuid (in: pguid=0x19ba80 | out: pguid=0x19ba80*(Data1=0xb7f37aeb, Data2=0xa204, Data3=0x4e0a, Data4=([0]=0x9f, [1]=0x44, [2]=0xf9, [3]=0x35, [4]=0xf9, [5]=0xb5, [6]=0xd1, [7]=0x93))) returned 0x0 [0188.738] CoCreateGuid (in: pguid=0x19b9c0 | out: pguid=0x19b9c0*(Data1=0x5065993, Data2=0x2f28, Data3=0x4911, Data4=([0]=0x80, [1]=0xca, [2]=0x6b, [3]=0xb6, [4]=0x5c, [5]=0x27, [6]=0xe8, [7]=0xb3))) returned 0x0 [0189.175] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\XML", ulOptions=0x0, samDesired=0x20019, phkResult=0x19a95c | out: phkResult=0x19a95c*=0x0) returned 0x2 [0189.176] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\XML", ulOptions=0x0, samDesired=0x20019, phkResult=0x19a95c | out: phkResult=0x19a95c*=0x0) returned 0x2 [0189.346] send (s=0x360, buf=0x38e99dd*, len=65536, flags=0) returned 65536 [0189.349] send (s=0x360, buf=0x38f99dd*, len=65536, flags=0) returned 65536 [0194.244] send (s=0x360, buf=0x39099dd*, len=65536, flags=0) returned 65536 [0198.041] send (s=0x360, buf=0x39199dd*, len=65536, flags=0) returned 65536 [0202.249] send (s=0x360, buf=0x39299dd*, len=65536, flags=0) returned 65536 [0206.136] send (s=0x360, buf=0x39399dd*, len=65536, flags=0) returned 65536 [0210.480] send (s=0x360, buf=0x39499dd*, len=65536, flags=0) returned 65536 [0214.450] send (s=0x360, buf=0x39599dd*, len=53770, flags=0) returned 53770 [0218.794] recv (in: s=0x360, buf=0x26e19a4, len=8192, flags=0 | out: buf=0x26e19a4*) returned 108 [0222.888] HeapFree (in: hHeap=0x1f0000, dwFlags=0x0, lpMem=0x1f0fe8 | out: hHeap=0x1f0000) returned 1 [0222.888] HeapFree (in: hHeap=0x1f0000, dwFlags=0x0, lpMem=0x1f0fd0 | out: hHeap=0x1f0000) returned 1 [0222.920] HeapFree (in: hHeap=0x1f0000, dwFlags=0x0, lpMem=0x1f1f50 | out: hHeap=0x1f0000) returned 1 [0222.921] GetModuleHandleW (lpModuleName="mscoree.dll") returned 0x6f780000 [0222.921] GetProcAddress (hModule=0x6f780000, lpProcName="CorExitProcess") returned 0x6f7a98e0 [0222.929] CoGetContextToken (in: pToken=0x19caa8 | out: pToken=0x19caa8) returned 0x0 [0222.929] IUnknown:QueryInterface (in: This=0x66f908, riid=0x6f1138a4*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19cacc | out: ppvObject=0x19cacc*=0x66f914) returned 0x0 [0222.930] IComThreadingInfo:GetCurrentThreadType (in: This=0x66f914, pThreadType=0x19cb2c | out: pThreadType=0x19cb2c*=1) returned 0x0 [0222.930] IUnknown:Release (This=0x66f914) returned 0x1 [0222.931] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x13880, cHandles=0x1, pHandles=0x674d98*=0x16c, lpdwindex=0x19c94c | out: lpdwindex=0x19c94c) returned 0x0 [0223.163] CoGetContextToken (in: pToken=0x19b8d4 | out: pToken=0x19b8d4) returned 0x0 [0223.163] CoGetContextToken (in: pToken=0x19b8b4 | out: pToken=0x19b8b4) returned 0x0 [0223.163] CoGetContextToken (in: pToken=0x19b838 | out: pToken=0x19b838) returned 0x0 [0223.163] IUnknown:Release (This=0x5251880) returned 0x1 [0223.163] IUnknown:Release (This=0x5251880) returned 0x0 [0223.163] CoGetContextToken (in: pToken=0x19b838 | out: pToken=0x19b838) returned 0x0 [0223.163] IUnknown:Release (This=0x5252210) returned 0x1 [0223.163] IUnknown:Release (This=0x5252210) returned 0x0 [0223.163] CoGetContextToken (in: pToken=0x19b838 | out: pToken=0x19b838) returned 0x0 [0223.163] IUnknown:Release (This=0x5252078) returned 0x1 [0223.163] IUnknown:Release (This=0x5252078) returned 0x0 [0223.163] CoGetContextToken (in: pToken=0x19b838 | out: pToken=0x19b838) returned 0x0 [0223.163] WbemLocator:IUnknown:Release (This=0x520b2e0) returned 0x1 [0223.163] WbemLocator:IUnknown:Release (This=0x526e198) returned 0x0 [0223.164] CoGetContextToken (in: pToken=0x19b838 | out: pToken=0x19b838) returned 0x0 [0223.164] IUnknown:Release (This=0x52513b8) returned 0x1 [0223.164] IUnknown:Release (This=0x52513b8) returned 0x0 [0223.164] CoGetContextToken (in: pToken=0x19b838 | out: pToken=0x19b838) returned 0x0 [0223.164] IUnknown:Release (This=0x5252870) returned 0x1 [0223.164] IUnknown:Release (This=0x5252870) returned 0x0 [0223.164] CoGetContextToken (in: pToken=0x19b838 | out: pToken=0x19b838) returned 0x0 [0223.164] IUnknown:Release (This=0x5251a18) returned 0x1 [0223.164] IUnknown:Release (This=0x5251a18) returned 0x0 [0223.164] CoGetContextToken (in: pToken=0x19b838 | out: pToken=0x19b838) returned 0x0 [0223.164] WbemLocator:IUnknown:Release (This=0x520cae0) returned 0x1 [0223.164] WbemLocator:IUnknown:Release (This=0x526e5f8) returned 0x0 [0223.165] CoGetContextToken (in: pToken=0x19b838 | out: pToken=0x19b838) returned 0x0 [0223.165] IUnknown:Release (This=0x5251bb0) returned 0x1 [0223.165] IUnknown:Release (This=0x5251bb0) returned 0x0 [0223.165] CoGetContextToken (in: pToken=0x19b838 | out: pToken=0x19b838) returned 0x0 [0223.165] IUnknown:Release (This=0x5251550) returned 0x1 [0223.165] IUnknown:Release (This=0x5251550) returned 0x0 [0223.165] CoGetContextToken (in: pToken=0x19b838 | out: pToken=0x19b838) returned 0x0 [0223.165] IUnknown:Release (This=0x5252ba0) returned 0x1 [0223.165] IUnknown:Release (This=0x5252ba0) returned 0x0 [0223.165] CoGetContextToken (in: pToken=0x19b838 | out: pToken=0x19b838) returned 0x0 [0223.165] IUnknown:Release (This=0x5251d48) returned 0x1 [0223.165] IUnknown:Release (This=0x5251d48) returned 0x0 [0223.165] CoGetContextToken (in: pToken=0x19b838 | out: pToken=0x19b838) returned 0x0 [0223.165] IUnknown:Release (This=0x5251220) returned 0x1 [0223.165] IUnknown:Release (This=0x5251220) returned 0x0 [0223.166] CoGetContextToken (in: pToken=0x19b838 | out: pToken=0x19b838) returned 0x0 [0223.166] IUnknown:Release (This=0x5252540) returned 0x1 [0223.166] IUnknown:Release (This=0x5252540) returned 0x0 [0223.166] CoGetContextToken (in: pToken=0x19b838 | out: pToken=0x19b838) returned 0x0 [0223.166] WbemLocator:IUnknown:Release (This=0x520c5e0) returned 0x1 [0223.166] WbemLocator:IUnknown:Release (This=0x526e0f8) returned 0x0 [0223.166] CoGetContextToken (in: pToken=0x19b838 | out: pToken=0x19b838) returned 0x0 [0223.166] IUnknown:Release (This=0x52516e8) returned 0x1 [0223.166] IUnknown:Release (This=0x52516e8) returned 0x0 [0223.166] CoGetContextToken (in: pToken=0x19b838 | out: pToken=0x19b838) returned 0x0 [0223.167] IUnknown:Release (This=0x5251ee0) returned 0x1 [0223.167] IUnknown:Release (This=0x5251ee0) returned 0x0 [0223.176] HeapFree (in: hHeap=0x1f0000, dwFlags=0x0, lpMem=0x1f05a8 | out: hHeap=0x1f0000) returned 1 [0223.262] TerminateProcess (hProcess=0xffffffff, uExitCode=0x0) Thread: id = 2 os_tid = 0x11d4 Thread: id = 3 os_tid = 0x1260 Thread: id = 4 os_tid = 0x1284 Thread: id = 5 os_tid = 0x1288 [0108.765] CoGetContextToken (in: pToken=0x259fc74 | out: pToken=0x259fc74) returned 0x800401f0 [0108.765] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0108.766] RoInitialize () returned 0x1 [0108.766] RoUninitialize () returned 0x0 [0171.114] CoGetContextToken (in: pToken=0x259fc60 | out: pToken=0x259fc60) returned 0x0 [0171.114] CoGetContextToken (in: pToken=0x259fbe0 | out: pToken=0x259fbe0) returned 0x0 [0171.114] WbemLocator:IUnknown:Release (This=0x51dea08) returned 0x1 [0171.114] WbemLocator:IUnknown:Release (This=0x51dea08) returned 0x0 [0171.114] CoGetContextToken (in: pToken=0x259fc60 | out: pToken=0x259fc60) returned 0x0 [0171.114] IUnknown:QueryInterface (in: This=0x66f908, riid=0x6f12da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x259fc04 | out: ppvObject=0x259fc04*=0x66f918) returned 0x0 [0171.114] CObjectContext::ContextCallback () returned 0x0 [0173.012] IUnknown:Release (This=0x66f918) returned 0x1 [0173.012] IUnknown:Release (This=0x66f908) returned 0x0 [0173.012] IUnknown:Release (This=0x51cfff0) returned 0x0 [0173.014] CloseHandle (hObject=0x4c4) returned 1 [0173.015] CloseHandle (hObject=0x4c0) returned 1 [0173.015] CloseHandle (hObject=0x494) returned 1 [0173.015] CloseHandle (hObject=0x488) returned 1 [0173.016] CertFreeCertificateContext (pCertContext=0x724cc0) returned 1 [0173.016] CloseHandle (hObject=0x3c0) returned 1 [0173.016] CloseHandle (hObject=0x3bc) returned 1 [0173.016] CloseHandle (hObject=0x3b8) returned 1 [0173.016] CertFreeCertificateContext (pCertContext=0x724900) returned 1 [0173.017] CloseHandle (hObject=0x3ac) returned 1 [0173.017] CloseHandle (hObject=0x3b4) returned 1 [0173.017] CloseHandle (hObject=0x558) returned 1 [0173.017] CertFreeCertificateContext (pCertContext=0x724e50) returned 1 [0173.017] CloseHandle (hObject=0x368) returned 1 [0173.018] CloseHandle (hObject=0x364) returned 1 [0173.018] RegCloseKey (hKey=0x71c) returned 0x0 [0173.018] CloseHandle (hObject=0x6ec) returned 1 [0173.018] CloseHandle (hObject=0x334) returned 1 [0173.018] CloseHandle (hObject=0x330) returned 1 [0173.019] CloseHandle (hObject=0x648) returned 1 [0173.019] CloseHandle (hObject=0x2f8) returned 1 [0173.019] CloseHandle (hObject=0x2f4) returned 1 [0173.020] CloseHandle (hObject=0x2f0) returned 1 [0173.020] CertCloseStore (hCertStore=0x6f7ed0, dwFlags=0x0) returned 1 [0173.020] CloseHandle (hObject=0x2ec) returned 1 [0173.020] CloseHandle (hObject=0x2e8) returned 1 [0173.021] CloseHandle (hObject=0x2e4) returned 1 [0173.021] CloseHandle (hObject=0x2e0) returned 1 [0173.021] CertFreeCertificateContext (pCertContext=0x724e50) returned 1 [0173.021] CloseHandle (hObject=0x2dc) returned 1 [0173.021] CloseHandle (hObject=0x2d8) returned 1 [0173.022] CloseHandle (hObject=0x2d4) returned 1 [0173.022] RegCloseKey (hKey=0x720) returned 0x0 [0173.022] CloseHandle (hObject=0x2d0) returned 1 [0173.022] CertFreeCertificateContext (pCertContext=0x724ef0) returned 1 [0173.022] CloseHandle (hObject=0x2c8) returned 1 [0181.792] CoGetContextToken (in: pToken=0x259fc60 | out: pToken=0x259fc60) returned 0x0 [0181.792] CoGetContextToken (in: pToken=0x259fbe0 | out: pToken=0x259fbe0) returned 0x0 [0181.792] WbemLocator:IUnknown:Release (This=0x717650) returned 0x1 [0181.792] WbemLocator:IUnknown:Release (This=0x51f1058) returned 0x0 [0181.799] CoReleaseMarshalData (pStm=0x51e13f0) returned 0x0 [0181.800] CoGetContextToken (in: pToken=0x259fbe0 | out: pToken=0x259fbe0) returned 0x0 [0181.800] WbemLocator:IUnknown:Release (This=0x51dec08) returned 0x1 [0181.800] WbemLocator:IUnknown:Release (This=0x51dec08) returned 0x0 [0181.800] CoGetContextToken (in: pToken=0x259fbe0 | out: pToken=0x259fbe0) returned 0x0 [0181.800] WbemLocator:IUnknown:Release (This=0x51de5e8) returned 0x1 [0181.800] WbemLocator:IUnknown:Release (This=0x51de5e8) returned 0x0 [0181.800] CoGetContextToken (in: pToken=0x259fbe0 | out: pToken=0x259fbe0) returned 0x0 [0181.800] WbemLocator:IUnknown:Release (This=0x717c50) returned 0x1 [0181.800] WbemLocator:IUnknown:Release (This=0x51f1788) returned 0x0 [0181.800] CoReleaseMarshalData (pStm=0x51e1250) returned 0x0 [0181.801] CoGetContextToken (in: pToken=0x259fbe0 | out: pToken=0x259fbe0) returned 0x0 [0181.801] WbemLocator:IUnknown:Release (This=0x51de738) returned 0x1 [0181.801] WbemLocator:IUnknown:Release (This=0x51de738) returned 0x0 [0181.801] CoGetContextToken (in: pToken=0x259fbe0 | out: pToken=0x259fbe0) returned 0x0 [0181.801] WbemLocator:IUnknown:Release (This=0x715f50) returned 0x1 [0181.801] WbemLocator:IUnknown:Release (This=0x51f16e8) returned 0x0 [0181.801] CoReleaseMarshalData (pStm=0x51e1470) returned 0x0 [0181.802] CoGetContextToken (in: pToken=0x259fbe0 | out: pToken=0x259fbe0) returned 0x0 [0181.802] WbemLocator:IUnknown:Release (This=0x51de8f8) returned 0x1 [0181.802] WbemLocator:IUnknown:Release (This=0x51de8f8) returned 0x0 [0181.802] CoGetContextToken (in: pToken=0x259fbe0 | out: pToken=0x259fbe0) returned 0x0 [0181.802] WbemLocator:IUnknown:Release (This=0x51de8d8) returned 0x1 [0181.802] WbemLocator:IUnknown:Release (This=0x51de8d8) returned 0x0 [0181.802] CoGetContextToken (in: pToken=0x259fbe0 | out: pToken=0x259fbe0) returned 0x0 [0181.802] WbemLocator:IUnknown:Release (This=0x51de8e8) returned 0x1 [0181.802] WbemLocator:IUnknown:Release (This=0x51de8e8) returned 0x0 [0181.802] CoGetContextToken (in: pToken=0x259fbe0 | out: pToken=0x259fbe0) returned 0x0 [0181.802] WbemLocator:IUnknown:Release (This=0x520cee0) returned 0x1 [0181.802] WbemLocator:IUnknown:Release (This=0x51f1a58) returned 0x0 [0181.803] CoReleaseMarshalData (pStm=0x5209b20) returned 0x0 [0181.803] CoGetContextToken (in: pToken=0x259fbe0 | out: pToken=0x259fbe0) returned 0x0 [0181.803] WbemLocator:IUnknown:Release (This=0x51de898) returned 0x1 [0181.803] WbemLocator:IUnknown:Release (This=0x51de898) returned 0x0 [0181.803] CoGetContextToken (in: pToken=0x259fbe0 | out: pToken=0x259fbe0) returned 0x0 [0181.803] WbemLocator:IUnknown:Release (This=0x51de598) returned 0x1 [0181.803] WbemLocator:IUnknown:Release (This=0x51de598) returned 0x0 [0181.803] CoGetContextToken (in: pToken=0x259fc60 | out: pToken=0x259fc60) returned 0x0 [0181.804] CoGetContextToken (in: pToken=0x259fbe0 | out: pToken=0x259fbe0) returned 0x0 [0181.804] WbemDefPath:IUnknown:Release (This=0x51d7be0) returned 0x1 [0181.804] WbemDefPath:IUnknown:Release (This=0x51d7be0) returned 0x0 [0181.804] CoGetContextToken (in: pToken=0x259fbe0 | out: pToken=0x259fbe0) returned 0x0 [0181.804] WbemDefPath:IUnknown:Release (This=0x51d8270) returned 0x1 [0181.804] WbemDefPath:IUnknown:Release (This=0x51d8270) returned 0x0 [0181.804] CoGetContextToken (in: pToken=0x259fbe0 | out: pToken=0x259fbe0) returned 0x0 [0181.804] WbemDefPath:IUnknown:Release (This=0x51d7a90) returned 0x1 [0181.804] WbemDefPath:IUnknown:Release (This=0x51d7a90) returned 0x0 [0181.804] CoGetContextToken (in: pToken=0x259fbe0 | out: pToken=0x259fbe0) returned 0x0 [0181.804] WbemDefPath:IUnknown:Release (This=0x51d7a20) returned 0x1 [0181.804] WbemDefPath:IUnknown:Release (This=0x51d7a20) returned 0x0 [0181.804] CoGetContextToken (in: pToken=0x259fc60 | out: pToken=0x259fc60) returned 0x0 [0181.804] IUnknown:QueryInterface (in: This=0x66f908, riid=0x6f12da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x259fc04 | out: ppvObject=0x259fc04*=0x66f918) returned 0x0 [0181.804] CObjectContext::ContextCallback () returned 0x0 [0181.810] IUnknown:Release (This=0x66f918) returned 0x1 [0181.811] IUnknown:Release (This=0x5269a50) returned 0x0 [0181.811] IUnknown:Release (This=0x5269f18) returned 0x0 [0181.811] IUnknown:Release (This=0x5263468) returned 0x0 [0181.811] IUnknown:Release (This=0x52632d0) returned 0x0 [0181.811] IUnknown:Release (This=0x5263138) returned 0x0 [0181.812] IUnknown:Release (This=0x5262c70) returned 0x0 [0181.812] IUnknown:Release (This=0x5262ad8) returned 0x0 [0181.812] IUnknown:Release (This=0x5262940) returned 0x0 [0181.812] IUnknown:Release (This=0x5262e08) returned 0x0 [0181.812] IUnknown:Release (This=0x5263600) returned 0x0 [0181.812] IUnknown:Release (This=0x5263798) returned 0x0 [0181.813] IUnknown:Release (This=0x5262610) returned 0x0 [0181.813] IUnknown:Release (This=0x5263930) returned 0x0 [0181.813] IUnknown:Release (This=0x52627a8) returned 0x0 [0181.813] IUnknown:Release (This=0x5262478) returned 0x0 [0181.813] IUnknown:Release (This=0x52622e0) returned 0x0 [0181.813] IUnknown:Release (This=0x5263ac8) returned 0x0 [0181.814] IUnknown:Release (This=0x5262fa0) returned 0x0 [0181.814] IUnknown:Release (This=0x5264128) returned 0x0 [0181.814] IUnknown:Release (This=0x5263f90) returned 0x0 [0181.814] IUnknown:Release (This=0x5263c60) returned 0x0 [0181.814] IUnknown:Release (This=0x5263df8) returned 0x0 [0181.814] IUnknown:Release (This=0x5251550) returned 0x0 [0181.815] IUnknown:Release (This=0x52513b8) returned 0x0 [0181.815] IUnknown:Release (This=0x5251220) returned 0x0 [0181.815] IUnknown:Release (This=0x5251088) returned 0x0 [0181.815] IUnknown:Release (This=0x52526d8) returned 0x0 [0181.815] IUnknown:Release (This=0x5252540) returned 0x0 [0181.815] IUnknown:Release (This=0x52523a8) returned 0x0 [0181.816] IUnknown:Release (This=0x52516e8) returned 0x0 [0181.816] IUnknown:Release (This=0x5252078) returned 0x0 [0181.816] IUnknown:Release (This=0x5252870) returned 0x0 [0181.816] IUnknown:Release (This=0x5250ef0) returned 0x0 [0181.817] IUnknown:Release (This=0x5251880) returned 0x0 [0181.817] IUnknown:Release (This=0x5251ee0) returned 0x0 [0181.817] IUnknown:Release (This=0x5252210) returned 0x0 [0181.817] IUnknown:Release (This=0x5252d38) returned 0x0 [0181.817] IUnknown:Release (This=0x5252ba0) returned 0x0 [0181.817] IUnknown:Release (This=0x5251a18) returned 0x0 [0181.818] IUnknown:Release (This=0x5251d48) returned 0x0 [0181.818] IUnknown:Release (This=0x5251bb0) returned 0x0 [0181.818] IUnknown:Release (This=0x523de38) returned 0x0 [0181.818] IUnknown:Release (This=0x527a7c8) returned 0x0 [0181.818] IUnknown:Release (This=0x523dca0) returned 0x0 [0181.818] IUnknown:Release (This=0x523d970) returned 0x0 [0181.819] IUnknown:Release (This=0x523d640) returned 0x0 [0181.819] IUnknown:Release (This=0x523d4a8) returned 0x0 [0181.819] IUnknown:Release (This=0x523e168) returned 0x0 [0181.819] IUnknown:Release (This=0x523d7d8) returned 0x0 [0181.819] IUnknown:Release (This=0x523d310) returned 0x0 [0181.819] IUnknown:Release (This=0x523e960) returned 0x0 [0181.820] IUnknown:Release (This=0x523f158) returned 0x0 [0181.820] IUnknown:Release (This=0x523e7c8) returned 0x0 [0181.820] IUnknown:Release (This=0x523e300) returned 0x0 [0181.820] IUnknown:Release (This=0x523ec90) returned 0x0 [0181.820] IUnknown:Release (This=0x523db08) returned 0x0 [0181.820] IUnknown:Release (This=0x523e498) returned 0x0 [0181.821] IUnknown:Release (This=0x523dfd0) returned 0x0 [0181.821] IUnknown:Release (This=0x523efc0) returned 0x0 [0181.821] IUnknown:Release (This=0x523ee28) returned 0x0 [0181.821] IUnknown:Release (This=0x523eaf8) returned 0x0 [0181.821] IUnknown:Release (This=0x523e630) returned 0x0 [0181.821] IUnknown:Release (This=0x5231950) returned 0x0 [0181.822] IUnknown:Release (This=0x5230fc0) returned 0x0 [0181.822] IUnknown:Release (This=0x5232148) returned 0x0 [0181.822] IUnknown:Release (This=0x5231fb0) returned 0x0 [0181.822] IUnknown:Release (This=0x5231488) returned 0x0 [0181.822] IUnknown:Release (This=0x5231620) returned 0x0 [0181.822] IUnknown:Release (This=0x5231e18) returned 0x0 [0181.822] IUnknown:Release (This=0x5230960) returned 0x0 [0181.823] IUnknown:Release (This=0x5231158) returned 0x0 [0181.823] IUnknown:Release (This=0x5231c80) returned 0x0 [0181.823] IUnknown:Release (This=0x5230c90) returned 0x0 [0181.823] IUnknown:Release (This=0x5232478) returned 0x0 [0181.823] IUnknown:Release (This=0x52322e0) returned 0x0 [0181.823] IUnknown:Release (This=0x52307c8) returned 0x0 [0181.824] IUnknown:Release (This=0x5231ae8) returned 0x0 [0181.824] IUnknown:Release (This=0x5230e28) returned 0x0 [0181.824] IUnknown:Release (This=0x5232610) returned 0x0 [0181.824] IUnknown:Release (This=0x52312f0) returned 0x0 [0181.824] IUnknown:Release (This=0x52317b8) returned 0x0 [0181.824] IUnknown:Release (This=0x5230af8) returned 0x0 [0181.825] IUnknown:Release (This=0x52250c0) returned 0x0 [0181.825] IUnknown:Release (This=0x5224f28) returned 0x0 [0181.825] IUnknown:Release (This=0x5224d90) returned 0x0 [0181.825] IUnknown:Release (This=0x5224bf8) returned 0x0 [0181.825] IUnknown:Release (This=0x5224a60) returned 0x0 [0181.825] IUnknown:Release (This=0x5224730) returned 0x0 [0181.826] IUnknown:Release (This=0x5224598) returned 0x0 [0181.826] IUnknown:Release (This=0x5224268) returned 0x0 [0181.826] IUnknown:Release (This=0x52240d0) returned 0x0 [0181.826] IUnknown:Release (This=0x5225a50) returned 0x0 [0181.826] IUnknown:Release (This=0x5225720) returned 0x0 [0181.826] IUnknown:Release (This=0x5225be8) returned 0x0 [0181.827] IUnknown:Release (This=0x52248c8) returned 0x0 [0181.827] IUnknown:Release (This=0x52253f0) returned 0x0 [0181.827] IUnknown:Release (This=0x52258b8) returned 0x0 [0181.827] IUnknown:Release (This=0x5225258) returned 0x0 [0181.827] IUnknown:Release (This=0x5225588) returned 0x0 [0181.827] IUnknown:Release (This=0x5224400) returned 0x0 [0181.827] IUnknown:Release (This=0x5225d80) returned 0x0 [0181.828] IUnknown:Release (This=0x5223f38) returned 0x0 [0181.828] IUnknown:Release (This=0x71f228) returned 0x0 [0181.828] IUnknown:Release (This=0x71fee8) returned 0x0 [0181.828] IUnknown:Release (This=0x71fd50) returned 0x0 [0181.828] IUnknown:Release (This=0x71fa20) returned 0x0 [0181.828] IUnknown:Release (This=0x71f6f0) returned 0x0 [0181.828] IUnknown:Release (This=0x71f3c0) returned 0x0 [0181.829] IUnknown:Release (This=0x521a868) returned 0x0 [0181.829] IUnknown:Release (This=0x521a278) returned 0x0 [0181.829] IUnknown:Release (This=0x5219838) returned 0x0 [0181.829] IUnknown:Release (This=0x5219e20) returned 0x0 [0181.829] IUnknown:Release (This=0x521d108) returned 0x0 [0181.829] IUnknown:Release (This=0x521dcc8) returned 0x0 [0181.829] IUnknown:Release (This=0x521d878) returned 0x0 [0181.829] IUnknown:Release (This=0x521d420) returned 0x0 [0181.830] IUnknown:Release (This=0x52089c0) returned 0x0 [0181.832] IUnknown:Release (This=0x52794a8) returned 0x0 [0181.832] IUnknown:Release (This=0x52690c0) returned 0x0 [0181.832] IUnknown:Release (This=0x5268f28) returned 0x0 [0181.832] IUnknown:Release (This=0x5268d90) returned 0x0 [0181.833] IUnknown:Release (This=0x5207e38) returned 0x0 [0181.833] IUnknown:Release (This=0x5268a60) returned 0x0 [0181.833] CloseHandle (hObject=0x8e4) returned 1 [0181.833] CloseHandle (hObject=0x7d4) returned 1 [0181.833] CloseHandle (hObject=0x868) returned 1 [0181.834] CloseHandle (hObject=0x99c) returned 1 [0181.834] CloseHandle (hObject=0x7d0) returned 1 [0181.834] CloseHandle (hObject=0x920) returned 1 [0181.834] CloseHandle (hObject=0x864) returned 1 [0181.834] CloseHandle (hObject=0x7cc) returned 1 [0181.834] CloseHandle (hObject=0x8e0) returned 1 [0181.834] CloseHandle (hObject=0x978) returned 1 [0181.834] CloseHandle (hObject=0x7c8) returned 1 [0181.834] CloseHandle (hObject=0x860) returned 1 [0181.834] CloseHandle (hObject=0x948) returned 1 [0181.835] CloseHandle (hObject=0x7c4) returned 1 [0181.835] CloseHandle (hObject=0x8dc) returned 1 [0181.835] CloseHandle (hObject=0x85c) returned 1 [0181.835] CloseHandle (hObject=0x7c0) returned 1 [0181.835] CloseHandle (hObject=0x91c) returned 1 [0181.835] CloseHandle (hObject=0x964) returned 1 [0181.835] CloseHandle (hObject=0x7bc) returned 1 [0181.835] CloseHandle (hObject=0x858) returned 1 [0181.835] CloseHandle (hObject=0x8d8) returned 1 [0181.835] CloseHandle (hObject=0x7b8) returned 1 [0181.836] CloseHandle (hObject=0x984) returned 1 [0181.836] CloseHandle (hObject=0x854) returned 1 [0181.836] CloseHandle (hObject=0x7b4) returned 1 [0181.836] CloseHandle (hObject=0x918) returned 1 [0181.836] CloseHandle (hObject=0x8d4) returned 1 [0181.836] CloseHandle (hObject=0x7b0) returned 1 [0181.837] CloseHandle (hObject=0x850) returned 1 [0181.837] CloseHandle (hObject=0x944) returned 1 [0181.837] CloseHandle (hObject=0x7ac) returned 1 [0181.837] CloseHandle (hObject=0x98c) returned 1 [0181.837] CloseHandle (hObject=0x84c) returned 1 [0181.837] CloseHandle (hObject=0x7a8) returned 1 [0181.837] CloseHandle (hObject=0x8d0) returned 1 [0181.837] CloseHandle (hObject=0x914) returned 1 [0181.837] CloseHandle (hObject=0x7a4) returned 1 [0181.838] CloseHandle (hObject=0x848) returned 1 [0181.838] CloseHandle (hObject=0x960) returned 1 [0181.838] CloseHandle (hObject=0x7a0) returned 1 [0181.838] CloseHandle (hObject=0x8cc) returned 1 [0181.838] CloseHandle (hObject=0x844) returned 1 [0181.838] CloseHandle (hObject=0x79c) returned 1 [0181.838] CloseHandle (hObject=0x940) returned 1 [0181.838] CloseHandle (hObject=0x910) returned 1 [0181.838] CloseHandle (hObject=0x798) returned 1 [0181.838] CloseHandle (hObject=0x840) returned 1 [0181.839] CloseHandle (hObject=0x8c8) returned 1 [0181.839] CloseHandle (hObject=0x794) returned 1 [0181.839] CloseHandle (hObject=0x974) returned 1 [0181.839] CloseHandle (hObject=0x83c) returned 1 [0181.839] CloseHandle (hObject=0x790) returned 1 [0181.839] CloseHandle (hObject=0x998) returned 1 [0181.839] CloseHandle (hObject=0x8c4) returned 1 [0181.839] CloseHandle (hObject=0x78c) returned 1 [0181.839] CloseHandle (hObject=0x838) returned 1 [0181.839] CloseHandle (hObject=0x90c) returned 1 [0181.840] CloseHandle (hObject=0x788) returned 1 [0181.840] CloseHandle (hObject=0x93c) returned 1 [0181.840] CloseHandle (hObject=0x834) returned 1 [0181.840] CloseHandle (hObject=0x784) returned 1 [0181.840] CloseHandle (hObject=0x8c0) returned 1 [0181.840] CloseHandle (hObject=0x95c) returned 1 [0181.840] CloseHandle (hObject=0x780) returned 1 [0181.840] CloseHandle (hObject=0x830) returned 1 [0181.840] CloseHandle (hObject=0x908) returned 1 [0181.841] CloseHandle (hObject=0x77c) returned 1 [0181.841] CloseHandle (hObject=0x8bc) returned 1 [0181.841] CloseHandle (hObject=0x82c) returned 1 [0181.841] CloseHandle (hObject=0x778) returned 1 [0181.841] CloseHandle (hObject=0x980) returned 1 [0181.841] CloseHandle (hObject=0x938) returned 1 [0181.841] CloseHandle (hObject=0x774) returned 1 [0181.841] CloseHandle (hObject=0x828) returned 1 [0181.841] CloseHandle (hObject=0x8b4) returned 1 [0181.841] CloseHandle (hObject=0x770) returned 1 [0181.841] CloseHandle (hObject=0x904) returned 1 [0181.842] CloseHandle (hObject=0x824) returned 1 [0181.842] CloseHandle (hObject=0x76c) returned 1 [0181.842] CloseHandle (hObject=0x970) returned 1 [0181.842] CloseHandle (hObject=0x8b8) returned 1 [0181.842] CloseHandle (hObject=0x764) returned 1 [0181.842] CloseHandle (hObject=0x820) returned 1 [0181.842] CloseHandle (hObject=0x958) returned 1 [0181.842] CloseHandle (hObject=0x768) returned 1 [0181.842] CloseHandle (hObject=0x900) returned 1 [0181.842] CloseHandle (hObject=0x81c) returned 1 [0181.843] CloseHandle (hObject=0x760) returned 1 [0181.843] CloseHandle (hObject=0x8b0) returned 1 [0181.843] CloseHandle (hObject=0x934) returned 1 [0181.843] CloseHandle (hObject=0x75c) returned 1 [0181.843] CloseHandle (hObject=0x818) returned 1 [0181.843] CloseHandle (hObject=0x990) returned 1 [0181.843] CloseHandle (hObject=0x758) returned 1 [0181.843] CloseHandle (hObject=0x8ac) returned 1 [0181.843] CloseHandle (hObject=0x814) returned 1 [0181.843] CloseHandle (hObject=0x8fc) returned 1 [0181.844] CloseHandle (hObject=0x988) returned 1 [0181.844] CloseHandle (hObject=0x810) returned 1 [0181.844] CloseHandle (hObject=0x8a8) returned 1 [0181.844] CloseHandle (hObject=0x930) returned 1 [0181.844] CloseHandle (hObject=0x80c) returned 1 [0181.844] CloseHandle (hObject=0x8f8) returned 1 [0181.844] CloseHandle (hObject=0x4c0) returned 1 [0181.844] CloseHandle (hObject=0x808) returned 1 [0181.844] CloseHandle (hObject=0x494) returned 1 [0181.844] CloseHandle (hObject=0x954) returned 1 [0181.845] RegCloseKey (hKey=0x88c) returned 0x0 [0181.845] CloseHandle (hObject=0x804) returned 1 [0181.845] RegCloseKey (hKey=0x888) returned 0x0 [0181.845] CloseHandle (hObject=0x3b4) returned 1 [0181.845] RegCloseKey (hKey=0x884) returned 0x0 [0181.845] CloseHandle (hObject=0x558) returned 1 [0181.845] CloseHandle (hObject=0x7fc) returned 1 [0181.845] CloseHandle (hObject=0x96c) returned 1 [0181.845] CloseHandle (hObject=0x8f4) returned 1 [0181.846] CloseHandle (hObject=0x7f8) returned 1 [0181.846] CloseHandle (hObject=0x330) returned 1 [0181.846] CloseHandle (hObject=0x880) returned 1 [0181.846] CloseHandle (hObject=0x92c) returned 1 [0181.846] CloseHandle (hObject=0x7f4) returned 1 [0181.846] CloseHandle (hObject=0x2e8) returned 1 [0181.846] CloseHandle (hObject=0x97c) returned 1 [0181.846] CloseHandle (hObject=0x87c) returned 1 [0181.846] CloseHandle (hObject=0x7f0) returned 1 [0181.847] CloseHandle (hObject=0x2c8) returned 1 [0181.847] CloseHandle (hObject=0x8f0) returned 1 [0181.847] CloseHandle (hObject=0x950) returned 1 [0181.847] CloseHandle (hObject=0x7ec) returned 1 [0181.847] CloseHandle (hObject=0x730) returned 1 [0181.847] CloseHandle (hObject=0x878) returned 1 [0181.848] CloseHandle (hObject=0x928) returned 1 [0181.848] CloseHandle (hObject=0x7e8) returned 1 [0181.848] CloseHandle (hObject=0x8ec) returned 1 [0181.848] CloseHandle (hObject=0x874) returned 1 [0181.848] CloseHandle (hObject=0x7e4) returned 1 [0181.848] CloseHandle (hObject=0x994) returned 1 [0181.848] CloseHandle (hObject=0x968) returned 1 [0181.848] CloseHandle (hObject=0x7e0) returned 1 [0181.848] CloseHandle (hObject=0x870) returned 1 [0181.848] CloseHandle (hObject=0x8e8) returned 1 [0181.849] CloseHandle (hObject=0x7dc) returned 1 [0181.849] CloseHandle (hObject=0x924) returned 1 [0181.849] CloseHandle (hObject=0x86c) returned 1 [0181.849] CloseHandle (hObject=0x7d8) returned 1 [0181.849] CloseHandle (hObject=0x94c) returned 1 [0222.943] EtwEventUnregister (RegHandle=0x6a5508) returned 0x0 [0222.943] EtwEventUnregister (RegHandle=0x6a4668) returned 0x0 [0222.949] FreeLibrary (hLibModule=0x69960000) returned 1 [0222.979] FreeLibrary (hLibModule=0x69890000) returned 1 [0222.990] ??3@YAXPAX@Z () returned 0x1 [0222.993] LocalFree (hMem=0x6b22a0) returned 0x0 [0222.998] IsWindow (hWnd=0x50278) returned 1 [0222.999] GetModuleHandleW (lpModuleName="user32.dll") returned 0x743d0000 [0222.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x259fa14, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcWAmÿgH{(ú\x01o\x98üY\x02\x01", lpUsedDefaultChar=0x0) returned 14 [0223.000] GetProcAddress (hModule=0x743d0000, lpProcName="DefWindowProcW") returned 0x73e807e0 [0223.000] SetWindowLongW (hWnd=0x50278, nIndex=-4, dwNewLong=1944586208) returned 78728238 [0223.001] SetClassLongW (hWnd=0x50278, nIndex=-24, dwNewLong=1944586208) returned 0x4b14c2e [0223.001] IsWindow (hWnd=0x50278) returned 1 [0223.002] DestroyWindow (hWnd=0x50278) returned 0 [0223.002] PostMessageW (hWnd=0x50278, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0223.002] SetConsoleCtrlHandler (HandlerRoutine=0x4b14c06, Add=0) returned 1 [0223.019] CloseHandle (hObject=0x718) returned 1 [0223.019] IUnknown:Release (This=0x5252870) returned 0x2 [0223.020] IUnknown:Release (This=0x5252540) returned 0x2 [0223.020] IUnknown:Release (This=0x5252210) returned 0x2 [0223.021] IUnknown:Release (This=0x52516e8) returned 0x2 [0223.021] IUnknown:Release (This=0x5251550) returned 0x2 [0223.021] IUnknown:Release (This=0x5251bb0) returned 0x2 [0223.022] IUnknown:Release (This=0x5251ee0) returned 0x2 [0223.022] IUnknown:Release (This=0x52513b8) returned 0x2 [0223.022] IUnknown:Release (This=0x5251220) returned 0x2 [0223.022] IUnknown:Release (This=0x5251a18) returned 0x2 [0223.023] IUnknown:Release (This=0x5251880) returned 0x2 [0223.023] IUnknown:Release (This=0x5252ba0) returned 0x2 [0223.023] IUnknown:Release (This=0x5251d48) returned 0x2 [0223.023] IUnknown:Release (This=0x5252078) returned 0x2 [0223.024] IUnknown:Release (This=0x527a630) returned 0x0 [0223.039] EtwEventUnregister (RegHandle=0x6a4738) returned 0x0 [0223.046] CloseHandle (hObject=0x8a0) returned 1 [0223.046] WinHttpCloseHandle (hInternet=0x634fc8) returned 1 [0223.048] CloseHandle (hObject=0x74c) returned 1 [0223.049] CloseHandle (hObject=0x9a0) returned 1 [0223.049] CloseHandle (hObject=0x440) returned 1 [0223.050] CloseHandle (hObject=0x43c) returned 1 [0223.050] RegCloseKey (hKey=0x438) returned 0x0 [0223.051] CloseHandle (hObject=0x434) returned 1 [0223.052] RegCloseKey (hKey=0x430) returned 0x0 [0223.052] CloseHandle (hObject=0x42c) returned 1 [0223.052] RegCloseKey (hKey=0x428) returned 0x0 [0223.053] RegCloseKey (hKey=0x424) returned 0x0 [0223.054] CloseHandle (hObject=0x40c) returned 1 [0223.055] setsockopt (s=0x3fc, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0223.055] closesocket (s=0x3fc) returned 0 [0223.057] CloseHandle (hObject=0x404) returned 1 [0223.057] setsockopt (s=0x3f4, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0223.058] closesocket (s=0x3f4) returned 0 [0223.058] CloseHandle (hObject=0x3f8) returned 1 [0223.059] UnmapViewOfFile (lpBaseAddress=0x6110000) returned 1 [0223.061] RegCloseKey (hKey=0x80000004) returned 0x0 [0223.061] setsockopt (s=0x540, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0223.062] closesocket (s=0x540) returned 0 [0223.064] FreeCredentialsHandle (phCredential=0x271c134) returned 0x0 [0223.065] DeleteSecurityContext (phContext=0x271c2ec) returned 0x0 [0223.066] CloseHandle (hObject=0x73c) returned 1 [0223.069] CloseHandle (hObject=0x754) returned 1 [0223.070] CloseHandle (hObject=0x4c8) returned 1 [0223.070] CloseHandle (hObject=0x3bc) returned 1 [0223.071] UnmapViewOfFile (lpBaseAddress=0x5b70000) returned 1 [0223.073] CloseHandle (hObject=0x334) returned 1 [0223.075] CloseHandle (hObject=0x8a4) returned 1 [0223.075] CloseHandle (hObject=0x72c) returned 1 [0223.075] CloseHandle (hObject=0x750) returned 1 [0223.076] CloseHandle (hObject=0x3b8) returned 1 [0223.077] CloseHandle (hObject=0x890) returned 1 [0223.078] CloseHandle (hObject=0x648) returned 1 [0223.078] CloseHandle (hObject=0x744) returned 1 [0223.078] CloseHandle (hObject=0x898) returned 1 [0223.079] setsockopt (s=0x4ac, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0223.079] closesocket (s=0x4ac) returned 0 [0223.080] CloseHandle (hObject=0x548) returned 1 [0223.080] setsockopt (s=0x360, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0223.080] closesocket (s=0x360) returned 0 [0223.082] setsockopt (s=0x54c, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0223.082] closesocket (s=0x54c) returned 0 [0223.082] CloseHandle (hObject=0x550) returned 1 [0223.083] CloseHandle (hObject=0x89c) returned 1 [0223.083] CloseHandle (hObject=0x748) returned 1 [0223.090] CoGetContextToken (in: pToken=0x259f8b0 | out: pToken=0x259f8b0) returned 0x0 [0223.090] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.090] WbemDefPath:IUnknown:Release (This=0x52401b8) returned 0x1 [0223.090] WbemDefPath:IUnknown:Release (This=0x52401b8) returned 0x0 [0223.091] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.091] WbemDefPath:IUnknown:Release (This=0x51d78d0) returned 0x1 [0223.091] WbemDefPath:IUnknown:Release (This=0x51d78d0) returned 0x0 [0223.091] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.091] WbemDefPath:IUnknown:Release (This=0x523fb98) returned 0x1 [0223.091] WbemDefPath:IUnknown:Release (This=0x523fb98) returned 0x0 [0223.091] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.091] WbemDefPath:IUnknown:Release (This=0x52278e0) returned 0x1 [0223.091] WbemDefPath:IUnknown:Release (This=0x52278e0) returned 0x0 [0223.092] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.092] WbemDefPath:IUnknown:Release (This=0x52610c0) returned 0x1 [0223.092] WbemDefPath:IUnknown:Release (This=0x52610c0) returned 0x0 [0223.094] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.094] WbemDefPath:IUnknown:Release (This=0x5277cf8) returned 0x1 [0223.094] WbemDefPath:IUnknown:Release (This=0x5277cf8) returned 0x0 [0223.094] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.094] WbemDefPath:IUnknown:Release (This=0x523ff88) returned 0x1 [0223.094] WbemDefPath:IUnknown:Release (This=0x523ff88) returned 0x0 [0223.095] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.095] WbemDefPath:IUnknown:Release (This=0x5261050) returned 0x1 [0223.095] WbemDefPath:IUnknown:Release (This=0x5261050) returned 0x0 [0223.095] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.095] WbemDefPath:IUnknown:Release (This=0x523f968) returned 0x1 [0223.095] WbemDefPath:IUnknown:Release (This=0x523f968) returned 0x0 [0223.095] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.095] WbemDefPath:IUnknown:Release (This=0x5261ad0) returned 0x1 [0223.095] WbemDefPath:IUnknown:Release (This=0x5261ad0) returned 0x0 [0223.095] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.095] WbemDefPath:IUnknown:Release (This=0x52276b0) returned 0x1 [0223.095] WbemDefPath:IUnknown:Release (This=0x52276b0) returned 0x0 [0223.096] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.096] WbemDefPath:IUnknown:Release (This=0x5227090) returned 0x1 [0223.096] WbemDefPath:IUnknown:Release (This=0x5227090) returned 0x0 [0223.096] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.096] WbemDefPath:IUnknown:Release (This=0x52272c0) returned 0x1 [0223.096] WbemDefPath:IUnknown:Release (This=0x52272c0) returned 0x0 [0223.096] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.096] WbemDefPath:IUnknown:Release (This=0x5240378) returned 0x1 [0223.096] WbemDefPath:IUnknown:Release (This=0x5240378) returned 0x0 [0223.096] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.096] WbemDefPath:IUnknown:Release (This=0x5277ac8) returned 0x1 [0223.096] WbemDefPath:IUnknown:Release (This=0x5277ac8) returned 0x0 [0223.097] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.097] WbemDefPath:IUnknown:Release (This=0x523fd58) returned 0x1 [0223.097] WbemDefPath:IUnknown:Release (This=0x523fd58) returned 0x0 [0223.097] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.097] WbemDefPath:IUnknown:Release (This=0x523f738) returned 0x1 [0223.097] WbemDefPath:IUnknown:Release (This=0x523f738) returned 0x0 [0223.097] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.097] WbemDefPath:IUnknown:Release (This=0x5227aa0) returned 0x1 [0223.097] WbemDefPath:IUnknown:Release (This=0x5227aa0) returned 0x0 [0223.097] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.097] WbemDefPath:IUnknown:Release (This=0x5261280) returned 0x1 [0223.097] WbemDefPath:IUnknown:Release (This=0x5261280) returned 0x0 [0223.098] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.098] WbemDefPath:IUnknown:Release (This=0x5227480) returned 0x1 [0223.098] WbemDefPath:IUnknown:Release (This=0x5227480) returned 0x0 [0223.098] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.098] WbemDefPath:IUnknown:Release (This=0x5226e60) returned 0x1 [0223.098] WbemDefPath:IUnknown:Release (This=0x5226e60) returned 0x0 [0223.098] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.098] WbemDefPath:IUnknown:Release (This=0x51d84a0) returned 0x1 [0223.098] WbemDefPath:IUnknown:Release (This=0x51d84a0) returned 0x0 [0223.098] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.098] WbemDefPath:IUnknown:Release (This=0x52784d8) returned 0x1 [0223.098] WbemDefPath:IUnknown:Release (This=0x52784d8) returned 0x0 [0223.101] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.101] WbemDefPath:IUnknown:Release (This=0x52612f0) returned 0x1 [0223.101] WbemDefPath:IUnknown:Release (This=0x52612f0) returned 0x0 [0223.101] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.101] WbemDefPath:IUnknown:Release (This=0x51d7e80) returned 0x1 [0223.101] WbemDefPath:IUnknown:Release (This=0x51d7e80) returned 0x0 [0223.101] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.101] WbemDefPath:IUnknown:Release (This=0x52616e0) returned 0x1 [0223.101] WbemDefPath:IUnknown:Release (This=0x52616e0) returned 0x0 [0223.101] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.102] WbemDefPath:IUnknown:Release (This=0x5240148) returned 0x1 [0223.102] WbemDefPath:IUnknown:Release (This=0x5240148) returned 0x0 [0223.102] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.102] WbemDefPath:IUnknown:Release (This=0x5240538) returned 0x1 [0223.102] WbemDefPath:IUnknown:Release (This=0x5240538) returned 0x0 [0223.102] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.102] WbemDefPath:IUnknown:Release (This=0x523fb28) returned 0x1 [0223.102] WbemDefPath:IUnknown:Release (This=0x523fb28) returned 0x0 [0223.102] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.102] WbemDefPath:IUnknown:Release (This=0x5261c90) returned 0x1 [0223.102] WbemDefPath:IUnknown:Release (This=0x5261c90) returned 0x0 [0223.102] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.102] WbemDefPath:IUnknown:Release (This=0x5261670) returned 0x1 [0223.103] WbemDefPath:IUnknown:Release (This=0x5261670) returned 0x0 [0223.103] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.103] WbemDefPath:IUnknown:Release (This=0x5227250) returned 0x1 [0223.104] WbemDefPath:IUnknown:Release (This=0x5227250) returned 0x0 [0223.104] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.104] WbemDefPath:IUnknown:Release (This=0x52782a8) returned 0x1 [0223.104] WbemDefPath:IUnknown:Release (This=0x52782a8) returned 0x0 [0223.104] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.104] WbemDefPath:IUnknown:Release (This=0x51d7c50) returned 0x1 [0223.104] WbemDefPath:IUnknown:Release (This=0x51d7c50) returned 0x0 [0223.104] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.104] WbemDefPath:IUnknown:Release (This=0x523ff18) returned 0x1 [0223.104] WbemDefPath:IUnknown:Release (This=0x523ff18) returned 0x0 [0223.105] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.105] WbemDefPath:IUnknown:Release (This=0x51d7630) returned 0x1 [0223.105] WbemDefPath:IUnknown:Release (This=0x51d7630) returned 0x0 [0223.105] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.105] WbemDefPath:IUnknown:Release (This=0x523f8f8) returned 0x1 [0223.105] WbemDefPath:IUnknown:Release (This=0x523f8f8) returned 0x0 [0223.105] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.105] WbemDefPath:IUnknown:Release (This=0x5227c60) returned 0x1 [0223.105] WbemDefPath:IUnknown:Release (This=0x5227c60) returned 0x0 [0223.105] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.105] WbemDefPath:IUnknown:Release (This=0x5261440) returned 0x1 [0223.105] WbemDefPath:IUnknown:Release (This=0x5261440) returned 0x0 [0223.106] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.106] WbemDefPath:IUnknown:Release (This=0x5227640) returned 0x1 [0223.106] WbemDefPath:IUnknown:Release (This=0x5227640) returned 0x0 [0223.106] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.106] WbemDefPath:IUnknown:Release (This=0x5260e20) returned 0x1 [0223.106] WbemDefPath:IUnknown:Release (This=0x5260e20) returned 0x0 [0223.106] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.106] WbemDefPath:IUnknown:Release (This=0x5227020) returned 0x1 [0223.106] WbemDefPath:IUnknown:Release (This=0x5227020) returned 0x0 [0223.106] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.106] WbemDefPath:IUnknown:Release (This=0x5278698) returned 0x1 [0223.106] WbemDefPath:IUnknown:Release (This=0x5278698) returned 0x0 [0223.107] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.107] WbemDefPath:IUnknown:Release (This=0x51d8040) returned 0x1 [0223.107] WbemDefPath:IUnknown:Release (This=0x51d8040) returned 0x0 [0223.107] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.107] WbemDefPath:IUnknown:Release (This=0x5278078) returned 0x1 [0223.107] WbemDefPath:IUnknown:Release (This=0x5278078) returned 0x0 [0223.107] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.107] WbemDefPath:IUnknown:Release (This=0x5240308) returned 0x1 [0223.107] WbemDefPath:IUnknown:Release (This=0x5240308) returned 0x0 [0223.107] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.107] WbemDefPath:IUnknown:Release (This=0x52614b0) returned 0x1 [0223.107] WbemDefPath:IUnknown:Release (This=0x52614b0) returned 0x0 [0223.108] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.108] WbemDefPath:IUnknown:Release (This=0x523fce8) returned 0x1 [0223.108] WbemDefPath:IUnknown:Release (This=0x523fce8) returned 0x0 [0223.110] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.110] WbemDefPath:IUnknown:Release (This=0x523f6c8) returned 0x1 [0223.110] WbemDefPath:IUnknown:Release (This=0x523f6c8) returned 0x0 [0223.110] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.110] WbemDefPath:IUnknown:Release (This=0x5261830) returned 0x1 [0223.110] WbemDefPath:IUnknown:Release (This=0x5261830) returned 0x0 [0223.110] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.110] WbemDefPath:IUnknown:Release (This=0x5227a30) returned 0x1 [0223.110] WbemDefPath:IUnknown:Release (This=0x5227a30) returned 0x0 [0223.110] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.111] WbemDefPath:IUnknown:Release (This=0x5260e90) returned 0x1 [0223.111] WbemDefPath:IUnknown:Release (This=0x5260e90) returned 0x0 [0223.111] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.111] WbemDefPath:IUnknown:Release (This=0x5261210) returned 0x1 [0223.111] WbemDefPath:IUnknown:Release (This=0x5261210) returned 0x0 [0223.111] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.111] WbemDefPath:IUnknown:Release (This=0x5227410) returned 0x1 [0223.111] WbemDefPath:IUnknown:Release (This=0x5227410) returned 0x0 [0223.111] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.111] WbemDefPath:IUnknown:Release (This=0x51d76a0) returned 0x1 [0223.112] WbemDefPath:IUnknown:Release (This=0x51d76a0) returned 0x0 [0223.112] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.112] WbemDefPath:IUnknown:Release (This=0x5226df0) returned 0x1 [0223.112] WbemDefPath:IUnknown:Release (This=0x5226df0) returned 0x0 [0223.112] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.112] WbemDefPath:IUnknown:Release (This=0x51d8430) returned 0x1 [0223.112] WbemDefPath:IUnknown:Release (This=0x51d8430) returned 0x0 [0223.113] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.113] WbemDefPath:IUnknown:Release (This=0x5278468) returned 0x1 [0223.113] WbemDefPath:IUnknown:Release (This=0x5278468) returned 0x0 [0223.113] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.113] WbemDefPath:IUnknown:Release (This=0x5277e48) returned 0x1 [0223.113] WbemDefPath:IUnknown:Release (This=0x5277e48) returned 0x0 [0223.113] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.113] WbemDefPath:IUnknown:Release (This=0x52400d8) returned 0x1 [0223.113] WbemDefPath:IUnknown:Release (This=0x52400d8) returned 0x0 [0223.113] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.113] WbemDefPath:IUnknown:Release (This=0x51d77f0) returned 0x1 [0223.113] WbemDefPath:IUnknown:Release (This=0x51d77f0) returned 0x0 [0223.114] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.114] WbemDefPath:IUnknown:Release (This=0x523fab8) returned 0x1 [0223.114] WbemDefPath:IUnknown:Release (This=0x523fab8) returned 0x0 [0223.114] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.114] WbemDefPath:IUnknown:Release (This=0x5261c20) returned 0x1 [0223.114] WbemDefPath:IUnknown:Release (This=0x5261c20) returned 0x0 [0223.114] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.115] WbemDefPath:IUnknown:Release (This=0x5261600) returned 0x1 [0223.115] WbemDefPath:IUnknown:Release (This=0x5261600) returned 0x0 [0223.115] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.115] WbemDefPath:IUnknown:Release (This=0x5227800) returned 0x1 [0223.115] WbemDefPath:IUnknown:Release (This=0x5227800) returned 0x0 [0223.116] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.116] WbemDefPath:IUnknown:Release (This=0x5260fe0) returned 0x1 [0223.116] WbemDefPath:IUnknown:Release (This=0x5260fe0) returned 0x0 [0223.116] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.116] WbemDefPath:IUnknown:Release (This=0x52271e0) returned 0x1 [0223.116] WbemDefPath:IUnknown:Release (This=0x52271e0) returned 0x0 [0223.116] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.116] WbemDefPath:IUnknown:Release (This=0x523fe38) returned 0x1 [0223.116] WbemDefPath:IUnknown:Release (This=0x523fe38) returned 0x0 [0223.116] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.116] WbemDefPath:IUnknown:Release (This=0x51d83c0) returned 0x1 [0223.116] WbemDefPath:IUnknown:Release (This=0x51d83c0) returned 0x0 [0223.117] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.117] WbemDefPath:IUnknown:Release (This=0x5278238) returned 0x1 [0223.117] WbemDefPath:IUnknown:Release (This=0x5278238) returned 0x0 [0223.117] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.117] WbemDefPath:IUnknown:Release (This=0x52404c8) returned 0x1 [0223.117] WbemDefPath:IUnknown:Release (This=0x52404c8) returned 0x0 [0223.117] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.117] WbemDefPath:IUnknown:Release (This=0x5277c88) returned 0x1 [0223.117] WbemDefPath:IUnknown:Release (This=0x5277c88) returned 0x0 [0223.117] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.117] WbemDefPath:IUnknown:Release (This=0x523fea8) returned 0x1 [0223.117] WbemDefPath:IUnknown:Release (This=0x523fea8) returned 0x0 [0223.118] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.118] WbemDefPath:IUnknown:Release (This=0x52403e8) returned 0x1 [0223.118] WbemDefPath:IUnknown:Release (This=0x52403e8) returned 0x0 [0223.118] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.118] WbemDefPath:IUnknown:Release (This=0x523f888) returned 0x1 [0223.118] WbemDefPath:IUnknown:Release (This=0x523f888) returned 0x0 [0223.118] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.118] WbemDefPath:IUnknown:Release (This=0x5227870) returned 0x1 [0223.118] WbemDefPath:IUnknown:Release (This=0x5227870) returned 0x0 [0223.118] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.118] WbemDefPath:IUnknown:Release (This=0x52619f0) returned 0x1 [0223.118] WbemDefPath:IUnknown:Release (This=0x52619f0) returned 0x0 [0223.118] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.119] WbemDefPath:IUnknown:Release (This=0x5227bf0) returned 0x1 [0223.119] WbemDefPath:IUnknown:Release (This=0x5227bf0) returned 0x0 [0223.119] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.119] WbemDefPath:IUnknown:Release (This=0x52613d0) returned 0x1 [0223.119] WbemDefPath:IUnknown:Release (This=0x52613d0) returned 0x0 [0223.119] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.119] WbemDefPath:IUnknown:Release (This=0x52275d0) returned 0x1 [0223.119] WbemDefPath:IUnknown:Release (This=0x52275d0) returned 0x0 [0223.119] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.119] WbemDefPath:IUnknown:Release (This=0x5260db0) returned 0x1 [0223.119] WbemDefPath:IUnknown:Release (This=0x5260db0) returned 0x0 [0223.119] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.120] WbemDefPath:IUnknown:Release (This=0x5226fb0) returned 0x1 [0223.120] WbemDefPath:IUnknown:Release (This=0x5226fb0) returned 0x0 [0223.122] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.122] WbemDefPath:IUnknown:Release (This=0x5277a58) returned 0x1 [0223.122] WbemDefPath:IUnknown:Release (This=0x5277a58) returned 0x0 [0223.122] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.122] WbemDefPath:IUnknown:Release (This=0x5278628) returned 0x1 [0223.122] WbemDefPath:IUnknown:Release (This=0x5278628) returned 0x0 [0223.122] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.123] WbemDefPath:IUnknown:Release (This=0x51d7fd0) returned 0x1 [0223.123] WbemDefPath:IUnknown:Release (This=0x51d7fd0) returned 0x0 [0223.123] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.123] WbemDefPath:IUnknown:Release (This=0x5240298) returned 0x1 [0223.123] WbemDefPath:IUnknown:Release (This=0x5240298) returned 0x0 [0223.123] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.123] WbemDefPath:IUnknown:Release (This=0x51d79b0) returned 0x1 [0223.123] WbemDefPath:IUnknown:Release (This=0x51d79b0) returned 0x0 [0223.123] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.123] WbemDefPath:IUnknown:Release (This=0x52779e8) returned 0x1 [0223.124] WbemDefPath:IUnknown:Release (This=0x52779e8) returned 0x0 [0223.124] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.124] WbemDefPath:IUnknown:Release (This=0x523fc78) returned 0x1 [0223.124] WbemDefPath:IUnknown:Release (This=0x523fc78) returned 0x0 [0223.124] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.124] WbemDefPath:IUnknown:Release (This=0x5226d10) returned 0x1 [0223.124] WbemDefPath:IUnknown:Release (This=0x5226d10) returned 0x0 [0223.124] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.124] WbemDefPath:IUnknown:Release (This=0x523f658) returned 0x1 [0223.124] WbemDefPath:IUnknown:Release (This=0x523f658) returned 0x0 [0223.124] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.124] WbemDefPath:IUnknown:Release (This=0x52617c0) returned 0x1 [0223.124] WbemDefPath:IUnknown:Release (This=0x52617c0) returned 0x0 [0223.125] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.125] WbemDefPath:IUnknown:Release (This=0x52279c0) returned 0x1 [0223.125] WbemDefPath:IUnknown:Release (This=0x52279c0) returned 0x0 [0223.125] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.125] WbemDefPath:IUnknown:Release (This=0x52611a0) returned 0x1 [0223.125] WbemDefPath:IUnknown:Release (This=0x52611a0) returned 0x0 [0223.125] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.125] WbemDefPath:IUnknown:Release (This=0x52273a0) returned 0x1 [0223.125] WbemDefPath:IUnknown:Release (This=0x52273a0) returned 0x0 [0223.125] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.125] WbemDefPath:IUnknown:Release (This=0x5261750) returned 0x1 [0223.125] WbemDefPath:IUnknown:Release (This=0x5261750) returned 0x0 [0223.126] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.126] WbemDefPath:IUnknown:Release (This=0x5226d80) returned 0x1 [0223.126] WbemDefPath:IUnknown:Release (This=0x5226d80) returned 0x0 [0223.126] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.126] WbemDefPath:IUnknown:Release (This=0x5277f28) returned 0x1 [0223.126] WbemDefPath:IUnknown:Release (This=0x5277f28) returned 0x0 [0223.126] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.126] WbemDefPath:IUnknown:Release (This=0x51d7da0) returned 0x1 [0223.126] WbemDefPath:IUnknown:Release (This=0x51d7da0) returned 0x0 [0223.126] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.126] WbemDefPath:IUnknown:Release (This=0x5277dd8) returned 0x1 [0223.126] WbemDefPath:IUnknown:Release (This=0x5277dd8) returned 0x0 [0223.127] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.127] WbemDefPath:IUnknown:Release (This=0x5240068) returned 0x1 [0223.127] WbemDefPath:IUnknown:Release (This=0x5240068) returned 0x0 [0223.127] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.127] WbemDefPath:IUnknown:Release (This=0x51d7780) returned 0x1 [0223.127] WbemDefPath:IUnknown:Release (This=0x51d7780) returned 0x0 [0223.127] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.127] WbemDefPath:IUnknown:Release (This=0x523fa48) returned 0x1 [0223.127] WbemDefPath:IUnknown:Release (This=0x523fa48) returned 0x0 [0223.127] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.127] WbemDefPath:IUnknown:Release (This=0x5261bb0) returned 0x1 [0223.127] WbemDefPath:IUnknown:Release (This=0x5261bb0) returned 0x0 [0223.128] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.128] WbemDefPath:IUnknown:Release (This=0x51d7b70) returned 0x1 [0223.128] WbemDefPath:IUnknown:Release (This=0x51d7b70) returned 0x0 [0223.128] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.128] WbemDefPath:IUnknown:Release (This=0x5261590) returned 0x1 [0223.128] WbemDefPath:IUnknown:Release (This=0x5261590) returned 0x0 [0223.128] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.128] WbemDefPath:IUnknown:Release (This=0x5227790) returned 0x1 [0223.128] WbemDefPath:IUnknown:Release (This=0x5227790) returned 0x0 [0223.128] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.128] WbemDefPath:IUnknown:Release (This=0x5260f70) returned 0x1 [0223.128] WbemDefPath:IUnknown:Release (This=0x5260f70) returned 0x0 [0223.129] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.129] WbemDefPath:IUnknown:Release (This=0x5227170) returned 0x1 [0223.129] WbemDefPath:IUnknown:Release (This=0x5227170) returned 0x0 [0223.129] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.129] WbemDefPath:IUnknown:Release (This=0x5277b38) returned 0x1 [0223.129] WbemDefPath:IUnknown:Release (This=0x5277b38) returned 0x0 [0223.129] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.129] WbemDefPath:IUnknown:Release (This=0x51d8190) returned 0x1 [0223.129] WbemDefPath:IUnknown:Release (This=0x51d8190) returned 0x0 [0223.129] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.129] WbemDefPath:IUnknown:Release (This=0x6ef318) returned 0x1 [0223.129] WbemDefPath:IUnknown:Release (This=0x6ef318) returned 0x0 [0223.130] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.130] WbemDefPath:IUnknown:Release (This=0x5240458) returned 0x1 [0223.130] WbemDefPath:IUnknown:Release (This=0x5240458) returned 0x0 [0223.130] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.130] WbemDefPath:IUnknown:Release (This=0x5277ba8) returned 0x1 [0223.130] WbemDefPath:IUnknown:Release (This=0x5277ba8) returned 0x0 [0223.130] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.130] WbemDefPath:IUnknown:Release (This=0x51d7550) returned 0x1 [0223.130] WbemDefPath:IUnknown:Release (This=0x51d7550) returned 0x0 [0223.130] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.130] WbemDefPath:IUnknown:Release (This=0x523f818) returned 0x1 [0223.130] WbemDefPath:IUnknown:Release (This=0x523f818) returned 0x0 [0223.130] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.131] WbemDefPath:IUnknown:Release (This=0x5261980) returned 0x1 [0223.131] WbemDefPath:IUnknown:Release (This=0x5261980) returned 0x0 [0223.131] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.131] WbemDefPath:IUnknown:Release (This=0x5227b80) returned 0x1 [0223.131] WbemDefPath:IUnknown:Release (This=0x5227b80) returned 0x0 [0223.131] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.131] WbemDefPath:IUnknown:Release (This=0x5261360) returned 0x1 [0223.131] WbemDefPath:IUnknown:Release (This=0x5261360) returned 0x0 [0223.131] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.131] WbemDefPath:IUnknown:Release (This=0x5227560) returned 0x1 [0223.131] WbemDefPath:IUnknown:Release (This=0x5227560) returned 0x0 [0223.131] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.131] WbemDefPath:IUnknown:Release (This=0x5260d40) returned 0x1 [0223.132] WbemDefPath:IUnknown:Release (This=0x5260d40) returned 0x0 [0223.132] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.132] WbemDefPath:IUnknown:Release (This=0x5226f40) returned 0x1 [0223.132] WbemDefPath:IUnknown:Release (This=0x5226f40) returned 0x0 [0223.132] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.132] WbemDefPath:IUnknown:Release (This=0x51d75c0) returned 0x1 [0223.132] WbemDefPath:IUnknown:Release (This=0x51d75c0) returned 0x0 [0223.132] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.132] WbemDefPath:IUnknown:Release (This=0x5261a60) returned 0x1 [0223.132] WbemDefPath:IUnknown:Release (This=0x5261a60) returned 0x0 [0223.133] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.133] WbemDefPath:IUnknown:Release (This=0x52785b8) returned 0x1 [0223.133] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.133] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.134] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.134] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.134] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.134] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.134] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.134] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.134] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.134] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.134] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.134] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.134] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.134] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.135] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.135] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.135] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.135] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.135] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.135] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.135] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.135] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.135] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.135] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.136] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.136] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.136] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.136] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.136] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.137] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.137] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.138] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.138] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.138] CoGetContextToken (in: pToken=0x259f8b0 | out: pToken=0x259f8b0) returned 0x0 [0223.138] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.138] WbemLocator:IUnknown:Release (This=0x520b8e0) returned 0x1 [0223.138] WbemLocator:IUnknown:Release (This=0x526e828) returned 0x0 [0223.139] CoReleaseMarshalData (pStm=0x52097e0) returned 0x0 [0223.144] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.144] WbemLocator:IUnknown:Release (This=0x520c7e0) returned 0x1 [0223.144] WbemLocator:IUnknown:Release (This=0x526e8c8) returned 0x0 [0223.145] CoReleaseMarshalData (pStm=0x52098a0) returned 0x0 [0223.146] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.146] WbemLocator:IUnknown:Release (This=0x51de898) returned 0x1 [0223.146] WbemLocator:IUnknown:Release (This=0x51de898) returned 0x0 [0223.146] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.146] WbemLocator:IUnknown:Release (This=0x51de8b8) returned 0x1 [0223.146] WbemLocator:IUnknown:Release (This=0x51de8b8) returned 0x0 [0223.146] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.146] WbemLocator:IUnknown:Release (This=0x520c0e0) returned 0x1 [0223.146] WbemLocator:IUnknown:Release (This=0x51f1918) returned 0x0 [0223.147] CoReleaseMarshalData (pStm=0x51e14f0) returned 0x0 [0223.149] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.149] WbemLocator:IUnknown:Release (This=0x520c4e0) returned 0x1 [0223.149] WbemLocator:IUnknown:Release (This=0x51f15a8) returned 0x0 [0223.150] CoReleaseMarshalData (pStm=0x51b8070) returned 0x0 [0223.154] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.154] WbemLocator:IUnknown:Release (This=0x520c8e0) returned 0x1 [0223.154] WbemLocator:IUnknown:Release (This=0x526e148) returned 0x0 [0223.154] CoReleaseMarshalData (pStm=0x52099c0) returned 0x0 [0223.155] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.155] WbemLocator:IUnknown:Release (This=0x520d0e0) returned 0x1 [0223.155] WbemLocator:IUnknown:Release (This=0x51f1d78) returned 0x0 [0223.156] CoReleaseMarshalData (pStm=0x52099a0) returned 0x0 [0223.157] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.157] WbemLocator:IUnknown:Release (This=0x71d050) returned 0x1 [0223.157] WbemLocator:IUnknown:Release (This=0x71d050) returned 0x0 [0223.157] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.157] WbemLocator:IUnknown:Release (This=0x716c50) returned 0x1 [0223.157] WbemLocator:IUnknown:Release (This=0x7254f0) returned 0x0 [0223.158] CoReleaseMarshalData (pStm=0x51e1030) returned 0x0 [0223.159] CoGetContextToken (in: pToken=0x259f830 | out: pToken=0x259f830) returned 0x0 [0223.159] WbemLocator:IUnknown:Release (This=0x520c9e0) returned 0x1 [0223.159] WbemLocator:IUnknown:Release (This=0x5248640) returned 0x0 [0223.160] CoReleaseMarshalData (pStm=0x5209ae0) returned 0x0 [0223.161] IUnknown:Release (This=0x66f9c0) returned 0x0 [0223.161] CoGetContextToken (in: pToken=0x259f8b0 | out: pToken=0x259f8b0) returned 0x0 [0223.161] IUnknown:QueryInterface (in: This=0x66f908, riid=0x6f12da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x259f854 | out: ppvObject=0x259f854*=0x66f918) returned 0x0 [0223.161] CObjectContext::ContextCallback () returned 0x0 [0223.170] IUnknown:Release (This=0x66f918) returned 0x1 [0223.170] IUnknown:Release (This=0x66f908) returned 0x0 Thread: id = 6 os_tid = 0x12f4 Thread: id = 7 os_tid = 0x12f8 Thread: id = 8 os_tid = 0x1310 Thread: id = 9 os_tid = 0x1314 Thread: id = 10 os_tid = 0x1318 [0149.870] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0149.870] RoInitialize () returned 0x1 [0149.870] RoUninitialize () returned 0x0 [0149.873] ResetEvent (hEvent=0x3a8) returned 1 Thread: id = 11 os_tid = 0x1320 Thread: id = 12 os_tid = 0x1324 Thread: id = 13 os_tid = 0x1328 [0161.155] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0161.155] RoInitialize () returned 0x1 [0161.155] RoUninitialize () returned 0x0 [0161.175] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x5e0f53c | out: lpiid=0x5e0f53c) returned 0x0 [0161.180] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51deab8) returned 0x0 [0162.087] WbemDefPath:IUnknown:QueryInterface (in: This=0x51deab8, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0162.087] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51deab8, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x51d7b70) returned 0x0 [0162.088] WbemDefPath:IUnknown:Release (This=0x51deab8) returned 0x0 [0162.088] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7b70, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x51d7b70) returned 0x0 [0162.091] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7b70, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0162.091] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7b70, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0162.091] WbemDefPath:IUnknown:AddRef (This=0x51d7b70) returned 0x3 [0162.091] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7b70, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0162.091] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7b70, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0162.091] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7b70, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x72c9e0) returned 0x0 [0162.091] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x72c9e0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0162.091] WbemDefPath:IUnknown:Release (This=0x72c9e0) returned 0x3 [0162.091] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0162.093] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0162.093] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7b70, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0162.093] WbemDefPath:IUnknown:Release (This=0x51d7b70) returned 0x2 [0162.093] WbemDefPath:IUnknown:Release (This=0x51d7b70) returned 0x1 [0162.094] SetEvent (hEvent=0x648) returned 1 [0167.272] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51dec88) returned 0x0 [0167.272] WbemDefPath:IUnknown:QueryInterface (in: This=0x51dec88, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0167.272] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51dec88, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x51d7da0) returned 0x0 [0167.272] WbemDefPath:IUnknown:Release (This=0x51dec88) returned 0x0 [0167.272] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7da0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x51d7da0) returned 0x0 [0167.272] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7da0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0167.272] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7da0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0167.273] WbemDefPath:IUnknown:AddRef (This=0x51d7da0) returned 0x3 [0167.273] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7da0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0167.273] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7da0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0167.273] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7da0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x72bdb0) returned 0x0 [0167.273] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x72bdb0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0167.273] WbemDefPath:IUnknown:Release (This=0x72bdb0) returned 0x3 [0167.273] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0167.273] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0167.273] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7da0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0167.273] WbemDefPath:IUnknown:Release (This=0x51d7da0) returned 0x2 [0167.273] WbemDefPath:IUnknown:Release (This=0x51d7da0) returned 0x1 [0167.273] SetEvent (hEvent=0x6ec) returned 1 [0173.025] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51dec08) returned 0x0 [0173.026] WbemDefPath:IUnknown:QueryInterface (in: This=0x51dec08, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0173.026] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51dec08, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x51d7be0) returned 0x0 [0173.026] WbemDefPath:IUnknown:Release (This=0x51dec08) returned 0x0 [0173.026] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7be0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x51d7be0) returned 0x0 [0173.026] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7be0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0173.026] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7be0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0173.026] WbemDefPath:IUnknown:AddRef (This=0x51d7be0) returned 0x3 [0173.026] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7be0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0173.026] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7be0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0173.026] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7be0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x72ca28) returned 0x0 [0173.026] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x72ca28, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0173.026] WbemDefPath:IUnknown:Release (This=0x72ca28) returned 0x3 [0173.026] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0173.027] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0173.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7be0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0173.027] WbemDefPath:IUnknown:Release (This=0x51d7be0) returned 0x2 [0173.027] WbemDefPath:IUnknown:Release (This=0x51d7be0) returned 0x1 [0173.027] SetEvent (hEvent=0x730) returned 1 [0173.620] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de678) returned 0x0 [0173.620] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de678, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0173.620] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de678, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x51d8270) returned 0x0 [0173.620] WbemDefPath:IUnknown:Release (This=0x51de678) returned 0x0 [0173.620] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8270, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x51d8270) returned 0x0 [0173.620] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8270, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0173.620] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8270, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0173.621] WbemDefPath:IUnknown:AddRef (This=0x51d8270) returned 0x3 [0173.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8270, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0173.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8270, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0173.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8270, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x72c4e8) returned 0x0 [0173.621] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x72c4e8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0173.621] WbemDefPath:IUnknown:Release (This=0x72c4e8) returned 0x3 [0173.621] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0173.621] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0173.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8270, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0173.621] WbemDefPath:IUnknown:Release (This=0x51d8270) returned 0x2 [0173.621] WbemDefPath:IUnknown:Release (This=0x51d8270) returned 0x1 [0173.621] SetEvent (hEvent=0x2c8) returned 1 [0173.694] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de738) returned 0x0 [0173.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de738, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0173.694] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de738, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x51d7a90) returned 0x0 [0173.694] WbemDefPath:IUnknown:Release (This=0x51de738) returned 0x0 [0173.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7a90, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x51d7a90) returned 0x0 [0173.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7a90, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0173.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7a90, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0173.694] WbemDefPath:IUnknown:AddRef (This=0x51d7a90) returned 0x3 [0173.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7a90, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0173.695] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7a90, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0173.695] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7a90, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x72c7e8) returned 0x0 [0173.695] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x72c7e8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0173.695] WbemDefPath:IUnknown:Release (This=0x72c7e8) returned 0x3 [0173.695] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0173.695] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0173.695] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7a90, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0173.695] WbemDefPath:IUnknown:Release (This=0x51d7a90) returned 0x2 [0173.695] WbemDefPath:IUnknown:Release (This=0x51d7a90) returned 0x1 [0173.695] SetEvent (hEvent=0x2e8) returned 1 [0173.757] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de888) returned 0x0 [0173.757] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de888, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0173.757] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de888, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x51d7b00) returned 0x0 [0173.757] WbemDefPath:IUnknown:Release (This=0x51de888) returned 0x0 [0173.757] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7b00, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x51d7b00) returned 0x0 [0173.757] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7b00, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0173.757] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7b00, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0173.757] WbemDefPath:IUnknown:AddRef (This=0x51d7b00) returned 0x3 [0173.757] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7b00, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0173.757] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7b00, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0173.757] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7b00, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x72c650) returned 0x0 [0173.757] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x72c650, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0173.757] WbemDefPath:IUnknown:Release (This=0x72c650) returned 0x3 [0173.757] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0173.757] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0173.757] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7b00, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0173.757] WbemDefPath:IUnknown:Release (This=0x51d7b00) returned 0x2 [0173.757] WbemDefPath:IUnknown:Release (This=0x51d7b00) returned 0x1 [0173.758] SetEvent (hEvent=0x330) returned 1 [0173.872] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de858) returned 0x0 [0173.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de858, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0173.872] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de858, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x51d77f0) returned 0x0 [0173.872] WbemDefPath:IUnknown:Release (This=0x51de858) returned 0x0 [0173.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d77f0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x51d77f0) returned 0x0 [0173.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d77f0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0173.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d77f0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0173.872] WbemDefPath:IUnknown:AddRef (This=0x51d77f0) returned 0x3 [0173.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d77f0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0173.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d77f0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0173.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d77f0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5210108) returned 0x0 [0173.872] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5210108, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0173.872] WbemDefPath:IUnknown:Release (This=0x5210108) returned 0x3 [0173.872] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0173.873] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0173.873] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d77f0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0173.873] WbemDefPath:IUnknown:Release (This=0x51d77f0) returned 0x2 [0173.873] WbemDefPath:IUnknown:Release (This=0x51d77f0) returned 0x1 [0173.873] SetEvent (hEvent=0x558) returned 1 [0173.881] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de778) returned 0x0 [0173.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de778, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0173.881] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de778, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x51d7e80) returned 0x0 [0173.881] WbemDefPath:IUnknown:Release (This=0x51de778) returned 0x0 [0173.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7e80, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x51d7e80) returned 0x0 [0173.882] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7e80, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0173.882] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7e80, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0173.882] WbemDefPath:IUnknown:AddRef (This=0x51d7e80) returned 0x3 [0173.882] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7e80, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0173.882] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7e80, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0173.882] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7e80, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x52101e0) returned 0x0 [0173.882] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x52101e0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0173.882] WbemDefPath:IUnknown:Release (This=0x52101e0) returned 0x3 [0173.882] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0173.882] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0173.882] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7e80, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0173.882] WbemDefPath:IUnknown:Release (This=0x51d7e80) returned 0x2 [0173.882] WbemDefPath:IUnknown:Release (This=0x51d7e80) returned 0x1 [0173.882] SetEvent (hEvent=0x3b4) returned 1 [0173.989] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de858) returned 0x0 [0173.989] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de858, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0173.989] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de858, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x51d7780) returned 0x0 [0173.989] WbemDefPath:IUnknown:Release (This=0x51de858) returned 0x0 [0173.989] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7780, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x51d7780) returned 0x0 [0173.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7780, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0173.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7780, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0173.990] WbemDefPath:IUnknown:AddRef (This=0x51d7780) returned 0x3 [0173.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7780, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0173.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7780, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0173.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7780, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x52104c8) returned 0x0 [0173.990] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x52104c8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0173.990] WbemDefPath:IUnknown:Release (This=0x52104c8) returned 0x3 [0173.990] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0173.990] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0173.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7780, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0173.990] WbemDefPath:IUnknown:Release (This=0x51d7780) returned 0x2 [0173.990] WbemDefPath:IUnknown:Release (This=0x51d7780) returned 0x1 [0173.990] SetEvent (hEvent=0x494) returned 1 [0173.997] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de928) returned 0x0 [0173.997] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de928, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0173.997] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de928, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x51d7a20) returned 0x0 [0173.997] WbemDefPath:IUnknown:Release (This=0x51de928) returned 0x0 [0173.997] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7a20, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x51d7a20) returned 0x0 [0173.997] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7a20, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0173.997] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7a20, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0173.997] WbemDefPath:IUnknown:AddRef (This=0x51d7a20) returned 0x3 [0173.997] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7a20, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0173.997] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7a20, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0173.997] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7a20, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5210540) returned 0x0 [0173.997] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5210540, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0173.998] WbemDefPath:IUnknown:Release (This=0x5210540) returned 0x3 [0173.998] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0173.998] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0173.998] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7a20, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0173.998] WbemDefPath:IUnknown:Release (This=0x51d7a20) returned 0x2 [0173.998] WbemDefPath:IUnknown:Release (This=0x51d7a20) returned 0x1 [0173.998] SetEvent (hEvent=0x4c0) returned 1 [0175.501] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de858) returned 0x0 [0175.501] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de858, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0175.501] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de858, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x51d78d0) returned 0x0 [0175.501] WbemDefPath:IUnknown:Release (This=0x51de858) returned 0x0 [0175.501] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d78d0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x51d78d0) returned 0x0 [0175.501] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d78d0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0175.501] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d78d0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0175.502] WbemDefPath:IUnknown:AddRef (This=0x51d78d0) returned 0x3 [0175.502] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d78d0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0175.502] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d78d0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0175.502] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d78d0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x520f9e8) returned 0x0 [0175.502] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x520f9e8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0175.502] WbemDefPath:IUnknown:Release (This=0x520f9e8) returned 0x3 [0175.502] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0175.502] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0175.502] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d78d0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0175.502] WbemDefPath:IUnknown:Release (This=0x51d78d0) returned 0x2 [0175.502] WbemDefPath:IUnknown:Release (This=0x51d78d0) returned 0x1 [0175.502] SetEvent (hEvent=0x758) returned 1 [0175.591] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de858) returned 0x0 [0175.592] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de858, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0175.592] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de858, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x51d7ef0) returned 0x0 [0175.592] WbemDefPath:IUnknown:Release (This=0x51de858) returned 0x0 [0175.592] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7ef0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x51d7ef0) returned 0x0 [0175.592] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7ef0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0175.592] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7ef0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0175.592] WbemDefPath:IUnknown:AddRef (This=0x51d7ef0) returned 0x3 [0175.592] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7ef0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0175.592] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7ef0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0175.592] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7ef0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x520faf0) returned 0x0 [0175.592] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x520faf0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0175.593] WbemDefPath:IUnknown:Release (This=0x520faf0) returned 0x3 [0175.593] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0175.593] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0175.593] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7ef0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0175.593] WbemDefPath:IUnknown:Release (This=0x51d7ef0) returned 0x2 [0175.593] WbemDefPath:IUnknown:Release (This=0x51d7ef0) returned 0x1 [0175.593] SetEvent (hEvent=0x75c) returned 1 [0175.685] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de8c8) returned 0x0 [0175.685] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de8c8, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0175.685] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de8c8, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x51d7f60) returned 0x0 [0175.685] WbemDefPath:IUnknown:Release (This=0x51de8c8) returned 0x0 [0175.685] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7f60, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x51d7f60) returned 0x0 [0175.685] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7f60, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0175.686] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7f60, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0175.686] WbemDefPath:IUnknown:AddRef (This=0x51d7f60) returned 0x3 [0175.686] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7f60, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0175.686] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7f60, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0175.686] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7f60, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x520fdc0) returned 0x0 [0175.686] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x520fdc0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0175.686] WbemDefPath:IUnknown:Release (This=0x520fdc0) returned 0x3 [0175.686] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0175.686] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0175.686] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7f60, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0175.686] WbemDefPath:IUnknown:Release (This=0x51d7f60) returned 0x2 [0175.686] WbemDefPath:IUnknown:Release (This=0x51d7f60) returned 0x1 [0175.686] SetEvent (hEvent=0x760) returned 1 [0175.779] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51deb58) returned 0x0 [0175.779] WbemDefPath:IUnknown:QueryInterface (in: This=0x51deb58, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0175.779] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51deb58, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x51d7550) returned 0x0 [0175.779] WbemDefPath:IUnknown:Release (This=0x51deb58) returned 0x0 [0175.779] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7550, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x51d7550) returned 0x0 [0175.779] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7550, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0175.779] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7550, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0175.779] WbemDefPath:IUnknown:AddRef (This=0x51d7550) returned 0x3 [0175.779] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7550, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0175.780] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7550, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0175.780] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7550, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x520fd90) returned 0x0 [0175.780] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x520fd90, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0175.780] WbemDefPath:IUnknown:Release (This=0x520fd90) returned 0x3 [0175.780] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0175.780] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0175.780] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7550, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0175.780] WbemDefPath:IUnknown:Release (This=0x51d7550) returned 0x2 [0175.780] WbemDefPath:IUnknown:Release (This=0x51d7550) returned 0x1 [0175.780] SetEvent (hEvent=0x768) returned 1 [0175.882] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51deb38) returned 0x0 [0175.882] WbemDefPath:IUnknown:QueryInterface (in: This=0x51deb38, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0175.882] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51deb38, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x51d7940) returned 0x0 [0175.882] WbemDefPath:IUnknown:Release (This=0x51deb38) returned 0x0 [0175.882] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7940, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x51d7940) returned 0x0 [0175.882] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7940, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0175.882] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7940, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0175.883] WbemDefPath:IUnknown:AddRef (This=0x51d7940) returned 0x3 [0175.883] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7940, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0175.883] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7940, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0175.883] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7940, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x52194b8) returned 0x0 [0175.884] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x52194b8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0175.884] WbemDefPath:IUnknown:Release (This=0x52194b8) returned 0x3 [0175.884] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0175.884] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0175.884] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7940, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0175.884] WbemDefPath:IUnknown:Release (This=0x51d7940) returned 0x2 [0175.884] WbemDefPath:IUnknown:Release (This=0x51d7940) returned 0x1 [0175.884] SetEvent (hEvent=0x764) returned 1 [0175.982] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51deb38) returned 0x0 [0175.982] WbemDefPath:IUnknown:QueryInterface (in: This=0x51deb38, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0175.982] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51deb38, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x51d8120) returned 0x0 [0175.982] WbemDefPath:IUnknown:Release (This=0x51deb38) returned 0x0 [0175.982] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8120, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x51d8120) returned 0x0 [0175.982] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8120, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0175.982] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8120, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0175.983] WbemDefPath:IUnknown:AddRef (This=0x51d8120) returned 0x3 [0175.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8120, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0175.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8120, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0175.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8120, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5219698) returned 0x0 [0175.983] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5219698, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0175.983] WbemDefPath:IUnknown:Release (This=0x5219698) returned 0x3 [0175.983] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0175.983] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0175.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8120, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0175.983] WbemDefPath:IUnknown:Release (This=0x51d8120) returned 0x2 [0175.983] WbemDefPath:IUnknown:Release (This=0x51d8120) returned 0x1 [0175.983] SetEvent (hEvent=0x76c) returned 1 [0176.076] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51deb38) returned 0x0 [0176.077] WbemDefPath:IUnknown:QueryInterface (in: This=0x51deb38, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0176.077] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51deb38, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x51d8190) returned 0x0 [0176.077] WbemDefPath:IUnknown:Release (This=0x51deb38) returned 0x0 [0176.077] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8190, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x51d8190) returned 0x0 [0176.077] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8190, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0176.077] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8190, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0176.077] WbemDefPath:IUnknown:AddRef (This=0x51d8190) returned 0x3 [0176.077] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8190, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0176.077] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8190, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0176.077] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8190, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5218a68) returned 0x0 [0176.078] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5218a68, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0176.078] WbemDefPath:IUnknown:Release (This=0x5218a68) returned 0x3 [0176.078] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0176.078] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0176.078] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8190, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0176.078] WbemDefPath:IUnknown:Release (This=0x51d8190) returned 0x2 [0176.078] WbemDefPath:IUnknown:Release (This=0x51d8190) returned 0x1 [0176.078] SetEvent (hEvent=0x770) returned 1 [0176.200] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51deb38) returned 0x0 [0176.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x51deb38, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0176.201] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51deb38, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x51d79b0) returned 0x0 [0176.201] WbemDefPath:IUnknown:Release (This=0x51deb38) returned 0x0 [0176.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d79b0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x51d79b0) returned 0x0 [0176.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d79b0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0176.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d79b0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0176.201] WbemDefPath:IUnknown:AddRef (This=0x51d79b0) returned 0x3 [0176.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d79b0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0176.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d79b0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0176.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d79b0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x52188d0) returned 0x0 [0176.201] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x52188d0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0176.201] WbemDefPath:IUnknown:Release (This=0x52188d0) returned 0x3 [0176.202] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0176.202] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0176.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d79b0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0176.202] WbemDefPath:IUnknown:Release (This=0x51d79b0) returned 0x2 [0176.202] WbemDefPath:IUnknown:Release (This=0x51d79b0) returned 0x1 [0176.202] SetEvent (hEvent=0x774) returned 1 [0176.294] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51deb38) returned 0x0 [0176.295] WbemDefPath:IUnknown:QueryInterface (in: This=0x51deb38, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0176.295] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51deb38, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x51d7c50) returned 0x0 [0176.295] WbemDefPath:IUnknown:Release (This=0x51deb38) returned 0x0 [0176.295] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7c50, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x51d7c50) returned 0x0 [0176.295] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7c50, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0176.295] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7c50, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0176.295] WbemDefPath:IUnknown:AddRef (This=0x51d7c50) returned 0x3 [0176.295] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7c50, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0176.295] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7c50, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0176.295] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7c50, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5218be8) returned 0x0 [0176.295] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5218be8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0176.295] WbemDefPath:IUnknown:Release (This=0x5218be8) returned 0x3 [0176.295] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0176.295] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0176.295] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7c50, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0176.296] WbemDefPath:IUnknown:Release (This=0x51d7c50) returned 0x2 [0176.296] WbemDefPath:IUnknown:Release (This=0x51d7c50) returned 0x1 [0176.296] SetEvent (hEvent=0x778) returned 1 [0176.315] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51deb38) returned 0x0 [0176.315] WbemDefPath:IUnknown:QueryInterface (in: This=0x51deb38, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0176.315] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51deb38, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x51d7fd0) returned 0x0 [0176.315] WbemDefPath:IUnknown:Release (This=0x51deb38) returned 0x0 [0176.315] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7fd0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x51d7fd0) returned 0x0 [0176.316] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7fd0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0176.316] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7fd0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0176.316] WbemDefPath:IUnknown:AddRef (This=0x51d7fd0) returned 0x3 [0176.316] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7fd0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0176.316] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7fd0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0176.316] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7fd0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5218b88) returned 0x0 [0176.316] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5218b88, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0176.316] WbemDefPath:IUnknown:Release (This=0x5218b88) returned 0x3 [0176.316] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0176.316] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0176.316] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7fd0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0176.316] WbemDefPath:IUnknown:Release (This=0x51d7fd0) returned 0x2 [0176.316] WbemDefPath:IUnknown:Release (This=0x51d7fd0) returned 0x1 [0176.316] SetEvent (hEvent=0x77c) returned 1 [0176.403] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51deb38) returned 0x0 [0176.404] WbemDefPath:IUnknown:QueryInterface (in: This=0x51deb38, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0176.404] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51deb38, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x51d8040) returned 0x0 [0176.404] WbemDefPath:IUnknown:Release (This=0x51deb38) returned 0x0 [0176.404] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8040, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x51d8040) returned 0x0 [0176.404] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8040, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0176.404] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8040, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0176.404] WbemDefPath:IUnknown:AddRef (This=0x51d8040) returned 0x3 [0176.404] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8040, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0176.404] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8040, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0176.404] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8040, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5218fa8) returned 0x0 [0176.404] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5218fa8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0176.405] WbemDefPath:IUnknown:Release (This=0x5218fa8) returned 0x3 [0176.405] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0176.405] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0176.405] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8040, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0176.405] WbemDefPath:IUnknown:Release (This=0x51d8040) returned 0x2 [0176.405] WbemDefPath:IUnknown:Release (This=0x51d8040) returned 0x1 [0176.405] SetEvent (hEvent=0x780) returned 1 [0176.527] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51deb58) returned 0x0 [0176.527] WbemDefPath:IUnknown:QueryInterface (in: This=0x51deb58, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0176.527] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51deb58, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x51d75c0) returned 0x0 [0176.528] WbemDefPath:IUnknown:Release (This=0x51deb58) returned 0x0 [0176.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d75c0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x51d75c0) returned 0x0 [0176.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d75c0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0176.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d75c0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0176.528] WbemDefPath:IUnknown:AddRef (This=0x51d75c0) returned 0x3 [0176.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d75c0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0176.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d75c0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0176.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d75c0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5219080) returned 0x0 [0176.528] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5219080, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0176.528] WbemDefPath:IUnknown:Release (This=0x5219080) returned 0x3 [0176.528] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0176.528] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0176.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d75c0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0176.528] WbemDefPath:IUnknown:Release (This=0x51d75c0) returned 0x2 [0176.529] WbemDefPath:IUnknown:Release (This=0x51d75c0) returned 0x1 [0176.529] SetEvent (hEvent=0x784) returned 1 [0176.621] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51deb58) returned 0x0 [0176.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x51deb58, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0176.622] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51deb58, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x51d7630) returned 0x0 [0176.622] WbemDefPath:IUnknown:Release (This=0x51deb58) returned 0x0 [0176.622] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7630, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x51d7630) returned 0x0 [0176.622] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7630, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0176.622] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7630, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0176.622] WbemDefPath:IUnknown:AddRef (This=0x51d7630) returned 0x3 [0176.622] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7630, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0176.622] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7630, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0176.622] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7630, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x52191a0) returned 0x0 [0176.622] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x52191a0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0176.622] WbemDefPath:IUnknown:Release (This=0x52191a0) returned 0x3 [0176.622] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0176.622] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0176.622] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d7630, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0176.623] WbemDefPath:IUnknown:Release (This=0x51d7630) returned 0x2 [0176.623] WbemDefPath:IUnknown:Release (This=0x51d7630) returned 0x1 [0176.623] SetEvent (hEvent=0x788) returned 1 [0176.721] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51deb58) returned 0x0 [0176.721] WbemDefPath:IUnknown:QueryInterface (in: This=0x51deb58, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0176.721] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51deb58, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x51d76a0) returned 0x0 [0176.722] WbemDefPath:IUnknown:Release (This=0x51deb58) returned 0x0 [0176.722] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d76a0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x51d76a0) returned 0x0 [0176.722] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d76a0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0176.722] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d76a0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0176.722] WbemDefPath:IUnknown:AddRef (This=0x51d76a0) returned 0x3 [0176.722] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d76a0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0176.722] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d76a0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0176.722] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d76a0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5223998) returned 0x0 [0176.722] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5223998, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0176.722] WbemDefPath:IUnknown:Release (This=0x5223998) returned 0x3 [0176.722] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0176.722] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0176.722] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d76a0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0176.723] WbemDefPath:IUnknown:Release (This=0x51d76a0) returned 0x2 [0176.723] WbemDefPath:IUnknown:Release (This=0x51d76a0) returned 0x1 [0176.723] SetEvent (hEvent=0x78c) returned 1 [0176.814] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51deb58) returned 0x0 [0176.815] WbemDefPath:IUnknown:QueryInterface (in: This=0x51deb58, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0176.815] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51deb58, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x51d84a0) returned 0x0 [0176.815] WbemDefPath:IUnknown:Release (This=0x51deb58) returned 0x0 [0176.815] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d84a0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x51d84a0) returned 0x0 [0176.815] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d84a0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0176.815] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d84a0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0176.815] WbemDefPath:IUnknown:AddRef (This=0x51d84a0) returned 0x3 [0176.815] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d84a0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0176.815] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d84a0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0176.815] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d84a0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5223a40) returned 0x0 [0176.815] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5223a40, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0176.815] WbemDefPath:IUnknown:Release (This=0x5223a40) returned 0x3 [0176.815] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0176.815] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0176.815] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d84a0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0176.816] WbemDefPath:IUnknown:Release (This=0x51d84a0) returned 0x2 [0176.816] WbemDefPath:IUnknown:Release (This=0x51d84a0) returned 0x1 [0176.816] SetEvent (hEvent=0x790) returned 1 [0176.908] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de638) returned 0x0 [0176.908] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de638, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0176.909] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de638, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x51d83c0) returned 0x0 [0176.909] WbemDefPath:IUnknown:Release (This=0x51de638) returned 0x0 [0176.909] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d83c0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x51d83c0) returned 0x0 [0176.909] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d83c0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0176.909] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d83c0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0176.909] WbemDefPath:IUnknown:AddRef (This=0x51d83c0) returned 0x3 [0176.909] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d83c0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0176.909] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d83c0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0176.909] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d83c0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5223b78) returned 0x0 [0176.909] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5223b78, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0176.909] WbemDefPath:IUnknown:Release (This=0x5223b78) returned 0x3 [0176.909] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0176.909] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0176.909] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d83c0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0176.909] WbemDefPath:IUnknown:Release (This=0x51d83c0) returned 0x2 [0176.909] WbemDefPath:IUnknown:Release (This=0x51d83c0) returned 0x1 [0176.909] SetEvent (hEvent=0x794) returned 1 [0177.003] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.003] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.003] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x51d8430) returned 0x0 [0177.003] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.003] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8430, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x51d8430) returned 0x0 [0177.003] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8430, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.003] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8430, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.003] WbemDefPath:IUnknown:AddRef (This=0x51d8430) returned 0x3 [0177.003] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8430, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.003] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8430, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.003] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8430, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5221d60) returned 0x0 [0177.003] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5221d60, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.003] WbemDefPath:IUnknown:Release (This=0x5221d60) returned 0x3 [0177.003] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.004] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.004] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8430, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.004] WbemDefPath:IUnknown:Release (This=0x51d8430) returned 0x2 [0177.004] WbemDefPath:IUnknown:Release (This=0x51d8430) returned 0x1 [0177.004] SetEvent (hEvent=0x798) returned 1 [0177.096] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.096] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.097] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x51d8350) returned 0x0 [0177.097] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.097] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8350, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x51d8350) returned 0x0 [0177.097] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8350, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.097] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8350, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.097] WbemDefPath:IUnknown:AddRef (This=0x51d8350) returned 0x3 [0177.097] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8350, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.097] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8350, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.097] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8350, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5221cd0) returned 0x0 [0177.097] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5221cd0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.097] WbemDefPath:IUnknown:Release (This=0x5221cd0) returned 0x3 [0177.097] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.097] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.097] WbemDefPath:IUnknown:QueryInterface (in: This=0x51d8350, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.098] WbemDefPath:IUnknown:Release (This=0x51d8350) returned 0x2 [0177.098] WbemDefPath:IUnknown:Release (This=0x51d8350) returned 0x1 [0177.098] SetEvent (hEvent=0x79c) returned 1 [0177.221] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.222] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.222] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x6ef318) returned 0x0 [0177.222] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.222] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ef318, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x6ef318) returned 0x0 [0177.222] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ef318, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.222] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ef318, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.222] WbemDefPath:IUnknown:AddRef (This=0x6ef318) returned 0x3 [0177.222] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ef318, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.222] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ef318, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.222] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ef318, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5222210) returned 0x0 [0177.222] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5222210, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.223] WbemDefPath:IUnknown:Release (This=0x5222210) returned 0x3 [0177.223] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.223] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.223] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ef318, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.223] WbemDefPath:IUnknown:Release (This=0x6ef318) returned 0x2 [0177.223] WbemDefPath:IUnknown:Release (This=0x6ef318) returned 0x1 [0177.223] SetEvent (hEvent=0x7a0) returned 1 [0177.317] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.317] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.317] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5227100) returned 0x0 [0177.317] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.317] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227100, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5227100) returned 0x0 [0177.317] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227100, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.317] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227100, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.317] WbemDefPath:IUnknown:AddRef (This=0x5227100) returned 0x3 [0177.318] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227100, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.318] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227100, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.318] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227100, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5222018) returned 0x0 [0177.318] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5222018, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.318] WbemDefPath:IUnknown:Release (This=0x5222018) returned 0x3 [0177.318] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.318] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.318] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227100, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.318] WbemDefPath:IUnknown:Release (This=0x5227100) returned 0x2 [0177.318] WbemDefPath:IUnknown:Release (This=0x5227100) returned 0x1 [0177.318] SetEvent (hEvent=0x7a4) returned 1 [0177.323] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.323] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.323] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5227480) returned 0x0 [0177.323] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.323] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227480, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5227480) returned 0x0 [0177.324] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227480, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.324] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227480, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.324] WbemDefPath:IUnknown:AddRef (This=0x5227480) returned 0x3 [0177.324] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227480, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.324] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227480, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.324] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227480, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5222540) returned 0x0 [0177.324] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5222540, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.324] WbemDefPath:IUnknown:Release (This=0x5222540) returned 0x3 [0177.324] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.324] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.324] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227480, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.324] WbemDefPath:IUnknown:Release (This=0x5227480) returned 0x2 [0177.324] WbemDefPath:IUnknown:Release (This=0x5227480) returned 0x1 [0177.324] SetEvent (hEvent=0x7a8) returned 1 [0177.330] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.330] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.330] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5227170) returned 0x0 [0177.330] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.330] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227170, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5227170) returned 0x0 [0177.330] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227170, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.330] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227170, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.330] WbemDefPath:IUnknown:AddRef (This=0x5227170) returned 0x3 [0177.330] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227170, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.330] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227170, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.330] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227170, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5222360) returned 0x0 [0177.331] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5222360, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.331] WbemDefPath:IUnknown:Release (This=0x5222360) returned 0x3 [0177.331] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.331] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.331] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227170, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.331] WbemDefPath:IUnknown:Release (This=0x5227170) returned 0x2 [0177.331] WbemDefPath:IUnknown:Release (This=0x5227170) returned 0x1 [0177.331] SetEvent (hEvent=0x7ac) returned 1 [0177.337] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de638) returned 0x0 [0177.337] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de638, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.337] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de638, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x52271e0) returned 0x0 [0177.337] WbemDefPath:IUnknown:Release (This=0x51de638) returned 0x0 [0177.337] WbemDefPath:IUnknown:QueryInterface (in: This=0x52271e0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x52271e0) returned 0x0 [0177.337] WbemDefPath:IUnknown:QueryInterface (in: This=0x52271e0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.337] WbemDefPath:IUnknown:QueryInterface (in: This=0x52271e0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.337] WbemDefPath:IUnknown:AddRef (This=0x52271e0) returned 0x3 [0177.337] WbemDefPath:IUnknown:QueryInterface (in: This=0x52271e0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.338] WbemDefPath:IUnknown:QueryInterface (in: This=0x52271e0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.338] WbemDefPath:IUnknown:QueryInterface (in: This=0x52271e0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5222738) returned 0x0 [0177.338] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5222738, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.338] WbemDefPath:IUnknown:Release (This=0x5222738) returned 0x3 [0177.338] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.338] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.338] WbemDefPath:IUnknown:QueryInterface (in: This=0x52271e0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.338] WbemDefPath:IUnknown:Release (This=0x52271e0) returned 0x2 [0177.338] WbemDefPath:IUnknown:Release (This=0x52271e0) returned 0x1 [0177.338] SetEvent (hEvent=0x7b0) returned 1 [0177.343] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.344] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.344] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5226d80) returned 0x0 [0177.344] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.344] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226d80, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5226d80) returned 0x0 [0177.344] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226d80, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.344] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226d80, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.344] WbemDefPath:IUnknown:AddRef (This=0x5226d80) returned 0x3 [0177.344] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226d80, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.344] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226d80, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.344] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226d80, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5222a20) returned 0x0 [0177.344] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5222a20, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.344] WbemDefPath:IUnknown:Release (This=0x5222a20) returned 0x3 [0177.344] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.344] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.344] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226d80, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.344] WbemDefPath:IUnknown:Release (This=0x5226d80) returned 0x2 [0177.344] WbemDefPath:IUnknown:Release (This=0x5226d80) returned 0x1 [0177.344] SetEvent (hEvent=0x7b4) returned 1 [0177.349] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de598) returned 0x0 [0177.349] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de598, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.349] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de598, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5227250) returned 0x0 [0177.349] WbemDefPath:IUnknown:Release (This=0x51de598) returned 0x0 [0177.349] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227250, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5227250) returned 0x0 [0177.350] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227250, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.350] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227250, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.350] WbemDefPath:IUnknown:AddRef (This=0x5227250) returned 0x3 [0177.350] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227250, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.350] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227250, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.350] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227250, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5222b40) returned 0x0 [0177.350] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5222b40, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.350] WbemDefPath:IUnknown:Release (This=0x5222b40) returned 0x3 [0177.350] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.350] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.350] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227250, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.350] WbemDefPath:IUnknown:Release (This=0x5227250) returned 0x2 [0177.350] WbemDefPath:IUnknown:Release (This=0x5227250) returned 0x1 [0177.350] SetEvent (hEvent=0x7b8) returned 1 [0177.355] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.355] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.355] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5227aa0) returned 0x0 [0177.355] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.355] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227aa0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5227aa0) returned 0x0 [0177.355] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227aa0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.355] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227aa0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.355] WbemDefPath:IUnknown:AddRef (This=0x5227aa0) returned 0x3 [0177.355] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227aa0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.355] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227aa0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.355] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227aa0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5222db0) returned 0x0 [0177.355] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5222db0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.355] WbemDefPath:IUnknown:Release (This=0x5222db0) returned 0x3 [0177.355] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.355] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.356] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227aa0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.356] WbemDefPath:IUnknown:Release (This=0x5227aa0) returned 0x2 [0177.356] WbemDefPath:IUnknown:Release (This=0x5227aa0) returned 0x1 [0177.356] SetEvent (hEvent=0x7bc) returned 1 [0177.360] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de638) returned 0x0 [0177.360] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de638, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.360] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de638, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5227790) returned 0x0 [0177.361] WbemDefPath:IUnknown:Release (This=0x51de638) returned 0x0 [0177.361] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227790, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5227790) returned 0x0 [0177.361] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227790, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.361] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227790, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.361] WbemDefPath:IUnknown:AddRef (This=0x5227790) returned 0x3 [0177.361] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227790, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.361] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227790, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.361] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227790, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5222e58) returned 0x0 [0177.361] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5222e58, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.361] WbemDefPath:IUnknown:Release (This=0x5222e58) returned 0x3 [0177.361] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.361] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.362] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227790, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.362] WbemDefPath:IUnknown:Release (This=0x5227790) returned 0x2 [0177.362] WbemDefPath:IUnknown:Release (This=0x5227790) returned 0x1 [0177.362] SetEvent (hEvent=0x7c0) returned 1 [0177.369] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.369] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5226d10) returned 0x0 [0177.369] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226d10, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5226d10) returned 0x0 [0177.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226d10, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226d10, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.370] WbemDefPath:IUnknown:AddRef (This=0x5226d10) returned 0x3 [0177.370] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226d10, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.370] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226d10, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.370] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226d10, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5223008) returned 0x0 [0177.370] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5223008, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.370] WbemDefPath:IUnknown:Release (This=0x5223008) returned 0x3 [0177.370] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.370] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.370] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226d10, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.370] WbemDefPath:IUnknown:Release (This=0x5226d10) returned 0x2 [0177.370] WbemDefPath:IUnknown:Release (This=0x5226d10) returned 0x1 [0177.370] SetEvent (hEvent=0x7c4) returned 1 [0177.380] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.380] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.380] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5227640) returned 0x0 [0177.381] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.381] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227640, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5227640) returned 0x0 [0177.381] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227640, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.381] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227640, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.381] WbemDefPath:IUnknown:AddRef (This=0x5227640) returned 0x3 [0177.381] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227640, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.381] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227640, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.381] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227640, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5223140) returned 0x0 [0177.381] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5223140, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.381] WbemDefPath:IUnknown:Release (This=0x5223140) returned 0x3 [0177.381] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.381] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.381] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227640, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.382] WbemDefPath:IUnknown:Release (This=0x5227640) returned 0x2 [0177.382] WbemDefPath:IUnknown:Release (This=0x5227640) returned 0x1 [0177.382] SetEvent (hEvent=0x7c8) returned 1 [0177.392] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.392] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.392] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x52274f0) returned 0x0 [0177.392] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.392] WbemDefPath:IUnknown:QueryInterface (in: This=0x52274f0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x52274f0) returned 0x0 [0177.392] WbemDefPath:IUnknown:QueryInterface (in: This=0x52274f0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.392] WbemDefPath:IUnknown:QueryInterface (in: This=0x52274f0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.392] WbemDefPath:IUnknown:AddRef (This=0x52274f0) returned 0x3 [0177.392] WbemDefPath:IUnknown:QueryInterface (in: This=0x52274f0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.392] WbemDefPath:IUnknown:QueryInterface (in: This=0x52274f0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.392] WbemDefPath:IUnknown:QueryInterface (in: This=0x52274f0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x52232f0) returned 0x0 [0177.393] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x52232f0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.393] WbemDefPath:IUnknown:Release (This=0x52232f0) returned 0x3 [0177.393] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.393] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.393] WbemDefPath:IUnknown:QueryInterface (in: This=0x52274f0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.393] WbemDefPath:IUnknown:Release (This=0x52274f0) returned 0x2 [0177.393] WbemDefPath:IUnknown:Release (This=0x52274f0) returned 0x1 [0177.393] SetEvent (hEvent=0x7cc) returned 1 [0177.401] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.401] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5226df0) returned 0x0 [0177.401] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226df0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5226df0) returned 0x0 [0177.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226df0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226df0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.401] WbemDefPath:IUnknown:AddRef (This=0x5226df0) returned 0x3 [0177.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226df0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.402] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226df0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.402] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226df0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5223398) returned 0x0 [0177.402] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5223398, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.402] WbemDefPath:IUnknown:Release (This=0x5223398) returned 0x3 [0177.402] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.402] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.402] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226df0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.402] WbemDefPath:IUnknown:Release (This=0x5226df0) returned 0x2 [0177.402] WbemDefPath:IUnknown:Release (This=0x5226df0) returned 0x1 [0177.402] SetEvent (hEvent=0x7d0) returned 1 [0177.406] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de638) returned 0x0 [0177.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de638, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.407] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de638, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5226e60) returned 0x0 [0177.407] WbemDefPath:IUnknown:Release (This=0x51de638) returned 0x0 [0177.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226e60, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5226e60) returned 0x0 [0177.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226e60, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226e60, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.407] WbemDefPath:IUnknown:AddRef (This=0x5226e60) returned 0x3 [0177.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226e60, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226e60, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226e60, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5223620) returned 0x0 [0177.407] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5223620, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.407] WbemDefPath:IUnknown:Release (This=0x5223620) returned 0x3 [0177.407] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.407] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226e60, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.407] WbemDefPath:IUnknown:Release (This=0x5226e60) returned 0x2 [0177.407] WbemDefPath:IUnknown:Release (This=0x5226e60) returned 0x1 [0177.407] SetEvent (hEvent=0x7d4) returned 1 [0177.413] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de598) returned 0x0 [0177.413] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de598, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.413] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de598, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5226ed0) returned 0x0 [0177.413] WbemDefPath:IUnknown:Release (This=0x51de598) returned 0x0 [0177.413] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226ed0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5226ed0) returned 0x0 [0177.413] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226ed0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.413] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226ed0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.413] WbemDefPath:IUnknown:AddRef (This=0x5226ed0) returned 0x3 [0177.414] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226ed0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.414] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226ed0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.414] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226ed0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x522e7d8) returned 0x0 [0177.414] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x522e7d8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.414] WbemDefPath:IUnknown:Release (This=0x522e7d8) returned 0x3 [0177.414] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.414] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.414] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226ed0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.414] WbemDefPath:IUnknown:Release (This=0x5226ed0) returned 0x2 [0177.414] WbemDefPath:IUnknown:Release (This=0x5226ed0) returned 0x1 [0177.414] SetEvent (hEvent=0x7d8) returned 1 [0177.431] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de638) returned 0x0 [0177.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de638, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.432] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de638, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5227870) returned 0x0 [0177.432] WbemDefPath:IUnknown:Release (This=0x51de638) returned 0x0 [0177.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227870, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5227870) returned 0x0 [0177.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227870, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227870, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.432] WbemDefPath:IUnknown:AddRef (This=0x5227870) returned 0x3 [0177.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227870, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227870, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227870, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x522e850) returned 0x0 [0177.432] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x522e850, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.432] WbemDefPath:IUnknown:Release (This=0x522e850) returned 0x3 [0177.432] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.432] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227870, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.432] WbemDefPath:IUnknown:Release (This=0x5227870) returned 0x2 [0177.432] WbemDefPath:IUnknown:Release (This=0x5227870) returned 0x1 [0177.433] SetEvent (hEvent=0x7dc) returned 1 [0177.437] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de638) returned 0x0 [0177.437] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de638, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.437] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de638, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x52278e0) returned 0x0 [0177.437] WbemDefPath:IUnknown:Release (This=0x51de638) returned 0x0 [0177.437] WbemDefPath:IUnknown:QueryInterface (in: This=0x52278e0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x52278e0) returned 0x0 [0177.438] WbemDefPath:IUnknown:QueryInterface (in: This=0x52278e0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.438] WbemDefPath:IUnknown:QueryInterface (in: This=0x52278e0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.438] WbemDefPath:IUnknown:AddRef (This=0x52278e0) returned 0x3 [0177.438] WbemDefPath:IUnknown:QueryInterface (in: This=0x52278e0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.438] WbemDefPath:IUnknown:QueryInterface (in: This=0x52278e0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.438] WbemDefPath:IUnknown:QueryInterface (in: This=0x52278e0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x522eaa8) returned 0x0 [0177.438] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x522eaa8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.438] WbemDefPath:IUnknown:Release (This=0x522eaa8) returned 0x3 [0177.438] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.438] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.438] WbemDefPath:IUnknown:QueryInterface (in: This=0x52278e0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.438] WbemDefPath:IUnknown:Release (This=0x52278e0) returned 0x2 [0177.438] WbemDefPath:IUnknown:Release (This=0x52278e0) returned 0x1 [0177.438] SetEvent (hEvent=0x7e0) returned 1 [0177.444] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de638) returned 0x0 [0177.445] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de638, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.445] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de638, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x52272c0) returned 0x0 [0177.445] WbemDefPath:IUnknown:Release (This=0x51de638) returned 0x0 [0177.445] WbemDefPath:IUnknown:QueryInterface (in: This=0x52272c0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x52272c0) returned 0x0 [0177.445] WbemDefPath:IUnknown:QueryInterface (in: This=0x52272c0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.445] WbemDefPath:IUnknown:QueryInterface (in: This=0x52272c0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.445] WbemDefPath:IUnknown:AddRef (This=0x52272c0) returned 0x3 [0177.445] WbemDefPath:IUnknown:QueryInterface (in: This=0x52272c0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.445] WbemDefPath:IUnknown:QueryInterface (in: This=0x52272c0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.445] WbemDefPath:IUnknown:QueryInterface (in: This=0x52272c0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x522e970) returned 0x0 [0177.445] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x522e970, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.445] WbemDefPath:IUnknown:Release (This=0x522e970) returned 0x3 [0177.445] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.445] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.445] WbemDefPath:IUnknown:QueryInterface (in: This=0x52272c0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.445] WbemDefPath:IUnknown:Release (This=0x52272c0) returned 0x2 [0177.445] WbemDefPath:IUnknown:Release (This=0x52272c0) returned 0x1 [0177.446] SetEvent (hEvent=0x7e4) returned 1 [0177.453] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.453] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.453] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5227330) returned 0x0 [0177.453] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.453] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227330, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5227330) returned 0x0 [0177.453] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227330, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.453] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227330, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.454] WbemDefPath:IUnknown:AddRef (This=0x5227330) returned 0x3 [0177.454] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227330, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.454] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227330, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.454] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227330, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x522ec40) returned 0x0 [0177.454] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x522ec40, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.454] WbemDefPath:IUnknown:Release (This=0x522ec40) returned 0x3 [0177.454] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.454] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.454] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227330, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.454] WbemDefPath:IUnknown:Release (This=0x5227330) returned 0x2 [0177.454] WbemDefPath:IUnknown:Release (This=0x5227330) returned 0x1 [0177.454] SetEvent (hEvent=0x7e8) returned 1 [0177.460] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.461] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.461] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x52273a0) returned 0x0 [0177.461] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.461] WbemDefPath:IUnknown:QueryInterface (in: This=0x52273a0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x52273a0) returned 0x0 [0177.461] WbemDefPath:IUnknown:QueryInterface (in: This=0x52273a0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.461] WbemDefPath:IUnknown:QueryInterface (in: This=0x52273a0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.461] WbemDefPath:IUnknown:AddRef (This=0x52273a0) returned 0x3 [0177.461] WbemDefPath:IUnknown:QueryInterface (in: This=0x52273a0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.461] WbemDefPath:IUnknown:QueryInterface (in: This=0x52273a0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.461] WbemDefPath:IUnknown:QueryInterface (in: This=0x52273a0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x522edf0) returned 0x0 [0177.461] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x522edf0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.461] WbemDefPath:IUnknown:Release (This=0x522edf0) returned 0x3 [0177.461] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.461] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.461] WbemDefPath:IUnknown:QueryInterface (in: This=0x52273a0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.461] WbemDefPath:IUnknown:Release (This=0x52273a0) returned 0x2 [0177.461] WbemDefPath:IUnknown:Release (This=0x52273a0) returned 0x1 [0177.461] SetEvent (hEvent=0x7ec) returned 1 [0177.469] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.469] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.469] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5227410) returned 0x0 [0177.469] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.469] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227410, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5227410) returned 0x0 [0177.469] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227410, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.469] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227410, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.469] WbemDefPath:IUnknown:AddRef (This=0x5227410) returned 0x3 [0177.469] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227410, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.469] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227410, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.469] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227410, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x522f000) returned 0x0 [0177.469] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x522f000, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.469] WbemDefPath:IUnknown:Release (This=0x522f000) returned 0x3 [0177.469] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.470] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.470] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227410, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.470] WbemDefPath:IUnknown:Release (This=0x5227410) returned 0x2 [0177.470] WbemDefPath:IUnknown:Release (This=0x5227410) returned 0x1 [0177.470] SetEvent (hEvent=0x7f0) returned 1 [0177.476] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de638) returned 0x0 [0177.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de638, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.476] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de638, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x52275d0) returned 0x0 [0177.477] WbemDefPath:IUnknown:Release (This=0x51de638) returned 0x0 [0177.477] WbemDefPath:IUnknown:QueryInterface (in: This=0x52275d0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x52275d0) returned 0x0 [0177.477] WbemDefPath:IUnknown:QueryInterface (in: This=0x52275d0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.477] WbemDefPath:IUnknown:QueryInterface (in: This=0x52275d0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.477] WbemDefPath:IUnknown:AddRef (This=0x52275d0) returned 0x3 [0177.477] WbemDefPath:IUnknown:QueryInterface (in: This=0x52275d0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.477] WbemDefPath:IUnknown:QueryInterface (in: This=0x52275d0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.477] WbemDefPath:IUnknown:QueryInterface (in: This=0x52275d0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x522f4b0) returned 0x0 [0177.477] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x522f4b0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.477] WbemDefPath:IUnknown:Release (This=0x522f4b0) returned 0x3 [0177.477] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.477] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.477] WbemDefPath:IUnknown:QueryInterface (in: This=0x52275d0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.477] WbemDefPath:IUnknown:Release (This=0x52275d0) returned 0x2 [0177.477] WbemDefPath:IUnknown:Release (This=0x52275d0) returned 0x1 [0177.477] SetEvent (hEvent=0x7f4) returned 1 [0177.482] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.482] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.482] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5227950) returned 0x0 [0177.482] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.482] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227950, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5227950) returned 0x0 [0177.482] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227950, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.482] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227950, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.482] WbemDefPath:IUnknown:AddRef (This=0x5227950) returned 0x3 [0177.483] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227950, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.483] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227950, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.483] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227950, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x522f2b8) returned 0x0 [0177.483] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x522f2b8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.483] WbemDefPath:IUnknown:Release (This=0x522f2b8) returned 0x3 [0177.483] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.483] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.483] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227950, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.483] WbemDefPath:IUnknown:Release (This=0x5227950) returned 0x2 [0177.483] WbemDefPath:IUnknown:Release (This=0x5227950) returned 0x1 [0177.483] SetEvent (hEvent=0x7f8) returned 1 [0177.490] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.491] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5227090) returned 0x0 [0177.491] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227090, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5227090) returned 0x0 [0177.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227090, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227090, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.491] WbemDefPath:IUnknown:AddRef (This=0x5227090) returned 0x3 [0177.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227090, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227090, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227090, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x522f510) returned 0x0 [0177.491] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x522f510, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.491] WbemDefPath:IUnknown:Release (This=0x522f510) returned 0x3 [0177.491] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.491] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227090, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.491] WbemDefPath:IUnknown:Release (This=0x5227090) returned 0x2 [0177.491] WbemDefPath:IUnknown:Release (This=0x5227090) returned 0x1 [0177.491] SetEvent (hEvent=0x7fc) returned 1 [0177.500] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.501] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.501] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5226f40) returned 0x0 [0177.501] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.501] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226f40, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5226f40) returned 0x0 [0177.501] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226f40, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.502] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226f40, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.502] WbemDefPath:IUnknown:AddRef (This=0x5226f40) returned 0x3 [0177.502] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226f40, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.502] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226f40, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.502] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226f40, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x522f5e8) returned 0x0 [0177.502] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x522f5e8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.502] WbemDefPath:IUnknown:Release (This=0x522f5e8) returned 0x3 [0177.503] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.503] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226f40, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.503] WbemDefPath:IUnknown:Release (This=0x5226f40) returned 0x2 [0177.503] WbemDefPath:IUnknown:Release (This=0x5226f40) returned 0x1 [0177.504] SetEvent (hEvent=0x804) returned 1 [0177.514] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.515] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.515] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x52279c0) returned 0x0 [0177.515] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.515] WbemDefPath:IUnknown:QueryInterface (in: This=0x52279c0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x52279c0) returned 0x0 [0177.515] WbemDefPath:IUnknown:QueryInterface (in: This=0x52279c0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.515] WbemDefPath:IUnknown:QueryInterface (in: This=0x52279c0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.516] WbemDefPath:IUnknown:AddRef (This=0x52279c0) returned 0x3 [0177.516] WbemDefPath:IUnknown:QueryInterface (in: This=0x52279c0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.516] WbemDefPath:IUnknown:QueryInterface (in: This=0x52279c0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.516] WbemDefPath:IUnknown:QueryInterface (in: This=0x52279c0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x522fa08) returned 0x0 [0177.516] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x522fa08, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.516] WbemDefPath:IUnknown:Release (This=0x522fa08) returned 0x3 [0177.516] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.516] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.516] WbemDefPath:IUnknown:QueryInterface (in: This=0x52279c0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.516] WbemDefPath:IUnknown:Release (This=0x52279c0) returned 0x2 [0177.516] WbemDefPath:IUnknown:Release (This=0x52279c0) returned 0x1 [0177.516] SetEvent (hEvent=0x808) returned 1 [0177.525] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de638) returned 0x0 [0177.525] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de638, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.526] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de638, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5227800) returned 0x0 [0177.526] WbemDefPath:IUnknown:Release (This=0x51de638) returned 0x0 [0177.526] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227800, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5227800) returned 0x0 [0177.526] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227800, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.526] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227800, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.526] WbemDefPath:IUnknown:AddRef (This=0x5227800) returned 0x3 [0177.526] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227800, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.526] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227800, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.526] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227800, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x522f9c0) returned 0x0 [0177.526] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x522f9c0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.526] WbemDefPath:IUnknown:Release (This=0x522f9c0) returned 0x3 [0177.526] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.526] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.526] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227800, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.526] WbemDefPath:IUnknown:Release (This=0x5227800) returned 0x2 [0177.526] WbemDefPath:IUnknown:Release (This=0x5227800) returned 0x1 [0177.526] SetEvent (hEvent=0x80c) returned 1 [0177.535] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.535] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.535] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5227a30) returned 0x0 [0177.535] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.535] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227a30, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5227a30) returned 0x0 [0177.536] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227a30, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.536] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227a30, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.536] WbemDefPath:IUnknown:AddRef (This=0x5227a30) returned 0x3 [0177.536] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227a30, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.536] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227a30, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.536] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227a30, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x522fcd8) returned 0x0 [0177.536] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x522fcd8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.536] WbemDefPath:IUnknown:Release (This=0x522fcd8) returned 0x3 [0177.536] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.536] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.536] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227a30, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.536] WbemDefPath:IUnknown:Release (This=0x5227a30) returned 0x2 [0177.536] WbemDefPath:IUnknown:Release (This=0x5227a30) returned 0x1 [0177.536] SetEvent (hEvent=0x810) returned 1 [0177.541] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.542] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.542] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5226fb0) returned 0x0 [0177.542] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.542] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226fb0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5226fb0) returned 0x0 [0177.542] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226fb0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.542] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226fb0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.542] WbemDefPath:IUnknown:AddRef (This=0x5226fb0) returned 0x3 [0177.542] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226fb0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.542] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226fb0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.542] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226fb0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x522fc60) returned 0x0 [0177.542] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x522fc60, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.542] WbemDefPath:IUnknown:Release (This=0x522fc60) returned 0x3 [0177.542] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.542] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.542] WbemDefPath:IUnknown:QueryInterface (in: This=0x5226fb0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.542] WbemDefPath:IUnknown:Release (This=0x5226fb0) returned 0x2 [0177.542] WbemDefPath:IUnknown:Release (This=0x5226fb0) returned 0x1 [0177.542] SetEvent (hEvent=0x814) returned 1 [0177.547] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.547] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.547] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5227020) returned 0x0 [0177.547] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.548] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227020, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5227020) returned 0x0 [0177.548] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227020, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.548] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227020, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.548] WbemDefPath:IUnknown:AddRef (This=0x5227020) returned 0x3 [0177.548] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227020, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.548] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227020, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.548] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227020, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x522fe70) returned 0x0 [0177.549] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x522fe70, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.549] WbemDefPath:IUnknown:Release (This=0x522fe70) returned 0x3 [0177.549] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.549] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.549] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227020, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.549] WbemDefPath:IUnknown:Release (This=0x5227020) returned 0x2 [0177.549] WbemDefPath:IUnknown:Release (This=0x5227020) returned 0x1 [0177.549] SetEvent (hEvent=0x818) returned 1 [0177.556] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de638) returned 0x0 [0177.556] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de638, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.556] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de638, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5227560) returned 0x0 [0177.556] WbemDefPath:IUnknown:Release (This=0x51de638) returned 0x0 [0177.556] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227560, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5227560) returned 0x0 [0177.556] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227560, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.556] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227560, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.557] WbemDefPath:IUnknown:AddRef (This=0x5227560) returned 0x3 [0177.557] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227560, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.557] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227560, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.557] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227560, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x522e1d8) returned 0x0 [0177.557] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x522e1d8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.557] WbemDefPath:IUnknown:Release (This=0x522e1d8) returned 0x3 [0177.557] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.557] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.557] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227560, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.557] WbemDefPath:IUnknown:Release (This=0x5227560) returned 0x2 [0177.557] WbemDefPath:IUnknown:Release (This=0x5227560) returned 0x1 [0177.557] SetEvent (hEvent=0x81c) returned 1 [0177.561] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de638) returned 0x0 [0177.562] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de638, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.562] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de638, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x52276b0) returned 0x0 [0177.562] WbemDefPath:IUnknown:Release (This=0x51de638) returned 0x0 [0177.562] WbemDefPath:IUnknown:QueryInterface (in: This=0x52276b0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x52276b0) returned 0x0 [0177.562] WbemDefPath:IUnknown:QueryInterface (in: This=0x52276b0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.562] WbemDefPath:IUnknown:QueryInterface (in: This=0x52276b0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.562] WbemDefPath:IUnknown:AddRef (This=0x52276b0) returned 0x3 [0177.562] WbemDefPath:IUnknown:QueryInterface (in: This=0x52276b0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.562] WbemDefPath:IUnknown:QueryInterface (in: This=0x52276b0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.562] WbemDefPath:IUnknown:QueryInterface (in: This=0x52276b0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x522e2e0) returned 0x0 [0177.562] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x522e2e0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.562] WbemDefPath:IUnknown:Release (This=0x522e2e0) returned 0x3 [0177.562] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.562] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.562] WbemDefPath:IUnknown:QueryInterface (in: This=0x52276b0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.562] WbemDefPath:IUnknown:Release (This=0x52276b0) returned 0x2 [0177.562] WbemDefPath:IUnknown:Release (This=0x52276b0) returned 0x1 [0177.562] SetEvent (hEvent=0x820) returned 1 [0177.574] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.575] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.575] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5227720) returned 0x0 [0177.575] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.575] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227720, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5227720) returned 0x0 [0177.575] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227720, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.575] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227720, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.575] WbemDefPath:IUnknown:AddRef (This=0x5227720) returned 0x3 [0177.575] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227720, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.575] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227720, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.575] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227720, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x522e388) returned 0x0 [0177.575] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x522e388, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.576] WbemDefPath:IUnknown:Release (This=0x522e388) returned 0x3 [0177.576] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.576] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.576] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227720, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.576] WbemDefPath:IUnknown:Release (This=0x5227720) returned 0x2 [0177.576] WbemDefPath:IUnknown:Release (This=0x5227720) returned 0x1 [0177.576] SetEvent (hEvent=0x824) returned 1 [0177.581] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.582] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.582] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5227c60) returned 0x0 [0177.582] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.582] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227c60, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5227c60) returned 0x0 [0177.582] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227c60, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.582] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227c60, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.582] WbemDefPath:IUnknown:AddRef (This=0x5227c60) returned 0x3 [0177.582] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227c60, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.583] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227c60, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.583] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227c60, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x523b1b0) returned 0x0 [0177.583] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x523b1b0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.583] WbemDefPath:IUnknown:Release (This=0x523b1b0) returned 0x3 [0177.583] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.583] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.583] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227c60, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.583] WbemDefPath:IUnknown:Release (This=0x5227c60) returned 0x2 [0177.583] WbemDefPath:IUnknown:Release (This=0x5227c60) returned 0x1 [0177.583] SetEvent (hEvent=0x828) returned 1 [0177.593] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.593] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.593] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5227b80) returned 0x0 [0177.593] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.593] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227b80, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5227b80) returned 0x0 [0177.594] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227b80, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.594] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227b80, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.594] WbemDefPath:IUnknown:AddRef (This=0x5227b80) returned 0x3 [0177.594] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227b80, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.594] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227b80, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.594] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227b80, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x523b078) returned 0x0 [0177.594] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x523b078, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.594] WbemDefPath:IUnknown:Release (This=0x523b078) returned 0x3 [0177.594] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.594] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.594] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227b80, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.594] WbemDefPath:IUnknown:Release (This=0x5227b80) returned 0x2 [0177.594] WbemDefPath:IUnknown:Release (This=0x5227b80) returned 0x1 [0177.594] SetEvent (hEvent=0x82c) returned 1 [0177.604] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.604] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.604] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5227b10) returned 0x0 [0177.604] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.604] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227b10, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5227b10) returned 0x0 [0177.604] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227b10, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.604] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227b10, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.604] WbemDefPath:IUnknown:AddRef (This=0x5227b10) returned 0x3 [0177.604] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227b10, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227b10, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227b10, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x523b348) returned 0x0 [0177.605] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x523b348, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.605] WbemDefPath:IUnknown:Release (This=0x523b348) returned 0x3 [0177.605] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.605] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227b10, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.605] WbemDefPath:IUnknown:Release (This=0x5227b10) returned 0x2 [0177.605] WbemDefPath:IUnknown:Release (This=0x5227b10) returned 0x1 [0177.605] SetEvent (hEvent=0x830) returned 1 [0177.613] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de638) returned 0x0 [0177.614] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de638, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.614] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de638, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5227bf0) returned 0x0 [0177.614] WbemDefPath:IUnknown:Release (This=0x51de638) returned 0x0 [0177.614] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227bf0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5227bf0) returned 0x0 [0177.614] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227bf0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.614] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227bf0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.614] WbemDefPath:IUnknown:AddRef (This=0x5227bf0) returned 0x3 [0177.614] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227bf0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.614] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227bf0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.614] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227bf0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x523b5a0) returned 0x0 [0177.614] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x523b5a0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.614] WbemDefPath:IUnknown:Release (This=0x523b5a0) returned 0x3 [0177.614] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.615] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x5227bf0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.615] WbemDefPath:IUnknown:Release (This=0x5227bf0) returned 0x2 [0177.615] WbemDefPath:IUnknown:Release (This=0x5227bf0) returned 0x1 [0177.615] SetEvent (hEvent=0x834) returned 1 [0177.622] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de638) returned 0x0 [0177.622] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de638, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.622] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de638, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5240068) returned 0x0 [0177.622] WbemDefPath:IUnknown:Release (This=0x51de638) returned 0x0 [0177.623] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240068, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5240068) returned 0x0 [0177.623] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240068, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.623] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240068, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.623] WbemDefPath:IUnknown:AddRef (This=0x5240068) returned 0x3 [0177.623] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240068, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.623] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240068, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.623] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240068, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x523b6f0) returned 0x0 [0177.623] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x523b6f0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.623] WbemDefPath:IUnknown:Release (This=0x523b6f0) returned 0x3 [0177.623] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.623] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.623] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240068, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.623] WbemDefPath:IUnknown:Release (This=0x5240068) returned 0x2 [0177.623] WbemDefPath:IUnknown:Release (This=0x5240068) returned 0x1 [0177.623] SetEvent (hEvent=0x838) returned 1 [0177.628] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.629] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.629] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x523f7a8) returned 0x0 [0177.629] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.629] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f7a8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x523f7a8) returned 0x0 [0177.629] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f7a8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.629] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f7a8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.629] WbemDefPath:IUnknown:AddRef (This=0x523f7a8) returned 0x3 [0177.629] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f7a8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.629] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f7a8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.629] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f7a8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5239860) returned 0x0 [0177.629] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5239860, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.629] WbemDefPath:IUnknown:Release (This=0x5239860) returned 0x3 [0177.629] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.629] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.629] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f7a8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.629] WbemDefPath:IUnknown:Release (This=0x523f7a8) returned 0x2 [0177.629] WbemDefPath:IUnknown:Release (This=0x523f7a8) returned 0x1 [0177.630] SetEvent (hEvent=0x83c) returned 1 [0177.634] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.634] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.634] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x523f968) returned 0x0 [0177.634] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.634] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f968, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x523f968) returned 0x0 [0177.634] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f968, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.634] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f968, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.635] WbemDefPath:IUnknown:AddRef (This=0x523f968) returned 0x3 [0177.635] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f968, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.635] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f968, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.635] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f968, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5239de8) returned 0x0 [0177.635] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5239de8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.635] WbemDefPath:IUnknown:Release (This=0x5239de8) returned 0x3 [0177.635] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.635] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.635] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f968, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.635] WbemDefPath:IUnknown:Release (This=0x523f968) returned 0x2 [0177.635] WbemDefPath:IUnknown:Release (This=0x523f968) returned 0x1 [0177.635] SetEvent (hEvent=0x840) returned 1 [0177.640] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de638) returned 0x0 [0177.640] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de638, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.640] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de638, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5240298) returned 0x0 [0177.640] WbemDefPath:IUnknown:Release (This=0x51de638) returned 0x0 [0177.640] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240298, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5240298) returned 0x0 [0177.640] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240298, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.640] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240298, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.640] WbemDefPath:IUnknown:AddRef (This=0x5240298) returned 0x3 [0177.640] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240298, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.640] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240298, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.640] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240298, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5239c20) returned 0x0 [0177.641] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5239c20, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.641] WbemDefPath:IUnknown:Release (This=0x5239c20) returned 0x3 [0177.641] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.641] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.641] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240298, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.641] WbemDefPath:IUnknown:Release (This=0x5240298) returned 0x2 [0177.641] WbemDefPath:IUnknown:Release (This=0x5240298) returned 0x1 [0177.641] SetEvent (hEvent=0x844) returned 1 [0177.649] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.649] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.649] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5240148) returned 0x0 [0177.649] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.649] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240148, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5240148) returned 0x0 [0177.650] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240148, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.650] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240148, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.650] WbemDefPath:IUnknown:AddRef (This=0x5240148) returned 0x3 [0177.650] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240148, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.650] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240148, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.651] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240148, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5239f68) returned 0x0 [0177.651] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5239f68, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.651] WbemDefPath:IUnknown:Release (This=0x5239f68) returned 0x3 [0177.651] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.651] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.651] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240148, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.651] WbemDefPath:IUnknown:Release (This=0x5240148) returned 0x2 [0177.651] WbemDefPath:IUnknown:Release (This=0x5240148) returned 0x1 [0177.651] SetEvent (hEvent=0x848) returned 1 [0177.658] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de598) returned 0x0 [0177.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de598, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.658] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de598, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5240378) returned 0x0 [0177.658] WbemDefPath:IUnknown:Release (This=0x51de598) returned 0x0 [0177.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240378, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5240378) returned 0x0 [0177.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240378, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240378, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.659] WbemDefPath:IUnknown:AddRef (This=0x5240378) returned 0x3 [0177.659] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240378, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.659] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240378, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.659] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240378, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x523a070) returned 0x0 [0177.659] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x523a070, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.659] WbemDefPath:IUnknown:Release (This=0x523a070) returned 0x3 [0177.659] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.659] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.659] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240378, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.659] WbemDefPath:IUnknown:Release (This=0x5240378) returned 0x2 [0177.659] WbemDefPath:IUnknown:Release (This=0x5240378) returned 0x1 [0177.659] SetEvent (hEvent=0x84c) returned 1 [0177.667] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.667] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x523fb28) returned 0x0 [0177.667] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fb28, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x523fb28) returned 0x0 [0177.668] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fb28, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.668] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fb28, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.668] WbemDefPath:IUnknown:AddRef (This=0x523fb28) returned 0x3 [0177.668] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fb28, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.668] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fb28, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.668] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fb28, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x523a328) returned 0x0 [0177.668] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x523a328, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.668] WbemDefPath:IUnknown:Release (This=0x523a328) returned 0x3 [0177.668] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.668] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.668] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fb28, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.668] WbemDefPath:IUnknown:Release (This=0x523fb28) returned 0x2 [0177.668] WbemDefPath:IUnknown:Release (This=0x523fb28) returned 0x1 [0177.668] SetEvent (hEvent=0x850) returned 1 [0177.674] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de638) returned 0x0 [0177.674] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de638, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.674] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de638, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x52401b8) returned 0x0 [0177.674] WbemDefPath:IUnknown:Release (This=0x51de638) returned 0x0 [0177.674] WbemDefPath:IUnknown:QueryInterface (in: This=0x52401b8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x52401b8) returned 0x0 [0177.674] WbemDefPath:IUnknown:QueryInterface (in: This=0x52401b8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x52401b8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.675] WbemDefPath:IUnknown:AddRef (This=0x52401b8) returned 0x3 [0177.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x52401b8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x52401b8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x52401b8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x523a190) returned 0x0 [0177.675] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x523a190, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.675] WbemDefPath:IUnknown:Release (This=0x523a190) returned 0x3 [0177.675] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.675] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.676] WbemDefPath:IUnknown:QueryInterface (in: This=0x52401b8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.676] WbemDefPath:IUnknown:Release (This=0x52401b8) returned 0x2 [0177.676] WbemDefPath:IUnknown:Release (This=0x52401b8) returned 0x1 [0177.676] SetEvent (hEvent=0x854) returned 1 [0177.681] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de638) returned 0x0 [0177.681] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de638, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.681] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de638, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x523f9d8) returned 0x0 [0177.682] WbemDefPath:IUnknown:Release (This=0x51de638) returned 0x0 [0177.682] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f9d8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x523f9d8) returned 0x0 [0177.682] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f9d8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.682] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f9d8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.682] WbemDefPath:IUnknown:AddRef (This=0x523f9d8) returned 0x3 [0177.682] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f9d8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.682] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f9d8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.682] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f9d8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x523a490) returned 0x0 [0177.682] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x523a490, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.682] WbemDefPath:IUnknown:Release (This=0x523a490) returned 0x3 [0177.682] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.682] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.682] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f9d8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.683] WbemDefPath:IUnknown:Release (This=0x523f9d8) returned 0x2 [0177.683] WbemDefPath:IUnknown:Release (This=0x523f9d8) returned 0x1 [0177.683] SetEvent (hEvent=0x858) returned 1 [0177.690] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.691] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.691] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x523fa48) returned 0x0 [0177.691] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.691] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fa48, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x523fa48) returned 0x0 [0177.691] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fa48, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.691] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fa48, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.691] WbemDefPath:IUnknown:AddRef (This=0x523fa48) returned 0x3 [0177.691] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fa48, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.691] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fa48, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.691] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fa48, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x523a6b8) returned 0x0 [0177.692] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x523a6b8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.692] WbemDefPath:IUnknown:Release (This=0x523a6b8) returned 0x3 [0177.692] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.692] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.692] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fa48, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.692] WbemDefPath:IUnknown:Release (This=0x523fa48) returned 0x2 [0177.692] WbemDefPath:IUnknown:Release (This=0x523fa48) returned 0x1 [0177.692] SetEvent (hEvent=0x85c) returned 1 [0177.698] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.698] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.699] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x523f5e8) returned 0x0 [0177.699] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.699] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f5e8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x523f5e8) returned 0x0 [0177.699] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f5e8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.699] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f5e8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.699] WbemDefPath:IUnknown:AddRef (This=0x523f5e8) returned 0x3 [0177.699] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f5e8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.699] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f5e8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.699] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f5e8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x523a928) returned 0x0 [0177.699] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x523a928, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.699] WbemDefPath:IUnknown:Release (This=0x523a928) returned 0x3 [0177.699] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.699] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.699] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f5e8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.700] WbemDefPath:IUnknown:Release (This=0x523f5e8) returned 0x2 [0177.700] WbemDefPath:IUnknown:Release (This=0x523f5e8) returned 0x1 [0177.700] SetEvent (hEvent=0x860) returned 1 [0177.708] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.708] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.708] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x523fe38) returned 0x0 [0177.709] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.709] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fe38, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x523fe38) returned 0x0 [0177.709] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fe38, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.709] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fe38, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.709] WbemDefPath:IUnknown:AddRef (This=0x523fe38) returned 0x3 [0177.709] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fe38, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.709] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fe38, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.709] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fe38, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x523aca0) returned 0x0 [0177.709] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x523aca0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.709] WbemDefPath:IUnknown:Release (This=0x523aca0) returned 0x3 [0177.709] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.709] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.709] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fe38, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.709] WbemDefPath:IUnknown:Release (This=0x523fe38) returned 0x2 [0177.710] WbemDefPath:IUnknown:Release (This=0x523fe38) returned 0x1 [0177.710] SetEvent (hEvent=0x864) returned 1 [0177.719] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de638) returned 0x0 [0177.719] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de638, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.719] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de638, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x523fea8) returned 0x0 [0177.719] WbemDefPath:IUnknown:Release (This=0x51de638) returned 0x0 [0177.719] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fea8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x523fea8) returned 0x0 [0177.719] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fea8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.719] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fea8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.719] WbemDefPath:IUnknown:AddRef (This=0x523fea8) returned 0x3 [0177.719] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fea8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.720] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fea8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.720] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fea8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x523aa30) returned 0x0 [0177.720] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x523aa30, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.720] WbemDefPath:IUnknown:Release (This=0x523aa30) returned 0x3 [0177.720] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.720] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.720] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fea8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.720] WbemDefPath:IUnknown:Release (This=0x523fea8) returned 0x2 [0177.720] WbemDefPath:IUnknown:Release (This=0x523fea8) returned 0x1 [0177.720] SetEvent (hEvent=0x868) returned 1 [0177.810] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.810] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.810] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5240228) returned 0x0 [0177.810] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.811] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240228, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5240228) returned 0x0 [0177.811] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240228, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.811] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240228, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.811] WbemDefPath:IUnknown:AddRef (This=0x5240228) returned 0x3 [0177.811] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240228, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.811] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240228, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.811] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240228, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x523ae20) returned 0x0 [0177.811] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x523ae20, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.811] WbemDefPath:IUnknown:Release (This=0x523ae20) returned 0x3 [0177.811] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.811] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.811] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240228, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.811] WbemDefPath:IUnknown:Release (This=0x5240228) returned 0x2 [0177.811] WbemDefPath:IUnknown:Release (This=0x5240228) returned 0x1 [0177.811] SetEvent (hEvent=0x86c) returned 1 [0177.816] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de588) returned 0x0 [0177.817] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de588, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.817] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de588, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x523fab8) returned 0x0 [0177.817] WbemDefPath:IUnknown:Release (This=0x51de588) returned 0x0 [0177.817] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fab8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x523fab8) returned 0x0 [0177.817] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fab8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.817] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fab8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.817] WbemDefPath:IUnknown:AddRef (This=0x523fab8) returned 0x3 [0177.817] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fab8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.817] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fab8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.817] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fab8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x523ad48) returned 0x0 [0177.817] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x523ad48, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.817] WbemDefPath:IUnknown:Release (This=0x523ad48) returned 0x3 [0177.817] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.817] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.817] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fab8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.817] WbemDefPath:IUnknown:Release (This=0x523fab8) returned 0x2 [0177.817] WbemDefPath:IUnknown:Release (This=0x523fab8) returned 0x1 [0177.817] SetEvent (hEvent=0x870) returned 1 [0177.823] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de598) returned 0x0 [0177.823] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de598, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.823] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de598, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x523f658) returned 0x0 [0177.823] WbemDefPath:IUnknown:Release (This=0x51de598) returned 0x0 [0177.823] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f658, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x523f658) returned 0x0 [0177.823] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f658, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.823] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f658, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.823] WbemDefPath:IUnknown:AddRef (This=0x523f658) returned 0x3 [0177.823] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f658, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.823] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f658, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.824] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f658, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5246c88) returned 0x0 [0177.824] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5246c88, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.824] WbemDefPath:IUnknown:Release (This=0x5246c88) returned 0x3 [0177.824] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.824] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.824] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f658, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.824] WbemDefPath:IUnknown:Release (This=0x523f658) returned 0x2 [0177.824] WbemDefPath:IUnknown:Release (This=0x523f658) returned 0x1 [0177.824] SetEvent (hEvent=0x874) returned 1 [0177.829] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de598) returned 0x0 [0177.829] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de598, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.829] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de598, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5240308) returned 0x0 [0177.830] WbemDefPath:IUnknown:Release (This=0x51de598) returned 0x0 [0177.830] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240308, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5240308) returned 0x0 [0177.830] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240308, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.830] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240308, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.830] WbemDefPath:IUnknown:AddRef (This=0x5240308) returned 0x3 [0177.830] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240308, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.830] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240308, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.830] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240308, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5246e68) returned 0x0 [0177.830] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5246e68, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.830] WbemDefPath:IUnknown:Release (This=0x5246e68) returned 0x3 [0177.830] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.830] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.830] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240308, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.830] WbemDefPath:IUnknown:Release (This=0x5240308) returned 0x2 [0177.830] WbemDefPath:IUnknown:Release (This=0x5240308) returned 0x1 [0177.830] SetEvent (hEvent=0x878) returned 1 [0177.836] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de638) returned 0x0 [0177.836] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de638, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.836] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de638, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x523fd58) returned 0x0 [0177.836] WbemDefPath:IUnknown:Release (This=0x51de638) returned 0x0 [0177.836] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fd58, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x523fd58) returned 0x0 [0177.836] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fd58, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.836] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fd58, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.836] WbemDefPath:IUnknown:AddRef (This=0x523fd58) returned 0x3 [0177.836] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fd58, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.836] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fd58, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.836] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fd58, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x52470d8) returned 0x0 [0177.836] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x52470d8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.836] WbemDefPath:IUnknown:Release (This=0x52470d8) returned 0x3 [0177.836] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.836] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.837] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fd58, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.837] WbemDefPath:IUnknown:Release (This=0x523fd58) returned 0x2 [0177.837] WbemDefPath:IUnknown:Release (This=0x523fd58) returned 0x1 [0177.837] SetEvent (hEvent=0x87c) returned 1 [0177.842] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de638) returned 0x0 [0177.842] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de638, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0177.842] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de638, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x523fdc8) returned 0x0 [0177.842] WbemDefPath:IUnknown:Release (This=0x51de638) returned 0x0 [0177.842] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fdc8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x523fdc8) returned 0x0 [0177.842] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fdc8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0177.842] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fdc8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0177.842] WbemDefPath:IUnknown:AddRef (This=0x523fdc8) returned 0x3 [0177.843] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fdc8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0177.843] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fdc8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0177.843] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fdc8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x52471c8) returned 0x0 [0177.843] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x52471c8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.843] WbemDefPath:IUnknown:Release (This=0x52471c8) returned 0x3 [0177.843] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0177.843] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0177.843] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fdc8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0177.843] WbemDefPath:IUnknown:Release (This=0x523fdc8) returned 0x2 [0177.843] WbemDefPath:IUnknown:Release (This=0x523fdc8) returned 0x1 [0177.843] SetEvent (hEvent=0x880) returned 1 [0179.332] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d2a0) returned 0x0 [0179.333] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d2a0, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0179.333] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d2a0, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x523fc78) returned 0x0 [0179.333] WbemDefPath:IUnknown:Release (This=0x71d2a0) returned 0x0 [0179.333] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fc78, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x523fc78) returned 0x0 [0179.333] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fc78, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0179.333] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fc78, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0179.333] WbemDefPath:IUnknown:AddRef (This=0x523fc78) returned 0x3 [0179.333] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fc78, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0179.333] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fc78, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0179.333] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fc78, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x52475e8) returned 0x0 [0179.333] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x52475e8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0179.333] WbemDefPath:IUnknown:Release (This=0x52475e8) returned 0x3 [0179.333] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0179.334] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0179.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fc78, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0179.334] WbemDefPath:IUnknown:Release (This=0x523fc78) returned 0x2 [0179.334] WbemDefPath:IUnknown:Release (This=0x523fc78) returned 0x1 [0179.334] SetEvent (hEvent=0x8a8) returned 1 [0179.434] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d2a0) returned 0x0 [0179.435] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d2a0, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0179.435] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d2a0, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x523ff18) returned 0x0 [0179.435] WbemDefPath:IUnknown:Release (This=0x71d2a0) returned 0x0 [0179.435] WbemDefPath:IUnknown:QueryInterface (in: This=0x523ff18, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x523ff18) returned 0x0 [0179.435] WbemDefPath:IUnknown:QueryInterface (in: This=0x523ff18, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0179.435] WbemDefPath:IUnknown:QueryInterface (in: This=0x523ff18, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0179.435] WbemDefPath:IUnknown:AddRef (This=0x523ff18) returned 0x3 [0179.435] WbemDefPath:IUnknown:QueryInterface (in: This=0x523ff18, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0179.435] WbemDefPath:IUnknown:QueryInterface (in: This=0x523ff18, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0179.435] WbemDefPath:IUnknown:QueryInterface (in: This=0x523ff18, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x52474f8) returned 0x0 [0179.435] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x52474f8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0179.435] WbemDefPath:IUnknown:Release (This=0x52474f8) returned 0x3 [0179.435] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0179.435] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0179.436] WbemDefPath:IUnknown:QueryInterface (in: This=0x523ff18, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0179.436] WbemDefPath:IUnknown:Release (This=0x523ff18) returned 0x2 [0179.436] WbemDefPath:IUnknown:Release (This=0x523ff18) returned 0x1 [0179.436] SetEvent (hEvent=0x8ac) returned 1 [0179.520] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d2a0) returned 0x0 [0179.520] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d2a0, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0179.520] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d2a0, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x523ff88) returned 0x0 [0179.520] WbemDefPath:IUnknown:Release (This=0x71d2a0) returned 0x0 [0179.520] WbemDefPath:IUnknown:QueryInterface (in: This=0x523ff88, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x523ff88) returned 0x0 [0179.520] WbemDefPath:IUnknown:QueryInterface (in: This=0x523ff88, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0179.520] WbemDefPath:IUnknown:QueryInterface (in: This=0x523ff88, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0179.521] WbemDefPath:IUnknown:AddRef (This=0x523ff88) returned 0x3 [0179.521] WbemDefPath:IUnknown:QueryInterface (in: This=0x523ff88, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0179.521] WbemDefPath:IUnknown:QueryInterface (in: This=0x523ff88, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0179.521] WbemDefPath:IUnknown:QueryInterface (in: This=0x523ff88, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5247978) returned 0x0 [0179.521] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5247978, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0179.521] WbemDefPath:IUnknown:Release (This=0x5247978) returned 0x3 [0179.521] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0179.521] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0179.521] WbemDefPath:IUnknown:QueryInterface (in: This=0x523ff88, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0179.521] WbemDefPath:IUnknown:Release (This=0x523ff88) returned 0x2 [0179.521] WbemDefPath:IUnknown:Release (This=0x523ff88) returned 0x1 [0179.521] SetEvent (hEvent=0x8b0) returned 1 [0179.614] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d380) returned 0x0 [0179.614] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d380, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0179.614] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d380, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x523f6c8) returned 0x0 [0179.614] WbemDefPath:IUnknown:Release (This=0x71d380) returned 0x0 [0179.614] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f6c8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x523f6c8) returned 0x0 [0179.614] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f6c8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0179.614] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f6c8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0179.615] WbemDefPath:IUnknown:AddRef (This=0x523f6c8) returned 0x3 [0179.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f6c8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0179.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f6c8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0179.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f6c8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x52477c8) returned 0x0 [0179.615] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x52477c8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0179.615] WbemDefPath:IUnknown:Release (This=0x52477c8) returned 0x3 [0179.615] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0179.615] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0179.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f6c8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0179.615] WbemDefPath:IUnknown:Release (This=0x523f6c8) returned 0x2 [0179.615] WbemDefPath:IUnknown:Release (This=0x523f6c8) returned 0x1 [0179.615] SetEvent (hEvent=0x8b8) returned 1 [0179.707] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d380) returned 0x0 [0179.708] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d380, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0179.708] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d380, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x523f818) returned 0x0 [0179.708] WbemDefPath:IUnknown:Release (This=0x71d380) returned 0x0 [0179.708] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f818, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x523f818) returned 0x0 [0179.708] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f818, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0179.708] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f818, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0179.708] WbemDefPath:IUnknown:AddRef (This=0x523f818) returned 0x3 [0179.708] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f818, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0179.708] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f818, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0179.708] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f818, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5247af8) returned 0x0 [0179.708] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5247af8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0179.708] WbemDefPath:IUnknown:Release (This=0x5247af8) returned 0x3 [0179.709] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0179.709] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0179.709] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f818, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0179.709] WbemDefPath:IUnknown:Release (This=0x523f818) returned 0x2 [0179.709] WbemDefPath:IUnknown:Release (This=0x523f818) returned 0x1 [0179.709] SetEvent (hEvent=0x8b4) returned 1 [0179.802] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d2d0) returned 0x0 [0179.803] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d2d0, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0179.803] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d2d0, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x523f738) returned 0x0 [0179.803] WbemDefPath:IUnknown:Release (This=0x71d2d0) returned 0x0 [0179.803] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f738, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x523f738) returned 0x0 [0179.803] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f738, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0179.803] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f738, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0179.803] WbemDefPath:IUnknown:AddRef (This=0x523f738) returned 0x3 [0179.803] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f738, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0179.803] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f738, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0179.803] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f738, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5245d40) returned 0x0 [0179.803] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5245d40, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0179.803] WbemDefPath:IUnknown:Release (This=0x5245d40) returned 0x3 [0179.803] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0179.803] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0179.803] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f738, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0179.803] WbemDefPath:IUnknown:Release (This=0x523f738) returned 0x2 [0179.803] WbemDefPath:IUnknown:Release (This=0x523f738) returned 0x1 [0179.804] SetEvent (hEvent=0x8bc) returned 1 [0179.895] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d380) returned 0x0 [0179.895] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d380, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0179.895] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d380, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x523fc08) returned 0x0 [0179.895] WbemDefPath:IUnknown:Release (This=0x71d380) returned 0x0 [0179.895] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fc08, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x523fc08) returned 0x0 [0179.895] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fc08, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0179.895] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fc08, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0179.895] WbemDefPath:IUnknown:AddRef (This=0x523fc08) returned 0x3 [0179.895] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fc08, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0179.896] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fc08, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0179.896] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fc08, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5245ce0) returned 0x0 [0179.896] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5245ce0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0179.896] WbemDefPath:IUnknown:Release (This=0x5245ce0) returned 0x3 [0179.896] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0179.896] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0179.896] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fc08, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0179.896] WbemDefPath:IUnknown:Release (This=0x523fc08) returned 0x2 [0179.896] WbemDefPath:IUnknown:Release (This=0x523fc08) returned 0x1 [0179.896] SetEvent (hEvent=0x8c0) returned 1 [0179.988] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d2d0) returned 0x0 [0179.989] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d2d0, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0179.989] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d2d0, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x523f888) returned 0x0 [0179.989] WbemDefPath:IUnknown:Release (This=0x71d2d0) returned 0x0 [0179.989] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f888, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x523f888) returned 0x0 [0179.989] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f888, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0179.989] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f888, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0179.989] WbemDefPath:IUnknown:AddRef (This=0x523f888) returned 0x3 [0179.989] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f888, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0179.989] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f888, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0179.989] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f888, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5245fe0) returned 0x0 [0179.990] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5245fe0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0179.990] WbemDefPath:IUnknown:Release (This=0x5245fe0) returned 0x3 [0179.990] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0179.990] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0179.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f888, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0179.990] WbemDefPath:IUnknown:Release (This=0x523f888) returned 0x2 [0179.990] WbemDefPath:IUnknown:Release (This=0x523f888) returned 0x1 [0179.990] SetEvent (hEvent=0x8c4) returned 1 [0180.083] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d2d0) returned 0x0 [0180.083] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d2d0, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0180.083] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d2d0, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x523fce8) returned 0x0 [0180.083] WbemDefPath:IUnknown:Release (This=0x71d2d0) returned 0x0 [0180.083] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fce8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x523fce8) returned 0x0 [0180.083] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fce8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0180.083] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fce8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0180.084] WbemDefPath:IUnknown:AddRef (This=0x523fce8) returned 0x3 [0180.084] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fce8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0180.084] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fce8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0180.084] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fce8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x52460b8) returned 0x0 [0180.084] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x52460b8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0180.084] WbemDefPath:IUnknown:Release (This=0x52460b8) returned 0x3 [0180.084] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0180.084] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0180.084] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fce8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0180.084] WbemDefPath:IUnknown:Release (This=0x523fce8) returned 0x2 [0180.084] WbemDefPath:IUnknown:Release (This=0x523fce8) returned 0x1 [0180.084] SetEvent (hEvent=0x8c8) returned 1 [0180.207] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d2d0) returned 0x0 [0180.208] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d2d0, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0180.208] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d2d0, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x52400d8) returned 0x0 [0180.208] WbemDefPath:IUnknown:Release (This=0x71d2d0) returned 0x0 [0180.208] WbemDefPath:IUnknown:QueryInterface (in: This=0x52400d8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x52400d8) returned 0x0 [0180.208] WbemDefPath:IUnknown:QueryInterface (in: This=0x52400d8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0180.208] WbemDefPath:IUnknown:QueryInterface (in: This=0x52400d8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0180.208] WbemDefPath:IUnknown:AddRef (This=0x52400d8) returned 0x3 [0180.208] WbemDefPath:IUnknown:QueryInterface (in: This=0x52400d8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0180.208] WbemDefPath:IUnknown:QueryInterface (in: This=0x52400d8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0180.208] WbemDefPath:IUnknown:QueryInterface (in: This=0x52400d8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x52463b8) returned 0x0 [0180.208] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x52463b8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0180.208] WbemDefPath:IUnknown:Release (This=0x52463b8) returned 0x3 [0180.208] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0180.208] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0180.208] WbemDefPath:IUnknown:QueryInterface (in: This=0x52400d8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0180.208] WbemDefPath:IUnknown:Release (This=0x52400d8) returned 0x2 [0180.208] WbemDefPath:IUnknown:Release (This=0x52400d8) returned 0x1 [0180.208] SetEvent (hEvent=0x8cc) returned 1 [0180.333] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d300) returned 0x0 [0180.333] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d300, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0180.333] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d300, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x523f8f8) returned 0x0 [0180.333] WbemDefPath:IUnknown:Release (This=0x71d300) returned 0x0 [0180.333] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f8f8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x523f8f8) returned 0x0 [0180.333] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f8f8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0180.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f8f8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0180.334] WbemDefPath:IUnknown:AddRef (This=0x523f8f8) returned 0x3 [0180.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f8f8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0180.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f8f8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0180.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f8f8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5246700) returned 0x0 [0180.334] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5246700, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0180.334] WbemDefPath:IUnknown:Release (This=0x5246700) returned 0x3 [0180.334] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0180.334] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0180.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x523f8f8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0180.334] WbemDefPath:IUnknown:Release (This=0x523f8f8) returned 0x2 [0180.334] WbemDefPath:IUnknown:Release (This=0x523f8f8) returned 0x1 [0180.334] SetEvent (hEvent=0x8d0) returned 1 [0180.435] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d2d0) returned 0x0 [0180.435] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d2d0, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0180.435] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d2d0, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x523fb98) returned 0x0 [0180.435] WbemDefPath:IUnknown:Release (This=0x71d2d0) returned 0x0 [0180.436] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fb98, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x523fb98) returned 0x0 [0180.436] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fb98, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0180.436] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fb98, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0180.436] WbemDefPath:IUnknown:AddRef (This=0x523fb98) returned 0x3 [0180.436] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fb98, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0180.436] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fb98, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0180.436] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fb98, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5246778) returned 0x0 [0180.436] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5246778, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0180.436] WbemDefPath:IUnknown:Release (This=0x5246778) returned 0x3 [0180.436] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0180.436] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0180.436] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fb98, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0180.436] WbemDefPath:IUnknown:Release (This=0x523fb98) returned 0x2 [0180.436] WbemDefPath:IUnknown:Release (This=0x523fb98) returned 0x1 [0180.436] SetEvent (hEvent=0x8d4) returned 1 [0180.568] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d300) returned 0x0 [0180.568] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d300, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0180.569] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d300, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x523fff8) returned 0x0 [0180.569] WbemDefPath:IUnknown:Release (This=0x71d300) returned 0x0 [0180.569] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fff8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x523fff8) returned 0x0 [0180.569] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fff8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0180.569] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fff8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0180.569] WbemDefPath:IUnknown:AddRef (This=0x523fff8) returned 0x3 [0180.569] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fff8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0180.569] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fff8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0180.569] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fff8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5246b50) returned 0x0 [0180.569] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5246b50, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0180.569] WbemDefPath:IUnknown:Release (This=0x5246b50) returned 0x3 [0180.569] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0180.569] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0180.570] WbemDefPath:IUnknown:QueryInterface (in: This=0x523fff8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0180.570] WbemDefPath:IUnknown:Release (This=0x523fff8) returned 0x2 [0180.570] WbemDefPath:IUnknown:Release (This=0x523fff8) returned 0x1 [0180.570] SetEvent (hEvent=0x8d8) returned 1 [0180.661] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0180.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0180.661] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x52403e8) returned 0x0 [0180.661] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0180.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x52403e8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x52403e8) returned 0x0 [0180.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x52403e8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0180.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x52403e8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0180.662] WbemDefPath:IUnknown:AddRef (This=0x52403e8) returned 0x3 [0180.662] WbemDefPath:IUnknown:QueryInterface (in: This=0x52403e8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0180.662] WbemDefPath:IUnknown:QueryInterface (in: This=0x52403e8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0180.662] WbemDefPath:IUnknown:QueryInterface (in: This=0x52403e8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5246898) returned 0x0 [0180.662] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5246898, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0180.662] WbemDefPath:IUnknown:Release (This=0x5246898) returned 0x3 [0180.662] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0180.662] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0180.662] WbemDefPath:IUnknown:QueryInterface (in: This=0x52403e8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0180.662] WbemDefPath:IUnknown:Release (This=0x52403e8) returned 0x2 [0180.662] WbemDefPath:IUnknown:Release (This=0x52403e8) returned 0x1 [0180.662] SetEvent (hEvent=0x8dc) returned 1 [0180.756] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d300) returned 0x0 [0180.756] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d300, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0180.756] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d300, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5240458) returned 0x0 [0180.756] WbemDefPath:IUnknown:Release (This=0x71d300) returned 0x0 [0180.756] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240458, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5240458) returned 0x0 [0180.756] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240458, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0180.756] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240458, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0180.757] WbemDefPath:IUnknown:AddRef (This=0x5240458) returned 0x3 [0180.757] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240458, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0180.757] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240458, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0180.757] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240458, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x525b6e8) returned 0x0 [0180.757] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x525b6e8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0180.757] WbemDefPath:IUnknown:Release (This=0x525b6e8) returned 0x3 [0180.757] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0180.757] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0180.757] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240458, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0180.757] WbemDefPath:IUnknown:Release (This=0x5240458) returned 0x2 [0180.757] WbemDefPath:IUnknown:Release (This=0x5240458) returned 0x1 [0180.757] SetEvent (hEvent=0x8e0) returned 1 [0180.852] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0180.853] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0180.853] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5240538) returned 0x0 [0180.853] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0180.853] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240538, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5240538) returned 0x0 [0180.853] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240538, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0180.853] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240538, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0180.853] WbemDefPath:IUnknown:AddRef (This=0x5240538) returned 0x3 [0180.853] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240538, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0180.853] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240538, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0180.853] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240538, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x525b6a0) returned 0x0 [0180.854] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x525b6a0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0180.854] WbemDefPath:IUnknown:Release (This=0x525b6a0) returned 0x3 [0180.854] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0180.854] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0180.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x5240538, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0180.854] WbemDefPath:IUnknown:Release (This=0x5240538) returned 0x2 [0180.854] WbemDefPath:IUnknown:Release (This=0x5240538) returned 0x1 [0180.854] SetEvent (hEvent=0x8e4) returned 1 [0180.957] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0180.958] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0180.958] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x52404c8) returned 0x0 [0180.958] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0180.958] WbemDefPath:IUnknown:QueryInterface (in: This=0x52404c8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x52404c8) returned 0x0 [0180.958] WbemDefPath:IUnknown:QueryInterface (in: This=0x52404c8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0180.958] WbemDefPath:IUnknown:QueryInterface (in: This=0x52404c8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0180.958] WbemDefPath:IUnknown:AddRef (This=0x52404c8) returned 0x3 [0180.958] WbemDefPath:IUnknown:QueryInterface (in: This=0x52404c8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0180.958] WbemDefPath:IUnknown:QueryInterface (in: This=0x52404c8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0180.958] WbemDefPath:IUnknown:QueryInterface (in: This=0x52404c8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x525b8b0) returned 0x0 [0180.958] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x525b8b0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0180.959] WbemDefPath:IUnknown:Release (This=0x525b8b0) returned 0x3 [0180.959] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0180.959] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0180.959] WbemDefPath:IUnknown:QueryInterface (in: This=0x52404c8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0180.959] WbemDefPath:IUnknown:Release (This=0x52404c8) returned 0x2 [0180.959] WbemDefPath:IUnknown:Release (This=0x52404c8) returned 0x1 [0180.959] SetEvent (hEvent=0x8e8) returned 1 [0181.067] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.067] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.067] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5260d40) returned 0x0 [0181.068] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.068] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260d40, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5260d40) returned 0x0 [0181.068] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260d40, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.068] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260d40, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.068] WbemDefPath:IUnknown:AddRef (This=0x5260d40) returned 0x3 [0181.068] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260d40, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.068] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260d40, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.068] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260d40, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x525b958) returned 0x0 [0181.068] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x525b958, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.068] WbemDefPath:IUnknown:Release (This=0x525b958) returned 0x3 [0181.068] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.068] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.069] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260d40, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.069] WbemDefPath:IUnknown:Release (This=0x5260d40) returned 0x2 [0181.069] WbemDefPath:IUnknown:Release (This=0x5260d40) returned 0x1 [0181.069] SetEvent (hEvent=0x8ec) returned 1 [0181.154] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.154] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.154] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5260fe0) returned 0x0 [0181.154] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.154] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260fe0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5260fe0) returned 0x0 [0181.154] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260fe0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.154] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260fe0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.154] WbemDefPath:IUnknown:AddRef (This=0x5260fe0) returned 0x3 [0181.154] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260fe0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.154] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260fe0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.154] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260fe0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x525bd00) returned 0x0 [0181.155] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x525bd00, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.155] WbemDefPath:IUnknown:Release (This=0x525bd00) returned 0x3 [0181.155] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.155] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.155] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260fe0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.155] WbemDefPath:IUnknown:Release (This=0x5260fe0) returned 0x2 [0181.155] WbemDefPath:IUnknown:Release (This=0x5260fe0) returned 0x1 [0181.155] SetEvent (hEvent=0x8f0) returned 1 [0181.224] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.225] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5261910) returned 0x0 [0181.225] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261910, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5261910) returned 0x0 [0181.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261910, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261910, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.225] WbemDefPath:IUnknown:AddRef (This=0x5261910) returned 0x3 [0181.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261910, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261910, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261910, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x525bb98) returned 0x0 [0181.225] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x525bb98, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.225] WbemDefPath:IUnknown:Release (This=0x525bb98) returned 0x3 [0181.225] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.226] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.226] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261910, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.226] WbemDefPath:IUnknown:Release (This=0x5261910) returned 0x2 [0181.226] WbemDefPath:IUnknown:Release (This=0x5261910) returned 0x1 [0181.226] SetEvent (hEvent=0x8f4) returned 1 [0181.357] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.357] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.358] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5261ad0) returned 0x0 [0181.358] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.358] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261ad0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5261ad0) returned 0x0 [0181.358] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261ad0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.358] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261ad0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.358] WbemDefPath:IUnknown:AddRef (This=0x5261ad0) returned 0x3 [0181.358] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261ad0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.358] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261ad0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.358] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261ad0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x525bf58) returned 0x0 [0181.358] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x525bf58, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.358] WbemDefPath:IUnknown:Release (This=0x525bf58) returned 0x3 [0181.358] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.358] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.358] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261ad0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.359] WbemDefPath:IUnknown:Release (This=0x5261ad0) returned 0x2 [0181.359] WbemDefPath:IUnknown:Release (This=0x5261ad0) returned 0x1 [0181.359] SetEvent (hEvent=0x8f8) returned 1 [0181.407] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.407] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5260e90) returned 0x0 [0181.407] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260e90, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5260e90) returned 0x0 [0181.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260e90, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.408] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260e90, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.408] WbemDefPath:IUnknown:AddRef (This=0x5260e90) returned 0x3 [0181.408] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260e90, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.408] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260e90, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.408] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260e90, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x525be98) returned 0x0 [0181.408] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x525be98, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.408] WbemDefPath:IUnknown:Release (This=0x525be98) returned 0x3 [0181.408] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.408] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.408] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260e90, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.408] WbemDefPath:IUnknown:Release (This=0x5260e90) returned 0x2 [0181.408] WbemDefPath:IUnknown:Release (This=0x5260e90) returned 0x1 [0181.408] SetEvent (hEvent=0x8fc) returned 1 [0181.451] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.451] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.451] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5260f00) returned 0x0 [0181.451] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.451] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260f00, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5260f00) returned 0x0 [0181.451] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260f00, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.451] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260f00, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.451] WbemDefPath:IUnknown:AddRef (This=0x5260f00) returned 0x3 [0181.451] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260f00, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.451] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260f00, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.451] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260f00, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5258400) returned 0x0 [0181.451] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5258400, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.452] WbemDefPath:IUnknown:Release (This=0x5258400) returned 0x3 [0181.452] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.452] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.452] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260f00, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.452] WbemDefPath:IUnknown:Release (This=0x5260f00) returned 0x2 [0181.452] WbemDefPath:IUnknown:Release (This=0x5260f00) returned 0x1 [0181.452] SetEvent (hEvent=0x900) returned 1 [0181.460] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.461] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.461] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x52611a0) returned 0x0 [0181.461] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.461] WbemDefPath:IUnknown:QueryInterface (in: This=0x52611a0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x52611a0) returned 0x0 [0181.461] WbemDefPath:IUnknown:QueryInterface (in: This=0x52611a0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.461] WbemDefPath:IUnknown:QueryInterface (in: This=0x52611a0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.461] WbemDefPath:IUnknown:AddRef (This=0x52611a0) returned 0x3 [0181.461] WbemDefPath:IUnknown:QueryInterface (in: This=0x52611a0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.461] WbemDefPath:IUnknown:QueryInterface (in: This=0x52611a0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.461] WbemDefPath:IUnknown:QueryInterface (in: This=0x52611a0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5258310) returned 0x0 [0181.461] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5258310, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.461] WbemDefPath:IUnknown:Release (This=0x5258310) returned 0x3 [0181.461] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.461] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.461] WbemDefPath:IUnknown:QueryInterface (in: This=0x52611a0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.462] WbemDefPath:IUnknown:Release (This=0x52611a0) returned 0x2 [0181.462] WbemDefPath:IUnknown:Release (This=0x52611a0) returned 0x1 [0181.462] SetEvent (hEvent=0x904) returned 1 [0181.470] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.470] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.470] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x52610c0) returned 0x0 [0181.470] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.470] WbemDefPath:IUnknown:QueryInterface (in: This=0x52610c0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x52610c0) returned 0x0 [0181.471] WbemDefPath:IUnknown:QueryInterface (in: This=0x52610c0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.471] WbemDefPath:IUnknown:QueryInterface (in: This=0x52610c0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.471] WbemDefPath:IUnknown:AddRef (This=0x52610c0) returned 0x3 [0181.471] WbemDefPath:IUnknown:QueryInterface (in: This=0x52610c0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.471] WbemDefPath:IUnknown:QueryInterface (in: This=0x52610c0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.471] WbemDefPath:IUnknown:QueryInterface (in: This=0x52610c0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5258730) returned 0x0 [0181.471] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5258730, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.471] WbemDefPath:IUnknown:Release (This=0x5258730) returned 0x3 [0181.471] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.471] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.471] WbemDefPath:IUnknown:QueryInterface (in: This=0x52610c0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.471] WbemDefPath:IUnknown:Release (This=0x52610c0) returned 0x2 [0181.471] WbemDefPath:IUnknown:Release (This=0x52610c0) returned 0x1 [0181.471] SetEvent (hEvent=0x908) returned 1 [0181.486] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.486] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.486] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5261590) returned 0x0 [0181.486] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.486] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261590, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5261590) returned 0x0 [0181.486] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261590, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.486] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261590, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.486] WbemDefPath:IUnknown:AddRef (This=0x5261590) returned 0x3 [0181.486] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261590, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.486] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261590, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.486] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261590, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5258ac0) returned 0x0 [0181.486] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5258ac0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.486] WbemDefPath:IUnknown:Release (This=0x5258ac0) returned 0x3 [0181.486] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.487] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.487] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261590, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.487] WbemDefPath:IUnknown:Release (This=0x5261590) returned 0x2 [0181.487] WbemDefPath:IUnknown:Release (This=0x5261590) returned 0x1 [0181.487] SetEvent (hEvent=0x90c) returned 1 [0181.495] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.495] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.495] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x52614b0) returned 0x0 [0181.495] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.495] WbemDefPath:IUnknown:QueryInterface (in: This=0x52614b0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x52614b0) returned 0x0 [0181.495] WbemDefPath:IUnknown:QueryInterface (in: This=0x52614b0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.495] WbemDefPath:IUnknown:QueryInterface (in: This=0x52614b0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.495] WbemDefPath:IUnknown:AddRef (This=0x52614b0) returned 0x3 [0181.495] WbemDefPath:IUnknown:QueryInterface (in: This=0x52614b0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.495] WbemDefPath:IUnknown:QueryInterface (in: This=0x52614b0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.495] WbemDefPath:IUnknown:QueryInterface (in: This=0x52614b0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5258af0) returned 0x0 [0181.496] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5258af0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.496] WbemDefPath:IUnknown:Release (This=0x5258af0) returned 0x3 [0181.496] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.496] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.496] WbemDefPath:IUnknown:QueryInterface (in: This=0x52614b0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.496] WbemDefPath:IUnknown:Release (This=0x52614b0) returned 0x2 [0181.496] WbemDefPath:IUnknown:Release (This=0x52614b0) returned 0x1 [0181.496] SetEvent (hEvent=0x910) returned 1 [0181.502] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.502] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.502] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5261520) returned 0x0 [0181.502] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.502] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261520, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5261520) returned 0x0 [0181.502] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261520, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.502] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261520, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.502] WbemDefPath:IUnknown:AddRef (This=0x5261520) returned 0x3 [0181.502] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261520, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.502] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261520, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261520, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5258be0) returned 0x0 [0181.503] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5258be0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.503] WbemDefPath:IUnknown:Release (This=0x5258be0) returned 0x3 [0181.503] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.503] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261520, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.503] WbemDefPath:IUnknown:Release (This=0x5261520) returned 0x2 [0181.503] WbemDefPath:IUnknown:Release (This=0x5261520) returned 0x1 [0181.503] SetEvent (hEvent=0x914) returned 1 [0181.511] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.511] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.511] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x52612f0) returned 0x0 [0181.512] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x52612f0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x52612f0) returned 0x0 [0181.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x52612f0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x52612f0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.512] WbemDefPath:IUnknown:AddRef (This=0x52612f0) returned 0x3 [0181.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x52612f0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x52612f0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x52612f0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5258dd8) returned 0x0 [0181.512] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5258dd8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.512] WbemDefPath:IUnknown:Release (This=0x5258dd8) returned 0x3 [0181.512] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.512] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x52612f0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.512] WbemDefPath:IUnknown:Release (This=0x52612f0) returned 0x2 [0181.512] WbemDefPath:IUnknown:Release (This=0x52612f0) returned 0x1 [0181.512] SetEvent (hEvent=0x918) returned 1 [0181.520] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.520] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.520] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5261600) returned 0x0 [0181.520] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.520] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261600, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5261600) returned 0x0 [0181.520] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261600, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.520] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261600, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.520] WbemDefPath:IUnknown:AddRef (This=0x5261600) returned 0x3 [0181.520] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261600, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.520] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261600, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.520] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261600, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5258ef8) returned 0x0 [0181.520] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5258ef8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.520] WbemDefPath:IUnknown:Release (This=0x5258ef8) returned 0x3 [0181.520] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.521] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.521] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261600, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.521] WbemDefPath:IUnknown:Release (This=0x5261600) returned 0x2 [0181.521] WbemDefPath:IUnknown:Release (This=0x5261600) returned 0x1 [0181.521] SetEvent (hEvent=0x91c) returned 1 [0181.528] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.528] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5261670) returned 0x0 [0181.528] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261670, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5261670) returned 0x0 [0181.529] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261670, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.529] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261670, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.529] WbemDefPath:IUnknown:AddRef (This=0x5261670) returned 0x3 [0181.529] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261670, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.529] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261670, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.529] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261670, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5258f40) returned 0x0 [0181.529] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5258f40, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.529] WbemDefPath:IUnknown:Release (This=0x5258f40) returned 0x3 [0181.529] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.529] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.529] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261670, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.529] WbemDefPath:IUnknown:Release (This=0x5261670) returned 0x2 [0181.529] WbemDefPath:IUnknown:Release (This=0x5261670) returned 0x1 [0181.529] SetEvent (hEvent=0x920) returned 1 [0181.539] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.540] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.540] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x52618a0) returned 0x0 [0181.540] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.540] WbemDefPath:IUnknown:QueryInterface (in: This=0x52618a0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x52618a0) returned 0x0 [0181.540] WbemDefPath:IUnknown:QueryInterface (in: This=0x52618a0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.540] WbemDefPath:IUnknown:QueryInterface (in: This=0x52618a0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.540] WbemDefPath:IUnknown:AddRef (This=0x52618a0) returned 0x3 [0181.540] WbemDefPath:IUnknown:QueryInterface (in: This=0x52618a0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.540] WbemDefPath:IUnknown:QueryInterface (in: This=0x52618a0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.540] WbemDefPath:IUnknown:QueryInterface (in: This=0x52618a0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5259390) returned 0x0 [0181.540] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5259390, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.540] WbemDefPath:IUnknown:Release (This=0x5259390) returned 0x3 [0181.540] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.540] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.540] WbemDefPath:IUnknown:QueryInterface (in: This=0x52618a0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.541] WbemDefPath:IUnknown:Release (This=0x52618a0) returned 0x2 [0181.541] WbemDefPath:IUnknown:Release (This=0x52618a0) returned 0x1 [0181.541] SetEvent (hEvent=0x924) returned 1 [0181.547] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.547] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.547] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x52613d0) returned 0x0 [0181.547] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.547] WbemDefPath:IUnknown:QueryInterface (in: This=0x52613d0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x52613d0) returned 0x0 [0181.547] WbemDefPath:IUnknown:QueryInterface (in: This=0x52613d0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.547] WbemDefPath:IUnknown:QueryInterface (in: This=0x52613d0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.548] WbemDefPath:IUnknown:AddRef (This=0x52613d0) returned 0x3 [0181.548] WbemDefPath:IUnknown:QueryInterface (in: This=0x52613d0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.548] WbemDefPath:IUnknown:QueryInterface (in: This=0x52613d0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.548] WbemDefPath:IUnknown:QueryInterface (in: This=0x52613d0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x52594c8) returned 0x0 [0181.548] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x52594c8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.548] WbemDefPath:IUnknown:Release (This=0x52594c8) returned 0x3 [0181.548] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.548] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.548] WbemDefPath:IUnknown:QueryInterface (in: This=0x52613d0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.548] WbemDefPath:IUnknown:Release (This=0x52613d0) returned 0x2 [0181.548] WbemDefPath:IUnknown:Release (This=0x52613d0) returned 0x1 [0181.548] SetEvent (hEvent=0x928) returned 1 [0181.556] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.556] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.556] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5261980) returned 0x0 [0181.556] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.556] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261980, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5261980) returned 0x0 [0181.556] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261980, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.556] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261980, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.557] WbemDefPath:IUnknown:AddRef (This=0x5261980) returned 0x3 [0181.557] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261980, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.557] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261980, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.557] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261980, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5259588) returned 0x0 [0181.557] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5259588, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.557] WbemDefPath:IUnknown:Release (This=0x5259588) returned 0x3 [0181.557] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.557] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.557] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261980, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.557] WbemDefPath:IUnknown:Release (This=0x5261980) returned 0x2 [0181.557] WbemDefPath:IUnknown:Release (This=0x5261980) returned 0x1 [0181.557] SetEvent (hEvent=0x92c) returned 1 [0181.563] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.564] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5261360) returned 0x0 [0181.564] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261360, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5261360) returned 0x0 [0181.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261360, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261360, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.564] WbemDefPath:IUnknown:AddRef (This=0x5261360) returned 0x3 [0181.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261360, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261360, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261360, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x52597e0) returned 0x0 [0181.564] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x52597e0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.564] WbemDefPath:IUnknown:Release (This=0x52597e0) returned 0x3 [0181.564] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.564] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261360, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.565] WbemDefPath:IUnknown:Release (This=0x5261360) returned 0x2 [0181.565] WbemDefPath:IUnknown:Release (This=0x5261360) returned 0x1 [0181.565] SetEvent (hEvent=0x930) returned 1 [0181.574] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.575] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.575] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5261a60) returned 0x0 [0181.575] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.575] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261a60, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5261a60) returned 0x0 [0181.575] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261a60, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.575] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261a60, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.575] WbemDefPath:IUnknown:AddRef (This=0x5261a60) returned 0x3 [0181.575] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261a60, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.575] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261a60, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.575] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261a60, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5259810) returned 0x0 [0181.575] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5259810, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.575] WbemDefPath:IUnknown:Release (This=0x5259810) returned 0x3 [0181.575] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.575] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.576] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261a60, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.576] WbemDefPath:IUnknown:Release (This=0x5261a60) returned 0x2 [0181.576] WbemDefPath:IUnknown:Release (This=0x5261a60) returned 0x1 [0181.576] SetEvent (hEvent=0x934) returned 1 [0181.583] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.583] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.583] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5261440) returned 0x0 [0181.583] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.583] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261440, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5261440) returned 0x0 [0181.583] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261440, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.583] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261440, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.583] WbemDefPath:IUnknown:AddRef (This=0x5261440) returned 0x3 [0181.583] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261440, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261440, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261440, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5259b70) returned 0x0 [0181.584] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5259b70, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.584] WbemDefPath:IUnknown:Release (This=0x5259b70) returned 0x3 [0181.584] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.584] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261440, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.584] WbemDefPath:IUnknown:Release (This=0x5261440) returned 0x2 [0181.584] WbemDefPath:IUnknown:Release (This=0x5261440) returned 0x1 [0181.584] SetEvent (hEvent=0x938) returned 1 [0181.591] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.591] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.591] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5261830) returned 0x0 [0181.591] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.591] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261830, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5261830) returned 0x0 [0181.591] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261830, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.591] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261830, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.591] WbemDefPath:IUnknown:AddRef (This=0x5261830) returned 0x3 [0181.591] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261830, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.591] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261830, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.591] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261830, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5259ab0) returned 0x0 [0181.591] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5259ab0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.591] WbemDefPath:IUnknown:Release (This=0x5259ab0) returned 0x3 [0181.591] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.592] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.592] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261830, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.592] WbemDefPath:IUnknown:Release (This=0x5261830) returned 0x2 [0181.592] WbemDefPath:IUnknown:Release (This=0x5261830) returned 0x1 [0181.592] SetEvent (hEvent=0x93c) returned 1 [0181.603] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.603] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.603] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5260f70) returned 0x0 [0181.603] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.603] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260f70, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5260f70) returned 0x0 [0181.604] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260f70, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.604] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260f70, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.604] WbemDefPath:IUnknown:AddRef (This=0x5260f70) returned 0x3 [0181.604] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260f70, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.604] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260f70, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.604] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260f70, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5259f18) returned 0x0 [0181.604] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5259f18, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.604] WbemDefPath:IUnknown:Release (This=0x5259f18) returned 0x3 [0181.604] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.604] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.604] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260f70, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.604] WbemDefPath:IUnknown:Release (This=0x5260f70) returned 0x2 [0181.604] WbemDefPath:IUnknown:Release (This=0x5260f70) returned 0x1 [0181.604] SetEvent (hEvent=0x940) returned 1 [0181.611] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.611] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.611] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x52619f0) returned 0x0 [0181.611] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.611] WbemDefPath:IUnknown:QueryInterface (in: This=0x52619f0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x52619f0) returned 0x0 [0181.611] WbemDefPath:IUnknown:QueryInterface (in: This=0x52619f0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.611] WbemDefPath:IUnknown:QueryInterface (in: This=0x52619f0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.611] WbemDefPath:IUnknown:AddRef (This=0x52619f0) returned 0x3 [0181.611] WbemDefPath:IUnknown:QueryInterface (in: This=0x52619f0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.611] WbemDefPath:IUnknown:QueryInterface (in: This=0x52619f0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.611] WbemDefPath:IUnknown:QueryInterface (in: This=0x52619f0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5259ee8) returned 0x0 [0181.611] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5259ee8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.612] WbemDefPath:IUnknown:Release (This=0x5259ee8) returned 0x3 [0181.612] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.612] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.612] WbemDefPath:IUnknown:QueryInterface (in: This=0x52619f0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.612] WbemDefPath:IUnknown:Release (This=0x52619f0) returned 0x2 [0181.612] WbemDefPath:IUnknown:Release (This=0x52619f0) returned 0x1 [0181.612] SetEvent (hEvent=0x944) returned 1 [0181.619] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.620] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.620] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5260db0) returned 0x0 [0181.620] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.620] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260db0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5260db0) returned 0x0 [0181.620] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260db0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.620] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260db0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.620] WbemDefPath:IUnknown:AddRef (This=0x5260db0) returned 0x3 [0181.620] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260db0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.620] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260db0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.620] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260db0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x525a098) returned 0x0 [0181.620] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x525a098, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.620] WbemDefPath:IUnknown:Release (This=0x525a098) returned 0x3 [0181.620] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.620] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.620] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260db0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.621] WbemDefPath:IUnknown:Release (This=0x5260db0) returned 0x2 [0181.621] WbemDefPath:IUnknown:Release (This=0x5260db0) returned 0x1 [0181.621] SetEvent (hEvent=0x948) returned 1 [0181.627] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.627] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.627] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5261050) returned 0x0 [0181.627] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.627] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261050, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5261050) returned 0x0 [0181.627] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261050, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.627] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261050, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.627] WbemDefPath:IUnknown:AddRef (This=0x5261050) returned 0x3 [0181.628] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261050, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.628] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261050, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.628] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261050, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x525a440) returned 0x0 [0181.628] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x525a440, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.628] WbemDefPath:IUnknown:Release (This=0x525a440) returned 0x3 [0181.628] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.628] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.628] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261050, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.628] WbemDefPath:IUnknown:Release (This=0x5261050) returned 0x2 [0181.628] WbemDefPath:IUnknown:Release (This=0x5261050) returned 0x1 [0181.628] SetEvent (hEvent=0x94c) returned 1 [0181.636] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.636] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.636] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5260e20) returned 0x0 [0181.636] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.636] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260e20, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5260e20) returned 0x0 [0181.636] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260e20, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.636] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260e20, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.636] WbemDefPath:IUnknown:AddRef (This=0x5260e20) returned 0x3 [0181.636] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260e20, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.636] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260e20, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.636] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260e20, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x525a410) returned 0x0 [0181.636] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x525a410, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.636] WbemDefPath:IUnknown:Release (This=0x525a410) returned 0x3 [0181.636] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.637] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.637] WbemDefPath:IUnknown:QueryInterface (in: This=0x5260e20, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.637] WbemDefPath:IUnknown:Release (This=0x5260e20) returned 0x2 [0181.637] WbemDefPath:IUnknown:Release (This=0x5260e20) returned 0x1 [0181.637] SetEvent (hEvent=0x950) returned 1 [0181.644] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.644] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.644] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5261280) returned 0x0 [0181.644] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.645] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261280, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5261280) returned 0x0 [0181.645] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261280, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.645] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261280, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.645] WbemDefPath:IUnknown:AddRef (This=0x5261280) returned 0x3 [0181.645] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261280, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.645] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261280, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.645] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261280, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x525a878) returned 0x0 [0181.645] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x525a878, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.645] WbemDefPath:IUnknown:Release (This=0x525a878) returned 0x3 [0181.645] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.645] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.645] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261280, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.645] WbemDefPath:IUnknown:Release (This=0x5261280) returned 0x2 [0181.645] WbemDefPath:IUnknown:Release (This=0x5261280) returned 0x1 [0181.645] SetEvent (hEvent=0x954) returned 1 [0181.653] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.653] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.653] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x52616e0) returned 0x0 [0181.653] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.653] WbemDefPath:IUnknown:QueryInterface (in: This=0x52616e0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x52616e0) returned 0x0 [0181.653] WbemDefPath:IUnknown:QueryInterface (in: This=0x52616e0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.653] WbemDefPath:IUnknown:QueryInterface (in: This=0x52616e0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.653] WbemDefPath:IUnknown:AddRef (This=0x52616e0) returned 0x3 [0181.653] WbemDefPath:IUnknown:QueryInterface (in: This=0x52616e0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.653] WbemDefPath:IUnknown:QueryInterface (in: This=0x52616e0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.653] WbemDefPath:IUnknown:QueryInterface (in: This=0x52616e0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x525a728) returned 0x0 [0181.653] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x525a728, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.654] WbemDefPath:IUnknown:Release (This=0x525a728) returned 0x3 [0181.654] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.654] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.654] WbemDefPath:IUnknown:QueryInterface (in: This=0x52616e0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.654] WbemDefPath:IUnknown:Release (This=0x52616e0) returned 0x2 [0181.654] WbemDefPath:IUnknown:Release (This=0x52616e0) returned 0x1 [0181.654] SetEvent (hEvent=0x958) returned 1 [0181.660] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.661] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5261750) returned 0x0 [0181.661] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261750, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5261750) returned 0x0 [0181.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261750, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261750, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.661] WbemDefPath:IUnknown:AddRef (This=0x5261750) returned 0x3 [0181.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261750, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261750, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261750, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x525ab78) returned 0x0 [0181.661] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x525ab78, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.661] WbemDefPath:IUnknown:Release (This=0x525ab78) returned 0x3 [0181.661] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.662] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.662] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261750, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.662] WbemDefPath:IUnknown:Release (This=0x5261750) returned 0x2 [0181.662] WbemDefPath:IUnknown:Release (This=0x5261750) returned 0x1 [0181.662] SetEvent (hEvent=0x95c) returned 1 [0181.671] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.671] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5261130) returned 0x0 [0181.671] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261130, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5261130) returned 0x0 [0181.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261130, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261130, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.672] WbemDefPath:IUnknown:AddRef (This=0x5261130) returned 0x3 [0181.672] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261130, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.672] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261130, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.672] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261130, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x525aad0) returned 0x0 [0181.672] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x525aad0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.672] WbemDefPath:IUnknown:Release (This=0x525aad0) returned 0x3 [0181.672] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.672] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.672] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261130, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.672] WbemDefPath:IUnknown:Release (This=0x5261130) returned 0x2 [0181.672] WbemDefPath:IUnknown:Release (This=0x5261130) returned 0x1 [0181.672] SetEvent (hEvent=0x960) returned 1 [0181.680] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.680] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5261210) returned 0x0 [0181.680] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261210, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5261210) returned 0x0 [0181.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261210, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261210, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.680] WbemDefPath:IUnknown:AddRef (This=0x5261210) returned 0x3 [0181.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261210, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261210, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261210, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x525ad28) returned 0x0 [0181.680] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x525ad28, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.680] WbemDefPath:IUnknown:Release (This=0x525ad28) returned 0x3 [0181.680] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.680] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261210, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.681] WbemDefPath:IUnknown:Release (This=0x5261210) returned 0x2 [0181.681] WbemDefPath:IUnknown:Release (This=0x5261210) returned 0x1 [0181.681] SetEvent (hEvent=0x964) returned 1 [0181.686] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.687] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.687] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x52617c0) returned 0x0 [0181.687] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.687] WbemDefPath:IUnknown:QueryInterface (in: This=0x52617c0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x52617c0) returned 0x0 [0181.687] WbemDefPath:IUnknown:QueryInterface (in: This=0x52617c0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.687] WbemDefPath:IUnknown:QueryInterface (in: This=0x52617c0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.687] WbemDefPath:IUnknown:AddRef (This=0x52617c0) returned 0x3 [0181.687] WbemDefPath:IUnknown:QueryInterface (in: This=0x52617c0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.687] WbemDefPath:IUnknown:QueryInterface (in: This=0x52617c0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.687] WbemDefPath:IUnknown:QueryInterface (in: This=0x52617c0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x525b190) returned 0x0 [0181.687] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x525b190, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.687] WbemDefPath:IUnknown:Release (This=0x525b190) returned 0x3 [0181.687] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.687] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.687] WbemDefPath:IUnknown:QueryInterface (in: This=0x52617c0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.687] WbemDefPath:IUnknown:Release (This=0x52617c0) returned 0x2 [0181.687] WbemDefPath:IUnknown:Release (This=0x52617c0) returned 0x1 [0181.687] SetEvent (hEvent=0x968) returned 1 [0181.693] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.693] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.693] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5261c90) returned 0x0 [0181.693] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.693] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261c90, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5261c90) returned 0x0 [0181.693] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261c90, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.693] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261c90, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.693] WbemDefPath:IUnknown:AddRef (This=0x5261c90) returned 0x3 [0181.693] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261c90, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.693] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261c90, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.693] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261c90, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x525b250) returned 0x0 [0181.693] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x525b250, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.693] WbemDefPath:IUnknown:Release (This=0x525b250) returned 0x3 [0181.693] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.693] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.693] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261c90, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.693] WbemDefPath:IUnknown:Release (This=0x5261c90) returned 0x2 [0181.693] WbemDefPath:IUnknown:Release (This=0x5261c90) returned 0x1 [0181.694] SetEvent (hEvent=0x96c) returned 1 [0181.700] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.700] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5261c20) returned 0x0 [0181.700] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261c20, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5261c20) returned 0x0 [0181.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261c20, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261c20, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.700] WbemDefPath:IUnknown:AddRef (This=0x5261c20) returned 0x3 [0181.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261c20, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261c20, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261c20, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x525b4d8) returned 0x0 [0181.700] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x525b4d8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.700] WbemDefPath:IUnknown:Release (This=0x525b4d8) returned 0x3 [0181.700] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.701] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.701] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261c20, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.701] WbemDefPath:IUnknown:Release (This=0x5261c20) returned 0x2 [0181.701] WbemDefPath:IUnknown:Release (This=0x5261c20) returned 0x1 [0181.701] SetEvent (hEvent=0x970) returned 1 [0181.706] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.707] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.707] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5261bb0) returned 0x0 [0181.707] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.707] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261bb0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5261bb0) returned 0x0 [0181.707] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261bb0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.707] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261bb0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.707] WbemDefPath:IUnknown:AddRef (This=0x5261bb0) returned 0x3 [0181.707] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261bb0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.707] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261bb0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.707] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261bb0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x525b568) returned 0x0 [0181.707] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x525b568, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.707] WbemDefPath:IUnknown:Release (This=0x525b568) returned 0x3 [0181.707] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.707] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.708] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261bb0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.708] WbemDefPath:IUnknown:Release (This=0x5261bb0) returned 0x2 [0181.708] WbemDefPath:IUnknown:Release (This=0x5261bb0) returned 0x1 [0181.708] SetEvent (hEvent=0x974) returned 1 [0181.714] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.714] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.714] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5261b40) returned 0x0 [0181.714] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.714] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261b40, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5261b40) returned 0x0 [0181.714] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261b40, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.714] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261b40, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.714] WbemDefPath:IUnknown:AddRef (This=0x5261b40) returned 0x3 [0181.714] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261b40, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.715] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261b40, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.715] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261b40, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5274b08) returned 0x0 [0181.715] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5274b08, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.715] WbemDefPath:IUnknown:Release (This=0x5274b08) returned 0x3 [0181.715] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.715] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.715] WbemDefPath:IUnknown:QueryInterface (in: This=0x5261b40, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.715] WbemDefPath:IUnknown:Release (This=0x5261b40) returned 0x2 [0181.715] WbemDefPath:IUnknown:Release (This=0x5261b40) returned 0x1 [0181.715] SetEvent (hEvent=0x978) returned 1 [0181.720] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.720] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.720] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5277c88) returned 0x0 [0181.720] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.720] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277c88, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5277c88) returned 0x0 [0181.720] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277c88, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.720] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277c88, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.720] WbemDefPath:IUnknown:AddRef (This=0x5277c88) returned 0x3 [0181.720] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277c88, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.720] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277c88, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.720] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277c88, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5274940) returned 0x0 [0181.720] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5274940, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.720] WbemDefPath:IUnknown:Release (This=0x5274940) returned 0x3 [0181.720] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.720] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.721] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277c88, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.721] WbemDefPath:IUnknown:Release (This=0x5277c88) returned 0x2 [0181.721] WbemDefPath:IUnknown:Release (This=0x5277c88) returned 0x1 [0181.721] SetEvent (hEvent=0x97c) returned 1 [0181.725] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.725] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.725] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5277d68) returned 0x0 [0181.725] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.725] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277d68, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5277d68) returned 0x0 [0181.725] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277d68, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.725] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277d68, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.725] WbemDefPath:IUnknown:AddRef (This=0x5277d68) returned 0x3 [0181.726] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277d68, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.726] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277d68, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.726] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277d68, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5274d90) returned 0x0 [0181.726] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5274d90, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.726] WbemDefPath:IUnknown:Release (This=0x5274d90) returned 0x3 [0181.726] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.726] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.726] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277d68, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.726] WbemDefPath:IUnknown:Release (This=0x5277d68) returned 0x2 [0181.726] WbemDefPath:IUnknown:Release (This=0x5277d68) returned 0x1 [0181.726] SetEvent (hEvent=0x980) returned 1 [0181.734] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.734] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.734] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5277a58) returned 0x0 [0181.734] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.734] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277a58, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5277a58) returned 0x0 [0181.735] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277a58, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.735] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277a58, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.735] WbemDefPath:IUnknown:AddRef (This=0x5277a58) returned 0x3 [0181.735] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277a58, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.735] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277a58, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.735] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277a58, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5274cd0) returned 0x0 [0181.735] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5274cd0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.735] WbemDefPath:IUnknown:Release (This=0x5274cd0) returned 0x3 [0181.735] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.735] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.735] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277a58, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.735] WbemDefPath:IUnknown:Release (This=0x5277a58) returned 0x2 [0181.735] WbemDefPath:IUnknown:Release (This=0x5277a58) returned 0x1 [0181.735] SetEvent (hEvent=0x984) returned 1 [0181.739] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.739] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.740] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5277f98) returned 0x0 [0181.740] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.740] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277f98, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5277f98) returned 0x0 [0181.740] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277f98, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.740] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277f98, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.740] WbemDefPath:IUnknown:AddRef (This=0x5277f98) returned 0x3 [0181.740] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277f98, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.740] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277f98, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.740] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277f98, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5275090) returned 0x0 [0181.740] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5275090, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.740] WbemDefPath:IUnknown:Release (This=0x5275090) returned 0x3 [0181.740] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.740] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.740] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277f98, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.740] WbemDefPath:IUnknown:Release (This=0x5277f98) returned 0x2 [0181.740] WbemDefPath:IUnknown:Release (This=0x5277f98) returned 0x1 [0181.740] SetEvent (hEvent=0x988) returned 1 [0181.745] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.745] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.745] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5277b38) returned 0x0 [0181.745] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.745] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277b38, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5277b38) returned 0x0 [0181.746] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277b38, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.746] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277b38, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.746] WbemDefPath:IUnknown:AddRef (This=0x5277b38) returned 0x3 [0181.746] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277b38, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.746] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277b38, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.746] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277b38, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5275378) returned 0x0 [0181.746] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5275378, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.746] WbemDefPath:IUnknown:Release (This=0x5275378) returned 0x3 [0181.746] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.746] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.746] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277b38, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.746] WbemDefPath:IUnknown:Release (This=0x5277b38) returned 0x2 [0181.746] WbemDefPath:IUnknown:Release (This=0x5277b38) returned 0x1 [0181.746] SetEvent (hEvent=0x98c) returned 1 [0181.749] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.750] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.750] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5277f28) returned 0x0 [0181.750] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.750] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277f28, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5277f28) returned 0x0 [0181.750] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277f28, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.750] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277f28, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.750] WbemDefPath:IUnknown:AddRef (This=0x5277f28) returned 0x3 [0181.750] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277f28, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.750] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277f28, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.750] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277f28, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x52754e0) returned 0x0 [0181.750] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x52754e0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.750] WbemDefPath:IUnknown:Release (This=0x52754e0) returned 0x3 [0181.750] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.750] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.750] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277f28, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.750] WbemDefPath:IUnknown:Release (This=0x5277f28) returned 0x2 [0181.750] WbemDefPath:IUnknown:Release (This=0x5277f28) returned 0x1 [0181.750] SetEvent (hEvent=0x990) returned 1 [0181.755] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.755] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.755] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x52779e8) returned 0x0 [0181.756] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.756] WbemDefPath:IUnknown:QueryInterface (in: This=0x52779e8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x52779e8) returned 0x0 [0181.756] WbemDefPath:IUnknown:QueryInterface (in: This=0x52779e8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.756] WbemDefPath:IUnknown:QueryInterface (in: This=0x52779e8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.756] WbemDefPath:IUnknown:AddRef (This=0x52779e8) returned 0x3 [0181.756] WbemDefPath:IUnknown:QueryInterface (in: This=0x52779e8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.756] WbemDefPath:IUnknown:QueryInterface (in: This=0x52779e8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.756] WbemDefPath:IUnknown:QueryInterface (in: This=0x52779e8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x52756a8) returned 0x0 [0181.756] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x52756a8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.756] WbemDefPath:IUnknown:Release (This=0x52756a8) returned 0x3 [0181.756] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.756] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.756] WbemDefPath:IUnknown:QueryInterface (in: This=0x52779e8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.756] WbemDefPath:IUnknown:Release (This=0x52779e8) returned 0x2 [0181.756] WbemDefPath:IUnknown:Release (This=0x52779e8) returned 0x1 [0181.756] SetEvent (hEvent=0x994) returned 1 [0181.762] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.762] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.762] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5278548) returned 0x0 [0181.762] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.762] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278548, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5278548) returned 0x0 [0181.762] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278548, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.762] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278548, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.762] WbemDefPath:IUnknown:AddRef (This=0x5278548) returned 0x3 [0181.762] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278548, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.762] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278548, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.762] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278548, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x52757c8) returned 0x0 [0181.762] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x52757c8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.762] WbemDefPath:IUnknown:Release (This=0x52757c8) returned 0x3 [0181.762] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.763] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.763] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278548, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.763] WbemDefPath:IUnknown:Release (This=0x5278548) returned 0x2 [0181.763] WbemDefPath:IUnknown:Release (This=0x5278548) returned 0x1 [0181.763] SetEvent (hEvent=0x998) returned 1 [0181.766] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.766] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.766] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5278698) returned 0x0 [0181.767] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.767] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278698, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5278698) returned 0x0 [0181.767] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278698, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.767] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278698, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.767] WbemDefPath:IUnknown:AddRef (This=0x5278698) returned 0x3 [0181.767] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278698, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.767] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278698, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.767] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278698, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5275858) returned 0x0 [0181.767] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5275858, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.767] WbemDefPath:IUnknown:Release (This=0x5275858) returned 0x3 [0181.767] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.767] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.767] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278698, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.767] WbemDefPath:IUnknown:Release (This=0x5278698) returned 0x2 [0181.767] WbemDefPath:IUnknown:Release (This=0x5278698) returned 0x1 [0181.767] SetEvent (hEvent=0x99c) returned 1 [0181.855] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.855] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.855] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x52785b8) returned 0x0 [0181.855] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.855] WbemDefPath:IUnknown:QueryInterface (in: This=0x52785b8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x52785b8) returned 0x0 [0181.855] WbemDefPath:IUnknown:QueryInterface (in: This=0x52785b8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.855] WbemDefPath:IUnknown:QueryInterface (in: This=0x52785b8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.856] WbemDefPath:IUnknown:AddRef (This=0x52785b8) returned 0x3 [0181.856] WbemDefPath:IUnknown:QueryInterface (in: This=0x52785b8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.856] WbemDefPath:IUnknown:QueryInterface (in: This=0x52785b8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.856] WbemDefPath:IUnknown:QueryInterface (in: This=0x52785b8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5275828) returned 0x0 [0181.856] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5275828, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.856] WbemDefPath:IUnknown:Release (This=0x5275828) returned 0x3 [0181.856] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.856] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.856] WbemDefPath:IUnknown:QueryInterface (in: This=0x52785b8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.856] WbemDefPath:IUnknown:Release (This=0x52785b8) returned 0x2 [0181.856] WbemDefPath:IUnknown:Release (This=0x52785b8) returned 0x1 [0181.856] SetEvent (hEvent=0x9a0) returned 1 [0181.861] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.861] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.861] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5277cf8) returned 0x0 [0181.861] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.861] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277cf8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5277cf8) returned 0x0 [0181.861] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277cf8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.861] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277cf8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.862] WbemDefPath:IUnknown:AddRef (This=0x5277cf8) returned 0x3 [0181.862] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277cf8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.862] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277cf8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.862] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277cf8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5275c90) returned 0x0 [0181.862] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5275c90, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.862] WbemDefPath:IUnknown:Release (This=0x5275c90) returned 0x3 [0181.862] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.862] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.862] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277cf8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.862] WbemDefPath:IUnknown:Release (This=0x5277cf8) returned 0x2 [0181.862] WbemDefPath:IUnknown:Release (This=0x5277cf8) returned 0x1 [0181.862] SetEvent (hEvent=0x8a0) returned 1 [0181.866] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.866] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.866] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5277978) returned 0x0 [0181.866] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.866] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277978, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5277978) returned 0x0 [0181.866] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277978, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.866] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277978, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.866] WbemDefPath:IUnknown:AddRef (This=0x5277978) returned 0x3 [0181.866] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277978, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.867] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277978, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.867] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277978, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5275ba0) returned 0x0 [0181.867] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5275ba0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.867] WbemDefPath:IUnknown:Release (This=0x5275ba0) returned 0x3 [0181.867] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.867] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.867] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277978, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.867] WbemDefPath:IUnknown:Release (This=0x5277978) returned 0x2 [0181.867] WbemDefPath:IUnknown:Release (This=0x5277978) returned 0x1 [0181.867] SetEvent (hEvent=0x89c) returned 1 [0181.871] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.871] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.871] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5277ba8) returned 0x0 [0181.871] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.871] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277ba8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5277ba8) returned 0x0 [0181.871] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277ba8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.871] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277ba8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.871] WbemDefPath:IUnknown:AddRef (This=0x5277ba8) returned 0x3 [0181.871] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277ba8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.871] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277ba8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277ba8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5276080) returned 0x0 [0181.872] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5276080, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.872] WbemDefPath:IUnknown:Release (This=0x5276080) returned 0x3 [0181.872] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.872] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277ba8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.872] WbemDefPath:IUnknown:Release (This=0x5277ba8) returned 0x2 [0181.872] WbemDefPath:IUnknown:Release (This=0x5277ba8) returned 0x1 [0181.872] SetEvent (hEvent=0x898) returned 1 [0181.876] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.876] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.876] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5277dd8) returned 0x0 [0181.876] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.876] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277dd8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5277dd8) returned 0x0 [0181.876] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277dd8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.876] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277dd8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.876] WbemDefPath:IUnknown:AddRef (This=0x5277dd8) returned 0x3 [0181.876] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277dd8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277dd8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277dd8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5275ed0) returned 0x0 [0181.877] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5275ed0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.877] WbemDefPath:IUnknown:Release (This=0x5275ed0) returned 0x3 [0181.877] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.877] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.877] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277dd8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.877] WbemDefPath:IUnknown:Release (This=0x5277dd8) returned 0x2 [0181.877] WbemDefPath:IUnknown:Release (This=0x5277dd8) returned 0x1 [0181.877] SetEvent (hEvent=0x890) returned 1 [0181.881] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.881] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5278388) returned 0x0 [0181.881] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.882] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278388, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5278388) returned 0x0 [0181.882] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278388, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.882] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278388, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.882] WbemDefPath:IUnknown:AddRef (This=0x5278388) returned 0x3 [0181.882] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278388, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.882] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278388, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.882] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278388, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x52761a0) returned 0x0 [0181.882] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x52761a0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.882] WbemDefPath:IUnknown:Release (This=0x52761a0) returned 0x3 [0181.882] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.882] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.882] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278388, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.882] WbemDefPath:IUnknown:Release (This=0x5278388) returned 0x2 [0181.882] WbemDefPath:IUnknown:Release (This=0x5278388) returned 0x1 [0181.882] SetEvent (hEvent=0x8a4) returned 1 [0181.886] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.886] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.886] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x52782a8) returned 0x0 [0181.886] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.886] WbemDefPath:IUnknown:QueryInterface (in: This=0x52782a8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x52782a8) returned 0x0 [0181.886] WbemDefPath:IUnknown:QueryInterface (in: This=0x52782a8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.886] WbemDefPath:IUnknown:QueryInterface (in: This=0x52782a8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.886] WbemDefPath:IUnknown:AddRef (This=0x52782a8) returned 0x3 [0181.886] WbemDefPath:IUnknown:QueryInterface (in: This=0x52782a8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.886] WbemDefPath:IUnknown:QueryInterface (in: This=0x52782a8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.886] WbemDefPath:IUnknown:QueryInterface (in: This=0x52782a8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x52762d8) returned 0x0 [0181.886] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x52762d8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.886] WbemDefPath:IUnknown:Release (This=0x52762d8) returned 0x3 [0181.886] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.886] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.886] WbemDefPath:IUnknown:QueryInterface (in: This=0x52782a8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.887] WbemDefPath:IUnknown:Release (This=0x52782a8) returned 0x2 [0181.887] WbemDefPath:IUnknown:Release (This=0x52782a8) returned 0x1 [0181.887] SetEvent (hEvent=0x754) returned 1 [0181.890] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d200) returned 0x0 [0181.890] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d200, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.890] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d200, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5277e48) returned 0x0 [0181.890] WbemDefPath:IUnknown:Release (This=0x71d200) returned 0x0 [0181.890] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277e48, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5277e48) returned 0x0 [0181.890] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277e48, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.890] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277e48, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.890] WbemDefPath:IUnknown:AddRef (This=0x5277e48) returned 0x3 [0181.890] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277e48, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.890] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277e48, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.890] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277e48, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x52766c8) returned 0x0 [0181.890] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x52766c8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.890] WbemDefPath:IUnknown:Release (This=0x52766c8) returned 0x3 [0181.890] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.890] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.890] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277e48, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.891] WbemDefPath:IUnknown:Release (This=0x5277e48) returned 0x2 [0181.891] WbemDefPath:IUnknown:Release (This=0x5277e48) returned 0x1 [0181.891] SetEvent (hEvent=0x74c) returned 1 [0181.893] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d050) returned 0x0 [0181.893] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d050, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.894] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d050, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5278468) returned 0x0 [0181.894] WbemDefPath:IUnknown:Release (This=0x71d050) returned 0x0 [0181.894] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278468, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5278468) returned 0x0 [0181.894] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278468, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.894] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278468, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.894] WbemDefPath:IUnknown:AddRef (This=0x5278468) returned 0x3 [0181.894] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278468, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.894] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278468, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.894] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278468, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x52764a0) returned 0x0 [0181.894] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x52764a0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.894] WbemDefPath:IUnknown:Release (This=0x52764a0) returned 0x3 [0181.894] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.894] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.895] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278468, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.895] WbemDefPath:IUnknown:Release (This=0x5278468) returned 0x2 [0181.895] WbemDefPath:IUnknown:Release (This=0x5278468) returned 0x1 [0181.895] SetEvent (hEvent=0x748) returned 1 [0181.899] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d050) returned 0x0 [0181.899] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d050, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.899] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d050, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5278078) returned 0x0 [0181.899] WbemDefPath:IUnknown:Release (This=0x71d050) returned 0x0 [0181.899] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278078, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5278078) returned 0x0 [0181.900] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278078, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.900] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278078, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.900] WbemDefPath:IUnknown:AddRef (This=0x5278078) returned 0x3 [0181.900] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278078, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.900] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278078, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.900] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278078, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x52767a0) returned 0x0 [0181.900] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x52767a0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.900] WbemDefPath:IUnknown:Release (This=0x52767a0) returned 0x3 [0181.900] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.900] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.900] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278078, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.900] WbemDefPath:IUnknown:Release (This=0x5278078) returned 0x2 [0181.900] WbemDefPath:IUnknown:Release (This=0x5278078) returned 0x1 [0181.900] SetEvent (hEvent=0x744) returned 1 [0181.903] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d050) returned 0x0 [0181.903] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d050, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.904] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d050, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x52784d8) returned 0x0 [0181.904] WbemDefPath:IUnknown:Release (This=0x71d050) returned 0x0 [0181.904] WbemDefPath:IUnknown:QueryInterface (in: This=0x52784d8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x52784d8) returned 0x0 [0181.904] WbemDefPath:IUnknown:QueryInterface (in: This=0x52784d8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.904] WbemDefPath:IUnknown:QueryInterface (in: This=0x52784d8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.904] WbemDefPath:IUnknown:AddRef (This=0x52784d8) returned 0x3 [0181.904] WbemDefPath:IUnknown:QueryInterface (in: This=0x52784d8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.904] WbemDefPath:IUnknown:QueryInterface (in: This=0x52784d8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.904] WbemDefPath:IUnknown:QueryInterface (in: This=0x52784d8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x52767b8) returned 0x0 [0181.904] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x52767b8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.904] WbemDefPath:IUnknown:Release (This=0x52767b8) returned 0x3 [0181.904] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.904] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.904] WbemDefPath:IUnknown:QueryInterface (in: This=0x52784d8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.904] WbemDefPath:IUnknown:Release (This=0x52784d8) returned 0x2 [0181.904] WbemDefPath:IUnknown:Release (This=0x52784d8) returned 0x1 [0181.904] SetEvent (hEvent=0x750) returned 1 [0181.909] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x71d050) returned 0x0 [0181.909] WbemDefPath:IUnknown:QueryInterface (in: This=0x71d050, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0181.909] WbemDefPath:IClassFactory:CreateInstance (in: This=0x71d050, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5278628) returned 0x0 [0181.910] WbemDefPath:IUnknown:Release (This=0x71d050) returned 0x0 [0181.910] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278628, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5278628) returned 0x0 [0181.910] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278628, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0181.910] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278628, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0181.910] WbemDefPath:IUnknown:AddRef (This=0x5278628) returned 0x3 [0181.910] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278628, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0181.910] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278628, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0181.910] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278628, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5276c98) returned 0x0 [0181.910] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5276c98, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.910] WbemDefPath:IUnknown:Release (This=0x5276c98) returned 0x3 [0181.911] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0181.911] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0181.911] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278628, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0181.911] WbemDefPath:IUnknown:Release (This=0x5278628) returned 0x2 [0181.911] WbemDefPath:IUnknown:Release (This=0x5278628) returned 0x1 [0181.911] SetEvent (hEvent=0x73c) returned 1 [0188.201] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de828) returned 0x0 [0188.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de828, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0188.202] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de828, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5278238) returned 0x0 [0188.202] WbemDefPath:IUnknown:Release (This=0x51de828) returned 0x0 [0188.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278238, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5278238) returned 0x0 [0188.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278238, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0188.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278238, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0188.202] WbemDefPath:IUnknown:AddRef (This=0x5278238) returned 0x3 [0188.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278238, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0188.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278238, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0188.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278238, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5276e30) returned 0x0 [0188.202] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5276e30, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0188.202] WbemDefPath:IUnknown:Release (This=0x5276e30) returned 0x3 [0188.202] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0188.202] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0188.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278238, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0188.203] WbemDefPath:IUnknown:Release (This=0x5278238) returned 0x2 [0188.203] WbemDefPath:IUnknown:Release (This=0x5278238) returned 0x1 [0188.203] SetEvent (hEvent=0x3b8) returned 1 [0188.279] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de918) returned 0x0 [0188.279] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de918, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0188.279] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de918, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5278158) returned 0x0 [0188.279] WbemDefPath:IUnknown:Release (This=0x51de918) returned 0x0 [0188.279] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278158, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5278158) returned 0x0 [0188.279] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278158, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0188.279] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278158, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0188.280] WbemDefPath:IUnknown:AddRef (This=0x5278158) returned 0x3 [0188.280] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278158, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0188.280] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278158, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0188.280] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278158, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x5276f80) returned 0x0 [0188.280] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5276f80, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0188.280] WbemDefPath:IUnknown:Release (This=0x5276f80) returned 0x3 [0188.280] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0188.280] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0188.280] WbemDefPath:IUnknown:QueryInterface (in: This=0x5278158, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0188.280] WbemDefPath:IUnknown:Release (This=0x5278158) returned 0x2 [0188.280] WbemDefPath:IUnknown:Release (This=0x5278158) returned 0x1 [0188.280] SetEvent (hEvent=0x3bc) returned 1 [0188.471] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de838) returned 0x0 [0188.472] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de838, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0188.472] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de838, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5277ac8) returned 0x0 [0188.472] WbemDefPath:IUnknown:Release (This=0x51de838) returned 0x0 [0188.472] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277ac8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5277ac8) returned 0x0 [0188.472] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277ac8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0188.472] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277ac8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0188.472] WbemDefPath:IUnknown:AddRef (This=0x5277ac8) returned 0x3 [0188.472] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277ac8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0188.472] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277ac8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0188.472] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277ac8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x52770e8) returned 0x0 [0188.472] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x52770e8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0188.472] WbemDefPath:IUnknown:Release (This=0x52770e8) returned 0x3 [0188.472] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0188.472] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0188.472] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277ac8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0188.472] WbemDefPath:IUnknown:Release (This=0x5277ac8) returned 0x2 [0188.473] WbemDefPath:IUnknown:Release (This=0x5277ac8) returned 0x1 [0188.473] SetEvent (hEvent=0x334) returned 1 [0188.703] CoGetClassObject (in: rclsid=0x51c9b34*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5e0f248 | out: ppv=0x5e0f248*=0x51de948) returned 0x0 [0188.704] WbemDefPath:IUnknown:QueryInterface (in: This=0x51de948, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5e0f464 | out: ppvObject=0x5e0f464*=0x0) returned 0x80004002 [0188.704] WbemDefPath:IClassFactory:CreateInstance (in: This=0x51de948, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f470 | out: ppvObject=0x5e0f470*=0x5277c18) returned 0x0 [0188.704] WbemDefPath:IUnknown:Release (This=0x51de948) returned 0x0 [0188.704] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277c18, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0f094 | out: ppvObject=0x5e0f094*=0x5277c18) returned 0x0 [0188.705] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277c18, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5e0f050 | out: ppvObject=0x5e0f050*=0x0) returned 0x80004002 [0188.705] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277c18, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5e0ec44 | out: ppvObject=0x5e0ec44*=0x0) returned 0x80004002 [0188.705] WbemDefPath:IUnknown:AddRef (This=0x5277c18) returned 0x3 [0188.705] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277c18, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5e0e9a4 | out: ppvObject=0x5e0e9a4*=0x0) returned 0x80004002 [0188.705] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277c18, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5e0e954 | out: ppvObject=0x5e0e954*=0x0) returned 0x80004002 [0188.705] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277c18, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0e960 | out: ppvObject=0x5e0e960*=0x52772f8) returned 0x0 [0188.705] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x52772f8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5e0e968 | out: pCid=0x5e0e968*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0188.706] WbemDefPath:IUnknown:Release (This=0x52772f8) returned 0x3 [0188.706] CoGetContextToken (in: pToken=0x5e0e9c0 | out: pToken=0x5e0e9c0) returned 0x0 [0188.706] CoGetContextToken (in: pToken=0x5e0edc8 | out: pToken=0x5e0edc8) returned 0x0 [0188.706] WbemDefPath:IUnknown:QueryInterface (in: This=0x5277c18, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5e0ee54 | out: ppvObject=0x5e0ee54*=0x0) returned 0x80004002 [0188.706] WbemDefPath:IUnknown:Release (This=0x5277c18) returned 0x2 [0188.706] WbemDefPath:IUnknown:Release (This=0x5277c18) returned 0x1 [0188.706] SetEvent (hEvent=0x648) returned 1 Thread: id = 14 os_tid = 0x132c [0162.103] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0162.103] RoInitialize () returned 0x1 [0162.103] RoUninitialize () returned 0x0 [0162.105] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x5f6f774 | out: lpiid=0x5f6f774) returned 0x0 [0162.107] CoGetClassObject (in: rclsid=0x51ca074*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5f6f480 | out: ppv=0x5f6f480*=0x72cb00) returned 0x0 [0162.306] WbemLocator:IUnknown:QueryInterface (in: This=0x72cb00, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5f6f69c | out: ppvObject=0x5f6f69c*=0x0) returned 0x80004002 [0162.306] WbemLocator:IClassFactory:CreateInstance (in: This=0x72cb00, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5f6f6a8 | out: ppvObject=0x5f6f6a8*=0x51dea08) returned 0x0 [0162.307] WbemLocator:IUnknown:Release (This=0x72cb00) returned 0x0 [0162.307] WbemLocator:IUnknown:QueryInterface (in: This=0x51dea08, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5f6f2cc | out: ppvObject=0x5f6f2cc*=0x51dea08) returned 0x0 [0162.307] WbemLocator:IUnknown:QueryInterface (in: This=0x51dea08, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5f6f288 | out: ppvObject=0x5f6f288*=0x0) returned 0x80004002 [0162.307] WbemLocator:IUnknown:QueryInterface (in: This=0x51dea08, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5f6ee7c | out: ppvObject=0x5f6ee7c*=0x0) returned 0x80004002 [0162.307] WbemLocator:IUnknown:AddRef (This=0x51dea08) returned 0x3 [0162.307] WbemLocator:IUnknown:QueryInterface (in: This=0x51dea08, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5f6ebdc | out: ppvObject=0x5f6ebdc*=0x0) returned 0x80004002 [0162.307] WbemLocator:IUnknown:QueryInterface (in: This=0x51dea08, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5f6eb8c | out: ppvObject=0x5f6eb8c*=0x0) returned 0x80004002 [0162.307] WbemLocator:IUnknown:QueryInterface (in: This=0x51dea08, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5f6eb98 | out: ppvObject=0x5f6eb98*=0x0) returned 0x80004002 [0162.307] CoGetContextToken (in: pToken=0x5f6ebf8 | out: pToken=0x5f6ebf8) returned 0x0 [0162.308] CoGetObjectContext (in: riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x72cb4c | out: ppv=0x72cb4c*=0x66f9c0) returned 0x0 [0162.311] CoGetContextToken (in: pToken=0x5f6f000 | out: pToken=0x5f6f000) returned 0x0 [0162.311] WbemLocator:IUnknown:QueryInterface (in: This=0x51dea08, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5f6f08c | out: ppvObject=0x5f6f08c*=0x0) returned 0x80004002 [0162.311] WbemLocator:IUnknown:Release (This=0x51dea08) returned 0x2 [0162.311] WbemLocator:IUnknown:Release (This=0x51dea08) returned 0x1 [0162.313] CoGetContextToken (in: pToken=0x5f6f688 | out: pToken=0x5f6f688) returned 0x0 [0162.313] CoGetContextToken (in: pToken=0x5f6f5e8 | out: pToken=0x5f6f5e8) returned 0x0 [0162.313] WbemLocator:IUnknown:QueryInterface (in: This=0x51dea08, riid=0x5f6f6b8*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5f6f6b4 | out: ppvObject=0x5f6f6b4*=0x51dea08) returned 0x0 [0162.313] WbemLocator:IUnknown:AddRef (This=0x51dea08) returned 0x3 [0162.313] WbemLocator:IUnknown:Release (This=0x51dea08) returned 0x2 [0162.315] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x5f6f84c | out: puCount=0x5f6f84c*=0x2) returned 0x0 [0162.315] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=8, puBuffLength=0x5f6f848*=0x0, pszText=0x0 | out: puBuffLength=0x5f6f848*=0xf, pszText=0x0) returned 0x0 [0162.315] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=8, puBuffLength=0x5f6f848*=0xf, pszText="00000000000000" | out: puBuffLength=0x5f6f848*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.321] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x5f6ea80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0162.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", cchWideChar=63, lpMultiByteStr=0x5f6efc8, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll\x05b\x1f¤hÿgH{(ú\x01oÈòö\x05\x01", lpUsedDefaultChar=0x0) returned 63 [0162.322] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll") returned 0x688d0000 [0162.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResetSecurity", cchWideChar=13, lpMultiByteStr=0x5f6effc, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResetSecurity ¤hÿgH{(ú\x01oÈòö\x05\x01", lpUsedDefaultChar=0x0) returned 13 [0162.477] GetProcAddress (hModule=0x688d0000, lpProcName="ResetSecurity") returned 0x688d2cc0 [0162.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetSecurity", cchWideChar=11, lpMultiByteStr=0x5f6effc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetSecurity\x05´ ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 11 [0162.479] GetProcAddress (hModule=0x688d0000, lpProcName="SetSecurity") returned 0x688d2d10 [0162.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServices", cchWideChar=18, lpMultiByteStr=0x5f6eff8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServices¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 18 [0162.494] GetProcAddress (hModule=0x688d0000, lpProcName="BlessIWbemServices") returned 0x688d2090 [0162.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServicesObject", cchWideChar=24, lpMultiByteStr=0x5f6eff0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesObject´ ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 24 [0162.518] GetProcAddress (hModule=0x688d0000, lpProcName="BlessIWbemServicesObject") returned 0x688d20f0 [0162.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyHandle", cchWideChar=17, lpMultiByteStr=0x5f6eff8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyHandle ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 17 [0162.544] GetProcAddress (hModule=0x688d0000, lpProcName="GetPropertyHandle") returned 0x688d27a0 [0162.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WritePropertyValue", cchWideChar=18, lpMultiByteStr=0x5f6eff8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WritePropertyValue¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 18 [0162.556] GetProcAddress (hModule=0x688d0000, lpProcName="WritePropertyValue") returned 0x688d2e50 [0162.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x5f6f004, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 5 [0162.570] GetProcAddress (hModule=0x688d0000, lpProcName="Clone") returned 0x688d2150 [0162.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VerifyClientKey", cchWideChar=15, lpMultiByteStr=0x5f6eff8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VerifyClientKey\x05´ ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 15 [0162.581] GetProcAddress (hModule=0x688d0000, lpProcName="VerifyClientKey") returned 0x688d2e00 [0162.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetQualifierSet", cchWideChar=15, lpMultiByteStr=0x5f6eff8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetQualifierSet\x05´ ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 15 [0162.586] GetProcAddress (hModule=0x688d0000, lpProcName="GetQualifierSet") returned 0x688d2860 [0162.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Get", cchWideChar=3, lpMultiByteStr=0x5f6f004, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Get\x05´ ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 3 [0162.588] GetProcAddress (hModule=0x688d0000, lpProcName="Get") returned 0x688d2630 [0162.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Put", cchWideChar=3, lpMultiByteStr=0x5f6f004, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Put\x05´ ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 3 [0162.606] GetProcAddress (hModule=0x688d0000, lpProcName="Put") returned 0x688d2970 [0162.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Delete", cchWideChar=6, lpMultiByteStr=0x5f6f004, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Delete¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 6 [0162.623] GetProcAddress (hModule=0x688d0000, lpProcName="Delete") returned 0x688d2410 [0162.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetNames", cchWideChar=8, lpMultiByteStr=0x5f6f000, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetNames´ ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 8 [0162.637] GetProcAddress (hModule=0x688d0000, lpProcName="GetNames") returned 0x688d2740 [0162.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginEnumeration", cchWideChar=16, lpMultiByteStr=0x5f6eff8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginEnumeration´ ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 16 [0162.661] GetProcAddress (hModule=0x688d0000, lpProcName="BeginEnumeration") returned 0x688d2050 [0162.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Next", cchWideChar=4, lpMultiByteStr=0x5f6f004, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Next´ ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 4 [0162.669] GetProcAddress (hModule=0x688d0000, lpProcName="Next") returned 0x688d2910 [0162.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndEnumeration", cchWideChar=14, lpMultiByteStr=0x5f6effc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndEnumeration¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 14 [0162.685] GetProcAddress (hModule=0x688d0000, lpProcName="EndEnumeration") returned 0x688d24d0 [0162.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyQualifierSet", cchWideChar=23, lpMultiByteStr=0x5f6eff0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyQualifierSet\x05´ ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 23 [0162.692] GetProcAddress (hModule=0x688d0000, lpProcName="GetPropertyQualifierSet") returned 0x688d2830 [0162.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x5f6f004, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 5 [0162.705] GetProcAddress (hModule=0x688d0000, lpProcName="Clone") returned 0x688d2150 [0162.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetObjectText", cchWideChar=13, lpMultiByteStr=0x5f6effc, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetObjectText ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 13 [0162.705] GetProcAddress (hModule=0x688d0000, lpProcName="GetObjectText") returned 0x688d2770 [0162.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnDerivedClass", cchWideChar=17, lpMultiByteStr=0x5f6eff8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnDerivedClass ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 17 [0162.717] GetProcAddress (hModule=0x688d0000, lpProcName="SpawnDerivedClass") returned 0x688d2d60 [0162.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnInstance", cchWideChar=13, lpMultiByteStr=0x5f6effc, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnInstance ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 13 [0162.727] GetProcAddress (hModule=0x688d0000, lpProcName="SpawnInstance") returned 0x688d2d90 [0162.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CompareTo", cchWideChar=9, lpMultiByteStr=0x5f6f000, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CompareTo ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 9 [0162.729] GetProcAddress (hModule=0x688d0000, lpProcName="CompareTo") returned 0x688d2200 [0162.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyOrigin", cchWideChar=17, lpMultiByteStr=0x5f6eff8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyOrigin ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 17 [0162.740] GetProcAddress (hModule=0x688d0000, lpProcName="GetPropertyOrigin") returned 0x688d2800 [0162.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="InheritsFrom", cchWideChar=12, lpMultiByteStr=0x5f6effc, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InheritsFrom´ ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 12 [0162.754] GetProcAddress (hModule=0x688d0000, lpProcName="InheritsFrom") returned 0x688d2880 [0162.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethod", cchWideChar=9, lpMultiByteStr=0x5f6f000, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethod ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 9 [0162.756] GetProcAddress (hModule=0x688d0000, lpProcName="GetMethod") returned 0x688d26b0 [0162.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutMethod", cchWideChar=9, lpMultiByteStr=0x5f6f000, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutMethod ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 9 [0162.769] GetProcAddress (hModule=0x688d0000, lpProcName="PutMethod") returned 0x688d2ae0 [0162.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DeleteMethod", cchWideChar=12, lpMultiByteStr=0x5f6effc, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DeleteMethod´ ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 12 [0162.783] GetProcAddress (hModule=0x688d0000, lpProcName="DeleteMethod") returned 0x688d2430 [0162.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginMethodEnumeration", cchWideChar=22, lpMultiByteStr=0x5f6eff4, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginMethodEnumeration¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 22 [0162.784] GetProcAddress (hModule=0x688d0000, lpProcName="BeginMethodEnumeration") returned 0x688d2070 [0162.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NextMethod", cchWideChar=10, lpMultiByteStr=0x5f6f000, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMethod¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 10 [0162.786] GetProcAddress (hModule=0x688d0000, lpProcName="NextMethod") returned 0x688d2940 [0162.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndMethodEnumeration", cchWideChar=20, lpMultiByteStr=0x5f6eff4, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndMethodEnumeration´ ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 20 [0162.804] GetProcAddress (hModule=0x688d0000, lpProcName="EndMethodEnumeration") returned 0x688d24f0 [0162.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodQualifierSet", cchWideChar=21, lpMultiByteStr=0x5f6eff4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodQualifierSet ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 21 [0162.812] GetProcAddress (hModule=0x688d0000, lpProcName="GetMethodQualifierSet") returned 0x688d2710 [0162.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodOrigin", cchWideChar=15, lpMultiByteStr=0x5f6eff8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodOrigin\x05´ ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 15 [0162.815] GetProcAddress (hModule=0x688d0000, lpProcName="GetMethodOrigin") returned 0x688d26e0 [0162.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Get", cchWideChar=16, lpMultiByteStr=0x5f6eff8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Get´ ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 16 [0162.817] GetProcAddress (hModule=0x688d0000, lpProcName="QualifierSet_Get") returned 0x688d2b70 [0162.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Put", cchWideChar=16, lpMultiByteStr=0x5f6eff8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Put´ ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 16 [0162.897] GetProcAddress (hModule=0x688d0000, lpProcName="QualifierSet_Put") returned 0x688d2c00 [0162.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Delete", cchWideChar=19, lpMultiByteStr=0x5f6eff4, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Delete\x05´ ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 19 [0162.921] GetProcAddress (hModule=0x688d0000, lpProcName="QualifierSet_Delete") returned 0x688d2b30 [0162.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_GetNames", cchWideChar=21, lpMultiByteStr=0x5f6eff4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_GetNames ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 21 [0162.923] GetProcAddress (hModule=0x688d0000, lpProcName="QualifierSet_GetNames") returned 0x688d2ba0 [0162.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_BeginEnumeration", cchWideChar=29, lpMultiByteStr=0x5f6efec, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_BeginEnumeration ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 29 [0162.938] GetProcAddress (hModule=0x688d0000, lpProcName="QualifierSet_BeginEnumeration") returned 0x688d2b10 [0162.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Next", cchWideChar=17, lpMultiByteStr=0x5f6eff8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Next ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 17 [0162.939] GetProcAddress (hModule=0x688d0000, lpProcName="QualifierSet_Next") returned 0x688d2bd0 [0162.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_EndEnumeration", cchWideChar=27, lpMultiByteStr=0x5f6efec, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_EndEnumeration\x05´ ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 27 [0162.950] GetProcAddress (hModule=0x688d0000, lpProcName="QualifierSet_EndEnumeration") returned 0x688d2b50 [0162.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentApartmentType", cchWideChar=23, lpMultiByteStr=0x5f6eff0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentApartmentType\x05´ ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 23 [0162.951] GetProcAddress (hModule=0x688d0000, lpProcName="GetCurrentApartmentType") returned 0x688d2860 [0162.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetDemultiplexedStub", cchWideChar=20, lpMultiByteStr=0x5f6eff4, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetDemultiplexedStub´ ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 20 [0162.957] GetProcAddress (hModule=0x688d0000, lpProcName="GetDemultiplexedStub") returned 0x688d2660 [0162.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateInstanceEnumWmi", cchWideChar=21, lpMultiByteStr=0x5f6eff4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateInstanceEnumWmi ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 21 [0162.966] GetProcAddress (hModule=0x688d0000, lpProcName="CreateInstanceEnumWmi") returned 0x688d2380 [0162.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateClassEnumWmi", cchWideChar=18, lpMultiByteStr=0x5f6eff8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateClassEnumWmi¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 18 [0162.984] GetProcAddress (hModule=0x688d0000, lpProcName="CreateClassEnumWmi") returned 0x688d22f0 [0162.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecQueryWmi", cchWideChar=12, lpMultiByteStr=0x5f6effc, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecQueryWmi´ ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 12 [0162.986] GetProcAddress (hModule=0x688d0000, lpProcName="ExecQueryWmi") returned 0x688d25a0 [0163.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecNotificationQueryWmi", cchWideChar=24, lpMultiByteStr=0x5f6eff0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecNotificationQueryWmi´ ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 24 [0163.022] GetProcAddress (hModule=0x688d0000, lpProcName="ExecNotificationQueryWmi") returned 0x688d2510 [0163.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutInstanceWmi", cchWideChar=14, lpMultiByteStr=0x5f6effc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutInstanceWmi¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 14 [0163.023] GetProcAddress (hModule=0x688d0000, lpProcName="PutInstanceWmi") returned 0x688d2a40 [0163.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutClassWmi", cchWideChar=11, lpMultiByteStr=0x5f6effc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutClassWmi\x05´ ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 11 [0163.042] GetProcAddress (hModule=0x688d0000, lpProcName="PutClassWmi") returned 0x688d29a0 [0163.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloneEnumWbemClassObject", cchWideChar=24, lpMultiByteStr=0x5f6eff0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloneEnumWbemClassObject´ ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 24 [0163.044] GetProcAddress (hModule=0x688d0000, lpProcName="CloneEnumWbemClassObject") returned 0x688d2170 [0163.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ConnectServerWmi", cchWideChar=16, lpMultiByteStr=0x5f6eff8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ConnectServerWmi´ ¤hÿgH{(ú\x01oÈòö\x05", lpUsedDefaultChar=0x0) returned 16 [0163.051] GetProcAddress (hModule=0x688d0000, lpProcName="ConnectServerWmi") returned 0x688d2230 [0163.101] CoCreateInstance (in: rclsid=0x688d13b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x688d1414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x5f6f724 | out: ppv=0x5f6f724*=0x51de988) returned 0x0 [0163.101] WbemLocator:IWbemLocator:ConnectServer (in: This=0x51de988, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x5f6f7b8 | out: ppNamespace=0x5f6f7b8*=0x7254f0) returned 0x0 [0166.901] WbemLocator:IUnknown:QueryInterface (in: This=0x7254f0, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5f6f64c | out: ppvObject=0x5f6f64c*=0x716c2c) returned 0x0 [0166.901] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x716c2c, pProxy=0x7254f0, pAuthnSvc=0x5f6f69c, pAuthzSvc=0x5f6f698, pServerPrincName=0x5f6f690, pAuthnLevel=0x5f6f694, pImpLevel=0x5f6f684, pAuthInfo=0x5f6f688, pCapabilites=0x5f6f68c | out: pAuthnSvc=0x5f6f69c*=0xa, pAuthzSvc=0x5f6f698*=0x0, pServerPrincName=0x5f6f690, pAuthnLevel=0x5f6f694*=0x6, pImpLevel=0x5f6f684*=0x2, pAuthInfo=0x5f6f688, pCapabilites=0x5f6f68c*=0x1) returned 0x0 [0166.901] WbemLocator:IUnknown:Release (This=0x716c2c) returned 0x1 [0166.901] WbemLocator:IUnknown:QueryInterface (in: This=0x7254f0, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5f6f640 | out: ppvObject=0x5f6f640*=0x716c50) returned 0x0 [0166.901] WbemLocator:IUnknown:QueryInterface (in: This=0x7254f0, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5f6f62c | out: ppvObject=0x5f6f62c*=0x716c2c) returned 0x0 [0166.901] WbemLocator:IClientSecurity:SetBlanket (This=0x716c2c, pProxy=0x7254f0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0166.901] WbemLocator:IUnknown:Release (This=0x716c2c) returned 0x2 [0166.901] WbemLocator:IUnknown:Release (This=0x716c50) returned 0x1 [0166.901] CoTaskMemFree (pv=0x51f08d0) [0166.902] WbemLocator:IUnknown:Release (This=0x51de988) returned 0x0 [0166.902] WbemLocator:IUnknown:QueryInterface (in: This=0x7254f0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5f6f23c | out: ppvObject=0x5f6f23c*=0x716c50) returned 0x0 [0166.902] WbemLocator:IUnknown:QueryInterface (in: This=0x716c50, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5f6f1f8 | out: ppvObject=0x5f6f1f8*=0x0) returned 0x80004002 [0166.902] WbemLocator:IUnknown:QueryInterface (in: This=0x716c50, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5f6f014 | out: ppvObject=0x5f6f014*=0x0) returned 0x80004002 [0166.902] WbemLocator:IUnknown:QueryInterface (in: This=0x7254f0, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x5f6edec | out: ppvObject=0x5f6edec*=0x0) returned 0x80004002 [0166.903] WbemLocator:IUnknown:AddRef (This=0x716c50) returned 0x3 [0166.903] WbemLocator:IUnknown:QueryInterface (in: This=0x716c50, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x5f6eb4c | out: ppvObject=0x5f6eb4c*=0x0) returned 0x80004002 [0166.903] WbemLocator:IUnknown:QueryInterface (in: This=0x716c50, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x5f6eafc | out: ppvObject=0x5f6eafc*=0x0) returned 0x80004002 [0166.903] WbemLocator:IUnknown:QueryInterface (in: This=0x716c50, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5f6eb08 | out: ppvObject=0x5f6eb08*=0x716bac) returned 0x0 [0166.903] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x716bac, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5f6eb10 | out: pCid=0x5f6eb10*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0166.903] WbemLocator:IUnknown:Release (This=0x716bac) returned 0x3 [0166.903] CoGetContextToken (in: pToken=0x5f6eb68 | out: pToken=0x5f6eb68) returned 0x0 [0166.904] CoGetContextToken (in: pToken=0x5f6ef70 | out: pToken=0x5f6ef70) returned 0x0 [0166.904] WbemLocator:IUnknown:QueryInterface (in: This=0x716c50, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5f6effc | out: ppvObject=0x5f6effc*=0x716c34) returned 0x0 [0166.904] WbemLocator:IRpcOptions:Query (in: This=0x716c34, pPrx=0x716c50, dwProperty=2, pdwValue=0x5f6f008 | out: pdwValue=0x5f6f008) returned 0x80004002 [0166.904] WbemLocator:IUnknown:Release (This=0x716c34) returned 0x3 [0166.904] WbemLocator:IUnknown:Release (This=0x716c50) returned 0x2 [0166.904] CoGetContextToken (in: pToken=0x5f6f550 | out: pToken=0x5f6f550) returned 0x0 [0166.904] CoGetContextToken (in: pToken=0x5f6f4b0 | out: pToken=0x5f6f4b0) returned 0x0 [0166.904] WbemLocator:IUnknown:QueryInterface (in: This=0x716c50, riid=0x5f6f580*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5f6f57c | out: ppvObject=0x5f6f57c*=0x7254f0) returned 0x0 [0166.904] WbemLocator:IUnknown:AddRef (This=0x7254f0) returned 0x4 [0166.904] WbemLocator:IUnknown:Release (This=0x7254f0) returned 0x3 [0166.904] WbemLocator:IUnknown:Release (This=0x7254f0) returned 0x2 [0166.905] SysStringLen (param_1=0x0) returned 0x0 [0166.906] CoUninitialize () Thread: id = 108 os_tid = 0x1330 [0166.991] CoGetContextToken (in: pToken=0x5f6f26c | out: pToken=0x5f6f26c) returned 0x0 [0166.991] CoGetContextToken (in: pToken=0x5f6f25c | out: pToken=0x5f6f25c) returned 0x0 [0166.992] CoGetMarshalSizeMax (in: pulSize=0x5f6f218, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x716c50, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x5f6f218) returned 0x0 [0166.993] CoMarshalInterface (pStm=0x51e1030, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x716c50, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0173.204] CoGetContextToken (in: pToken=0x5f6f26c | out: pToken=0x5f6f26c) returned 0x0 [0173.204] CoGetContextToken (in: pToken=0x5f6f25c | out: pToken=0x5f6f25c) returned 0x0 [0173.204] CoGetMarshalSizeMax (in: pulSize=0x5f6f218, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x717650, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x5f6f218) returned 0x0 [0173.205] CoMarshalInterface (pStm=0x51e13f0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x717650, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0173.661] CoGetContextToken (in: pToken=0x5f6f26c | out: pToken=0x5f6f26c) returned 0x0 [0173.661] CoGetContextToken (in: pToken=0x5f6f25c | out: pToken=0x5f6f25c) returned 0x0 [0173.661] CoGetMarshalSizeMax (in: pulSize=0x5f6f218, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x717c50, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x5f6f218) returned 0x0 [0173.661] CoMarshalInterface (pStm=0x51e1250, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x717c50, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0173.730] CoGetContextToken (in: pToken=0x5f6f26c | out: pToken=0x5f6f26c) returned 0x0 [0173.730] CoGetContextToken (in: pToken=0x5f6f25c | out: pToken=0x5f6f25c) returned 0x0 [0173.730] CoGetMarshalSizeMax (in: pulSize=0x5f6f218, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x715f50, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x5f6f218) returned 0x0 [0173.730] CoMarshalInterface (pStm=0x51e1470, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x715f50, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0173.803] CoGetContextToken (in: pToken=0x5f6f26c | out: pToken=0x5f6f26c) returned 0x0 [0173.803] CoGetContextToken (in: pToken=0x5f6f25c | out: pToken=0x5f6f25c) returned 0x0 [0173.803] CoGetMarshalSizeMax (in: pulSize=0x5f6f218, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x520c4e0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x5f6f218) returned 0x0 [0173.803] CoMarshalInterface (pStm=0x51b8070, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x520c4e0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0173.956] CoGetContextToken (in: pToken=0x5f6f26c | out: pToken=0x5f6f26c) returned 0x0 [0173.956] CoGetContextToken (in: pToken=0x5f6f25c | out: pToken=0x5f6f25c) returned 0x0 [0173.956] CoGetMarshalSizeMax (in: pulSize=0x5f6f218, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x520c0e0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x5f6f218) returned 0x0 [0173.957] CoMarshalInterface (pStm=0x51e14f0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x520c0e0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0174.048] CoGetContextToken (in: pToken=0x5f6f26c | out: pToken=0x5f6f26c) returned 0x0 [0174.048] CoGetContextToken (in: pToken=0x5f6f25c | out: pToken=0x5f6f25c) returned 0x0 [0174.048] CoGetMarshalSizeMax (in: pulSize=0x5f6f218, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x520cee0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x5f6f218) returned 0x0 [0174.048] CoMarshalInterface (pStm=0x5209b20, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x520cee0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0174.490] CoGetContextToken (in: pToken=0x5f6f26c | out: pToken=0x5f6f26c) returned 0x0 [0174.490] CoGetContextToken (in: pToken=0x5f6f25c | out: pToken=0x5f6f25c) returned 0x0 [0174.490] CoGetMarshalSizeMax (in: pulSize=0x5f6f218, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x520d0e0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x5f6f218) returned 0x0 [0174.491] CoMarshalInterface (pStm=0x52099a0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x520d0e0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0178.256] CoGetContextToken (in: pToken=0x5f6f26c | out: pToken=0x5f6f26c) returned 0x0 [0178.256] CoGetContextToken (in: pToken=0x5f6f25c | out: pToken=0x5f6f25c) returned 0x0 [0178.256] CoGetMarshalSizeMax (in: pulSize=0x5f6f218, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x520c9e0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x5f6f218) returned 0x0 [0178.257] CoMarshalInterface (pStm=0x5209ae0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x520c9e0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0182.023] CoGetContextToken (in: pToken=0x5f6f26c | out: pToken=0x5f6f26c) returned 0x0 [0182.023] CoGetContextToken (in: pToken=0x5f6f25c | out: pToken=0x5f6f25c) returned 0x0 [0182.023] CoGetMarshalSizeMax (in: pulSize=0x5f6f218, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x520c7e0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x5f6f218) returned 0x0 [0182.023] CoMarshalInterface (pStm=0x52098a0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x520c7e0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0188.344] CoGetContextToken (in: pToken=0x5f6f26c | out: pToken=0x5f6f26c) returned 0x0 [0188.344] CoGetContextToken (in: pToken=0x5f6f25c | out: pToken=0x5f6f25c) returned 0x0 [0188.344] CoGetMarshalSizeMax (in: pulSize=0x5f6f218, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x520c8e0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x5f6f218) returned 0x0 [0188.344] CoMarshalInterface (pStm=0x52099c0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x520c8e0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0188.538] CoGetContextToken (in: pToken=0x5f6f26c | out: pToken=0x5f6f26c) returned 0x0 [0188.538] CoGetContextToken (in: pToken=0x5f6f25c | out: pToken=0x5f6f25c) returned 0x0 [0188.538] CoGetMarshalSizeMax (in: pulSize=0x5f6f218, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x520b8e0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x5f6f218) returned 0x0 [0188.538] CoMarshalInterface (pStm=0x52097e0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x520b8e0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 Thread: id = 115 os_tid = 0x134c Thread: id = 116 os_tid = 0x1350 [0173.035] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0173.035] RoInitialize () returned 0x1 [0173.035] RoUninitialize () returned 0x0 [0173.039] CoGetClassObject (in: rclsid=0x51ca074*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x629f400 | out: ppv=0x629f400*=0x72c2d8) returned 0x0 [0173.039] WbemLocator:IUnknown:QueryInterface (in: This=0x72c2d8, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x629f61c | out: ppvObject=0x629f61c*=0x0) returned 0x80004002 [0173.040] WbemLocator:IClassFactory:CreateInstance (in: This=0x72c2d8, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f628 | out: ppvObject=0x629f628*=0x51dec08) returned 0x0 [0173.040] WbemLocator:IUnknown:Release (This=0x72c2d8) returned 0x0 [0173.040] WbemLocator:IUnknown:QueryInterface (in: This=0x51dec08, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f24c | out: ppvObject=0x629f24c*=0x51dec08) returned 0x0 [0173.040] WbemLocator:IUnknown:QueryInterface (in: This=0x51dec08, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x629f208 | out: ppvObject=0x629f208*=0x0) returned 0x80004002 [0173.040] WbemLocator:IUnknown:QueryInterface (in: This=0x51dec08, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x629edfc | out: ppvObject=0x629edfc*=0x0) returned 0x80004002 [0173.040] WbemLocator:IUnknown:AddRef (This=0x51dec08) returned 0x3 [0173.040] WbemLocator:IUnknown:QueryInterface (in: This=0x51dec08, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x629eb5c | out: ppvObject=0x629eb5c*=0x0) returned 0x80004002 [0173.040] WbemLocator:IUnknown:QueryInterface (in: This=0x51dec08, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x629eb0c | out: ppvObject=0x629eb0c*=0x0) returned 0x80004002 [0173.040] WbemLocator:IUnknown:QueryInterface (in: This=0x51dec08, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629eb18 | out: ppvObject=0x629eb18*=0x0) returned 0x80004002 [0173.040] CoGetContextToken (in: pToken=0x629eb78 | out: pToken=0x629eb78) returned 0x0 [0173.041] CoGetContextToken (in: pToken=0x629ef80 | out: pToken=0x629ef80) returned 0x0 [0173.041] WbemLocator:IUnknown:QueryInterface (in: This=0x51dec08, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f00c | out: ppvObject=0x629f00c*=0x0) returned 0x80004002 [0173.041] WbemLocator:IUnknown:Release (This=0x51dec08) returned 0x2 [0173.041] WbemLocator:IUnknown:Release (This=0x51dec08) returned 0x1 [0173.041] CoGetContextToken (in: pToken=0x629f608 | out: pToken=0x629f608) returned 0x0 [0173.041] CoGetContextToken (in: pToken=0x629f568 | out: pToken=0x629f568) returned 0x0 [0173.041] WbemLocator:IUnknown:QueryInterface (in: This=0x51dec08, riid=0x629f638*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x629f634 | out: ppvObject=0x629f634*=0x51dec08) returned 0x0 [0173.041] WbemLocator:IUnknown:AddRef (This=0x51dec08) returned 0x3 [0173.041] WbemLocator:IUnknown:Release (This=0x51dec08) returned 0x2 [0173.041] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7be0, puCount=0x629f7cc | out: puCount=0x629f7cc*=0x2) returned 0x0 [0173.041] WbemDefPath:IWbemPath:GetText (in: This=0x51d7be0, lFlags=8, puBuffLength=0x629f7c8*=0x0, pszText=0x0 | out: puBuffLength=0x629f7c8*=0x18, pszText=0x0) returned 0x0 [0173.041] WbemDefPath:IWbemPath:GetText (in: This=0x51d7be0, lFlags=8, puBuffLength=0x629f7c8*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x629f7c8*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0173.041] CoCreateInstance (in: rclsid=0x688d13b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x688d1414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x629f690 | out: ppv=0x629f690*=0x51de598) returned 0x0 [0173.042] WbemLocator:IWbemLocator:ConnectServer (in: This=0x51de598, strNetworkResource="\\\\.\\ROOT\\SecurityCenter", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x629f738 | out: ppNamespace=0x629f738*=0x51f1058) returned 0x0 [0173.188] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1058, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f5b8 | out: ppvObject=0x629f5b8*=0x71762c) returned 0x0 [0173.188] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x71762c, pProxy=0x51f1058, pAuthnSvc=0x629f608, pAuthzSvc=0x629f604, pServerPrincName=0x629f5fc, pAuthnLevel=0x629f600, pImpLevel=0x629f5f0, pAuthInfo=0x629f5f4, pCapabilites=0x629f5f8 | out: pAuthnSvc=0x629f608*=0xa, pAuthzSvc=0x629f604*=0x0, pServerPrincName=0x629f5fc, pAuthnLevel=0x629f600*=0x6, pImpLevel=0x629f5f0*=0x2, pAuthInfo=0x629f5f4, pCapabilites=0x629f5f8*=0x1) returned 0x0 [0173.188] WbemLocator:IUnknown:Release (This=0x71762c) returned 0x1 [0173.188] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1058, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f5ac | out: ppvObject=0x629f5ac*=0x717650) returned 0x0 [0173.188] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1058, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f598 | out: ppvObject=0x629f598*=0x71762c) returned 0x0 [0173.188] WbemLocator:IClientSecurity:SetBlanket (This=0x71762c, pProxy=0x51f1058, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0173.188] WbemLocator:IUnknown:Release (This=0x71762c) returned 0x2 [0173.188] WbemLocator:IUnknown:Release (This=0x717650) returned 0x1 [0173.188] CoTaskMemFree (pv=0x51f8c78) [0173.189] WbemLocator:IUnknown:Release (This=0x51de598) returned 0x0 [0173.189] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1058, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f1a8 | out: ppvObject=0x629f1a8*=0x717650) returned 0x0 [0173.189] WbemLocator:IUnknown:QueryInterface (in: This=0x717650, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x629f164 | out: ppvObject=0x629f164*=0x0) returned 0x80004002 [0173.189] WbemLocator:IUnknown:QueryInterface (in: This=0x717650, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x629ef84 | out: ppvObject=0x629ef84*=0x0) returned 0x80004002 [0173.189] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1058, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x629ed5c | out: ppvObject=0x629ed5c*=0x0) returned 0x80004002 [0173.190] WbemLocator:IUnknown:AddRef (This=0x717650) returned 0x3 [0173.190] WbemLocator:IUnknown:QueryInterface (in: This=0x717650, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x629eabc | out: ppvObject=0x629eabc*=0x0) returned 0x80004002 [0173.190] WbemLocator:IUnknown:QueryInterface (in: This=0x717650, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x629ea6c | out: ppvObject=0x629ea6c*=0x0) returned 0x80004002 [0173.190] WbemLocator:IUnknown:QueryInterface (in: This=0x717650, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629ea78 | out: ppvObject=0x629ea78*=0x7175ac) returned 0x0 [0173.190] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x7175ac, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x629ea80 | out: pCid=0x629ea80*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0173.190] WbemLocator:IUnknown:Release (This=0x7175ac) returned 0x3 [0173.190] CoGetContextToken (in: pToken=0x629ead8 | out: pToken=0x629ead8) returned 0x0 [0173.190] CoGetContextToken (in: pToken=0x629eee0 | out: pToken=0x629eee0) returned 0x0 [0173.190] WbemLocator:IUnknown:QueryInterface (in: This=0x717650, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629ef6c | out: ppvObject=0x629ef6c*=0x717634) returned 0x0 [0173.190] WbemLocator:IRpcOptions:Query (in: This=0x717634, pPrx=0x717650, dwProperty=2, pdwValue=0x629ef78 | out: pdwValue=0x629ef78) returned 0x80004002 [0173.190] WbemLocator:IUnknown:Release (This=0x717634) returned 0x3 [0173.191] WbemLocator:IUnknown:Release (This=0x717650) returned 0x2 [0173.191] CoGetContextToken (in: pToken=0x629f4b8 | out: pToken=0x629f4b8) returned 0x0 [0173.191] CoGetContextToken (in: pToken=0x629f418 | out: pToken=0x629f418) returned 0x0 [0173.191] WbemLocator:IUnknown:QueryInterface (in: This=0x717650, riid=0x629f4e8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x629f4e4 | out: ppvObject=0x629f4e4*=0x51f1058) returned 0x0 [0173.191] WbemLocator:IUnknown:AddRef (This=0x51f1058) returned 0x4 [0173.191] WbemLocator:IUnknown:Release (This=0x51f1058) returned 0x3 [0173.191] WbemLocator:IUnknown:Release (This=0x51f1058) returned 0x2 [0173.191] SysStringLen (param_1=0x0) returned 0x0 [0173.191] CoUninitialize () Thread: id = 117 os_tid = 0x1368 [0173.625] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0173.625] RoInitialize () returned 0x1 [0173.625] RoUninitialize () returned 0x0 [0173.626] CoGetClassObject (in: rclsid=0x51ca074*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x629f380 | out: ppv=0x629f380*=0x72c698) returned 0x0 [0173.626] WbemLocator:IUnknown:QueryInterface (in: This=0x72c698, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x629f59c | out: ppvObject=0x629f59c*=0x0) returned 0x80004002 [0173.626] WbemLocator:IClassFactory:CreateInstance (in: This=0x72c698, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f5a8 | out: ppvObject=0x629f5a8*=0x51de5e8) returned 0x0 [0173.626] WbemLocator:IUnknown:Release (This=0x72c698) returned 0x0 [0173.626] WbemLocator:IUnknown:QueryInterface (in: This=0x51de5e8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f1cc | out: ppvObject=0x629f1cc*=0x51de5e8) returned 0x0 [0173.626] WbemLocator:IUnknown:QueryInterface (in: This=0x51de5e8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x629f188 | out: ppvObject=0x629f188*=0x0) returned 0x80004002 [0173.626] WbemLocator:IUnknown:QueryInterface (in: This=0x51de5e8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x629ed7c | out: ppvObject=0x629ed7c*=0x0) returned 0x80004002 [0173.627] WbemLocator:IUnknown:AddRef (This=0x51de5e8) returned 0x3 [0173.627] WbemLocator:IUnknown:QueryInterface (in: This=0x51de5e8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x629eadc | out: ppvObject=0x629eadc*=0x0) returned 0x80004002 [0173.627] WbemLocator:IUnknown:QueryInterface (in: This=0x51de5e8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x629ea8c | out: ppvObject=0x629ea8c*=0x0) returned 0x80004002 [0173.627] WbemLocator:IUnknown:QueryInterface (in: This=0x51de5e8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629ea98 | out: ppvObject=0x629ea98*=0x0) returned 0x80004002 [0173.627] CoGetContextToken (in: pToken=0x629eaf8 | out: pToken=0x629eaf8) returned 0x0 [0173.627] CoGetContextToken (in: pToken=0x629ef00 | out: pToken=0x629ef00) returned 0x0 [0173.627] WbemLocator:IUnknown:QueryInterface (in: This=0x51de5e8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629ef8c | out: ppvObject=0x629ef8c*=0x0) returned 0x80004002 [0173.627] WbemLocator:IUnknown:Release (This=0x51de5e8) returned 0x2 [0173.627] WbemLocator:IUnknown:Release (This=0x51de5e8) returned 0x1 [0173.627] CoGetContextToken (in: pToken=0x629f588 | out: pToken=0x629f588) returned 0x0 [0173.627] CoGetContextToken (in: pToken=0x629f4e8 | out: pToken=0x629f4e8) returned 0x0 [0173.627] WbemLocator:IUnknown:QueryInterface (in: This=0x51de5e8, riid=0x629f5b8*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x629f5b4 | out: ppvObject=0x629f5b4*=0x51de5e8) returned 0x0 [0173.627] WbemLocator:IUnknown:AddRef (This=0x51de5e8) returned 0x3 [0173.627] WbemLocator:IUnknown:Release (This=0x51de5e8) returned 0x2 [0173.627] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d8270, puCount=0x629f74c | out: puCount=0x629f74c*=0x2) returned 0x0 [0173.627] WbemDefPath:IWbemPath:GetText (in: This=0x51d8270, lFlags=8, puBuffLength=0x629f748*=0x0, pszText=0x0 | out: puBuffLength=0x629f748*=0x18, pszText=0x0) returned 0x0 [0173.628] WbemDefPath:IWbemPath:GetText (in: This=0x51d8270, lFlags=8, puBuffLength=0x629f748*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x629f748*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0173.628] CoCreateInstance (in: rclsid=0x688d13b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x688d1414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x629f610 | out: ppv=0x629f610*=0x51de608) returned 0x0 [0173.628] WbemLocator:IWbemLocator:ConnectServer (in: This=0x51de608, strNetworkResource="\\\\.\\ROOT\\SecurityCenter", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x629f6b8 | out: ppNamespace=0x629f6b8*=0x51f1788) returned 0x0 [0173.654] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1788, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f538 | out: ppvObject=0x629f538*=0x717c2c) returned 0x0 [0173.654] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x717c2c, pProxy=0x51f1788, pAuthnSvc=0x629f588, pAuthzSvc=0x629f584, pServerPrincName=0x629f57c, pAuthnLevel=0x629f580, pImpLevel=0x629f570, pAuthInfo=0x629f574, pCapabilites=0x629f578 | out: pAuthnSvc=0x629f588*=0xa, pAuthzSvc=0x629f584*=0x0, pServerPrincName=0x629f57c, pAuthnLevel=0x629f580*=0x6, pImpLevel=0x629f570*=0x2, pAuthInfo=0x629f574, pCapabilites=0x629f578*=0x1) returned 0x0 [0173.654] WbemLocator:IUnknown:Release (This=0x717c2c) returned 0x1 [0173.654] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1788, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f52c | out: ppvObject=0x629f52c*=0x717c50) returned 0x0 [0173.655] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1788, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f518 | out: ppvObject=0x629f518*=0x717c2c) returned 0x0 [0173.655] WbemLocator:IClientSecurity:SetBlanket (This=0x717c2c, pProxy=0x51f1788, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0173.655] WbemLocator:IUnknown:Release (This=0x717c2c) returned 0x2 [0173.655] WbemLocator:IUnknown:Release (This=0x717c50) returned 0x1 [0173.655] CoTaskMemFree (pv=0x51f8978) [0173.655] WbemLocator:IUnknown:Release (This=0x51de608) returned 0x0 [0173.655] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1788, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f128 | out: ppvObject=0x629f128*=0x717c50) returned 0x0 [0173.655] WbemLocator:IUnknown:QueryInterface (in: This=0x717c50, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x629f0e4 | out: ppvObject=0x629f0e4*=0x0) returned 0x80004002 [0173.656] WbemLocator:IUnknown:QueryInterface (in: This=0x717c50, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x629ef04 | out: ppvObject=0x629ef04*=0x0) returned 0x80004002 [0173.656] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1788, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x629ecdc | out: ppvObject=0x629ecdc*=0x0) returned 0x80004002 [0173.656] WbemLocator:IUnknown:AddRef (This=0x717c50) returned 0x3 [0173.656] WbemLocator:IUnknown:QueryInterface (in: This=0x717c50, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x629ea3c | out: ppvObject=0x629ea3c*=0x0) returned 0x80004002 [0173.656] WbemLocator:IUnknown:QueryInterface (in: This=0x717c50, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x629e9ec | out: ppvObject=0x629e9ec*=0x0) returned 0x80004002 [0173.657] WbemLocator:IUnknown:QueryInterface (in: This=0x717c50, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629e9f8 | out: ppvObject=0x629e9f8*=0x717bac) returned 0x0 [0173.657] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x717bac, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x629ea00 | out: pCid=0x629ea00*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0173.657] WbemLocator:IUnknown:Release (This=0x717bac) returned 0x3 [0173.657] CoGetContextToken (in: pToken=0x629ea58 | out: pToken=0x629ea58) returned 0x0 [0173.657] CoGetContextToken (in: pToken=0x629ee60 | out: pToken=0x629ee60) returned 0x0 [0173.657] WbemLocator:IUnknown:QueryInterface (in: This=0x717c50, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629eeec | out: ppvObject=0x629eeec*=0x717c34) returned 0x0 [0173.657] WbemLocator:IRpcOptions:Query (in: This=0x717c34, pPrx=0x717c50, dwProperty=2, pdwValue=0x629eef8 | out: pdwValue=0x629eef8) returned 0x80004002 [0173.657] WbemLocator:IUnknown:Release (This=0x717c34) returned 0x3 [0173.657] WbemLocator:IUnknown:Release (This=0x717c50) returned 0x2 [0173.657] CoGetContextToken (in: pToken=0x629f438 | out: pToken=0x629f438) returned 0x0 [0173.657] CoGetContextToken (in: pToken=0x629f398 | out: pToken=0x629f398) returned 0x0 [0173.657] WbemLocator:IUnknown:QueryInterface (in: This=0x717c50, riid=0x629f468*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x629f464 | out: ppvObject=0x629f464*=0x51f1788) returned 0x0 [0173.657] WbemLocator:IUnknown:AddRef (This=0x51f1788) returned 0x4 [0173.657] WbemLocator:IUnknown:Release (This=0x51f1788) returned 0x3 [0173.657] WbemLocator:IUnknown:Release (This=0x51f1788) returned 0x2 [0173.657] SysStringLen (param_1=0x0) returned 0x0 [0173.658] CoUninitialize () Thread: id = 118 os_tid = 0x136c [0173.699] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0173.699] RoInitialize () returned 0x1 [0173.699] RoUninitialize () returned 0x0 [0173.700] CoGetClassObject (in: rclsid=0x51ca074*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x629f300 | out: ppv=0x629f300*=0x72c860) returned 0x0 [0173.701] WbemLocator:IUnknown:QueryInterface (in: This=0x72c860, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x629f51c | out: ppvObject=0x629f51c*=0x0) returned 0x80004002 [0173.701] WbemLocator:IClassFactory:CreateInstance (in: This=0x72c860, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f528 | out: ppvObject=0x629f528*=0x51de738) returned 0x0 [0173.701] WbemLocator:IUnknown:Release (This=0x72c860) returned 0x0 [0173.701] WbemLocator:IUnknown:QueryInterface (in: This=0x51de738, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f14c | out: ppvObject=0x629f14c*=0x51de738) returned 0x0 [0173.701] WbemLocator:IUnknown:QueryInterface (in: This=0x51de738, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x629f108 | out: ppvObject=0x629f108*=0x0) returned 0x80004002 [0173.701] WbemLocator:IUnknown:QueryInterface (in: This=0x51de738, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x629ecfc | out: ppvObject=0x629ecfc*=0x0) returned 0x80004002 [0173.701] WbemLocator:IUnknown:AddRef (This=0x51de738) returned 0x3 [0173.701] WbemLocator:IUnknown:QueryInterface (in: This=0x51de738, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x629ea5c | out: ppvObject=0x629ea5c*=0x0) returned 0x80004002 [0173.701] WbemLocator:IUnknown:QueryInterface (in: This=0x51de738, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x629ea0c | out: ppvObject=0x629ea0c*=0x0) returned 0x80004002 [0173.701] WbemLocator:IUnknown:QueryInterface (in: This=0x51de738, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629ea18 | out: ppvObject=0x629ea18*=0x0) returned 0x80004002 [0173.701] CoGetContextToken (in: pToken=0x629ea78 | out: pToken=0x629ea78) returned 0x0 [0173.701] CoGetContextToken (in: pToken=0x629ee80 | out: pToken=0x629ee80) returned 0x0 [0173.701] WbemLocator:IUnknown:QueryInterface (in: This=0x51de738, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629ef0c | out: ppvObject=0x629ef0c*=0x0) returned 0x80004002 [0173.702] WbemLocator:IUnknown:Release (This=0x51de738) returned 0x2 [0173.702] WbemLocator:IUnknown:Release (This=0x51de738) returned 0x1 [0173.702] CoGetContextToken (in: pToken=0x629f508 | out: pToken=0x629f508) returned 0x0 [0173.702] CoGetContextToken (in: pToken=0x629f468 | out: pToken=0x629f468) returned 0x0 [0173.702] WbemLocator:IUnknown:QueryInterface (in: This=0x51de738, riid=0x629f538*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x629f534 | out: ppvObject=0x629f534*=0x51de738) returned 0x0 [0173.702] WbemLocator:IUnknown:AddRef (This=0x51de738) returned 0x3 [0173.702] WbemLocator:IUnknown:Release (This=0x51de738) returned 0x2 [0173.702] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7a90, puCount=0x629f6cc | out: puCount=0x629f6cc*=0x2) returned 0x0 [0173.702] WbemDefPath:IWbemPath:GetText (in: This=0x51d7a90, lFlags=8, puBuffLength=0x629f6c8*=0x0, pszText=0x0 | out: puBuffLength=0x629f6c8*=0x18, pszText=0x0) returned 0x0 [0173.702] WbemDefPath:IWbemPath:GetText (in: This=0x51d7a90, lFlags=8, puBuffLength=0x629f6c8*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x629f6c8*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0173.702] CoCreateInstance (in: rclsid=0x688d13b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x688d1414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x629f590 | out: ppv=0x629f590*=0x51de638) returned 0x0 [0173.702] WbemLocator:IWbemLocator:ConnectServer (in: This=0x51de638, strNetworkResource="\\\\.\\ROOT\\SecurityCenter", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x629f638 | out: ppNamespace=0x629f638*=0x51f16e8) returned 0x0 [0173.723] WbemLocator:IUnknown:QueryInterface (in: This=0x51f16e8, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f4b8 | out: ppvObject=0x629f4b8*=0x715f2c) returned 0x0 [0173.724] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x715f2c, pProxy=0x51f16e8, pAuthnSvc=0x629f508, pAuthzSvc=0x629f504, pServerPrincName=0x629f4fc, pAuthnLevel=0x629f500, pImpLevel=0x629f4f0, pAuthInfo=0x629f4f4, pCapabilites=0x629f4f8 | out: pAuthnSvc=0x629f508*=0xa, pAuthzSvc=0x629f504*=0x0, pServerPrincName=0x629f4fc, pAuthnLevel=0x629f500*=0x6, pImpLevel=0x629f4f0*=0x2, pAuthInfo=0x629f4f4, pCapabilites=0x629f4f8*=0x1) returned 0x0 [0173.724] WbemLocator:IUnknown:Release (This=0x715f2c) returned 0x1 [0173.724] WbemLocator:IUnknown:QueryInterface (in: This=0x51f16e8, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f4ac | out: ppvObject=0x629f4ac*=0x715f50) returned 0x0 [0173.724] WbemLocator:IUnknown:QueryInterface (in: This=0x51f16e8, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f498 | out: ppvObject=0x629f498*=0x715f2c) returned 0x0 [0173.724] WbemLocator:IClientSecurity:SetBlanket (This=0x715f2c, pProxy=0x51f16e8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0173.724] WbemLocator:IUnknown:Release (This=0x715f2c) returned 0x2 [0173.724] WbemLocator:IUnknown:Release (This=0x715f50) returned 0x1 [0173.724] CoTaskMemFree (pv=0x51f89d8) [0173.724] WbemLocator:IUnknown:Release (This=0x51de638) returned 0x0 [0173.724] WbemLocator:IUnknown:QueryInterface (in: This=0x51f16e8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f0a8 | out: ppvObject=0x629f0a8*=0x715f50) returned 0x0 [0173.725] WbemLocator:IUnknown:QueryInterface (in: This=0x715f50, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x629f064 | out: ppvObject=0x629f064*=0x0) returned 0x80004002 [0173.725] WbemLocator:IUnknown:QueryInterface (in: This=0x715f50, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x629ee84 | out: ppvObject=0x629ee84*=0x0) returned 0x80004002 [0173.725] WbemLocator:IUnknown:QueryInterface (in: This=0x51f16e8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x629ec5c | out: ppvObject=0x629ec5c*=0x0) returned 0x80004002 [0173.726] WbemLocator:IUnknown:AddRef (This=0x715f50) returned 0x3 [0173.726] WbemLocator:IUnknown:QueryInterface (in: This=0x715f50, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x629e9bc | out: ppvObject=0x629e9bc*=0x0) returned 0x80004002 [0173.726] WbemLocator:IUnknown:QueryInterface (in: This=0x715f50, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x629e96c | out: ppvObject=0x629e96c*=0x0) returned 0x80004002 [0173.726] WbemLocator:IUnknown:QueryInterface (in: This=0x715f50, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629e978 | out: ppvObject=0x629e978*=0x715eac) returned 0x0 [0173.726] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x715eac, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x629e980 | out: pCid=0x629e980*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0173.726] WbemLocator:IUnknown:Release (This=0x715eac) returned 0x3 [0173.726] CoGetContextToken (in: pToken=0x629e9d8 | out: pToken=0x629e9d8) returned 0x0 [0173.726] CoGetContextToken (in: pToken=0x629ede0 | out: pToken=0x629ede0) returned 0x0 [0173.726] WbemLocator:IUnknown:QueryInterface (in: This=0x715f50, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629ee6c | out: ppvObject=0x629ee6c*=0x715f34) returned 0x0 [0173.726] WbemLocator:IRpcOptions:Query (in: This=0x715f34, pPrx=0x715f50, dwProperty=2, pdwValue=0x629ee78 | out: pdwValue=0x629ee78) returned 0x80004002 [0173.726] WbemLocator:IUnknown:Release (This=0x715f34) returned 0x3 [0173.726] WbemLocator:IUnknown:Release (This=0x715f50) returned 0x2 [0173.726] CoGetContextToken (in: pToken=0x629f3b8 | out: pToken=0x629f3b8) returned 0x0 [0173.726] CoGetContextToken (in: pToken=0x629f318 | out: pToken=0x629f318) returned 0x0 [0173.726] WbemLocator:IUnknown:QueryInterface (in: This=0x715f50, riid=0x629f3e8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x629f3e4 | out: ppvObject=0x629f3e4*=0x51f16e8) returned 0x0 [0173.726] WbemLocator:IUnknown:AddRef (This=0x51f16e8) returned 0x4 [0173.726] WbemLocator:IUnknown:Release (This=0x51f16e8) returned 0x3 [0173.726] WbemLocator:IUnknown:Release (This=0x51f16e8) returned 0x2 [0173.726] SysStringLen (param_1=0x0) returned 0x0 [0173.726] CoUninitialize () Thread: id = 119 os_tid = 0x1370 [0173.761] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0173.761] RoInitialize () returned 0x1 [0173.761] RoUninitialize () returned 0x0 [0173.762] CoGetClassObject (in: rclsid=0x51ca074*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x629f280 | out: ppv=0x629f280*=0x520ffe8) returned 0x0 [0173.763] WbemLocator:IUnknown:QueryInterface (in: This=0x520ffe8, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x629f49c | out: ppvObject=0x629f49c*=0x0) returned 0x80004002 [0173.763] WbemLocator:IClassFactory:CreateInstance (in: This=0x520ffe8, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f4a8 | out: ppvObject=0x629f4a8*=0x51de8f8) returned 0x0 [0173.763] WbemLocator:IUnknown:Release (This=0x520ffe8) returned 0x0 [0173.763] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8f8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f0cc | out: ppvObject=0x629f0cc*=0x51de8f8) returned 0x0 [0173.763] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8f8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x629f088 | out: ppvObject=0x629f088*=0x0) returned 0x80004002 [0173.763] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8f8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x629ec7c | out: ppvObject=0x629ec7c*=0x0) returned 0x80004002 [0173.763] WbemLocator:IUnknown:AddRef (This=0x51de8f8) returned 0x3 [0173.763] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8f8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x629e9dc | out: ppvObject=0x629e9dc*=0x0) returned 0x80004002 [0173.763] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8f8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x629e98c | out: ppvObject=0x629e98c*=0x0) returned 0x80004002 [0173.763] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8f8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629e998 | out: ppvObject=0x629e998*=0x0) returned 0x80004002 [0173.763] CoGetContextToken (in: pToken=0x629e9f8 | out: pToken=0x629e9f8) returned 0x0 [0173.766] CoGetContextToken (in: pToken=0x629ee00 | out: pToken=0x629ee00) returned 0x0 [0173.766] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8f8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629ee8c | out: ppvObject=0x629ee8c*=0x0) returned 0x80004002 [0173.766] WbemLocator:IUnknown:Release (This=0x51de8f8) returned 0x2 [0173.766] WbemLocator:IUnknown:Release (This=0x51de8f8) returned 0x1 [0173.766] CoGetContextToken (in: pToken=0x629f488 | out: pToken=0x629f488) returned 0x0 [0173.766] CoGetContextToken (in: pToken=0x629f3e8 | out: pToken=0x629f3e8) returned 0x0 [0173.766] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8f8, riid=0x629f4b8*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x629f4b4 | out: ppvObject=0x629f4b4*=0x51de8f8) returned 0x0 [0173.766] WbemLocator:IUnknown:AddRef (This=0x51de8f8) returned 0x3 [0173.766] WbemLocator:IUnknown:Release (This=0x51de8f8) returned 0x2 [0173.766] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b00, puCount=0x629f64c | out: puCount=0x629f64c*=0x2) returned 0x0 [0173.766] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b00, lFlags=8, puBuffLength=0x629f648*=0x0, pszText=0x0 | out: puBuffLength=0x629f648*=0x19, pszText=0x0) returned 0x0 [0173.766] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b00, lFlags=8, puBuffLength=0x629f648*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x629f648*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0173.767] CoCreateInstance (in: rclsid=0x688d13b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x688d1414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x629f510 | out: ppv=0x629f510*=0x51de7c8) returned 0x0 [0173.767] WbemLocator:IWbemLocator:ConnectServer (in: This=0x51de7c8, strNetworkResource="\\\\.\\ROOT\\SecurityCenter2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x629f5b8 | out: ppNamespace=0x629f5b8*=0x51f15a8) returned 0x0 [0173.796] WbemLocator:IUnknown:QueryInterface (in: This=0x51f15a8, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f438 | out: ppvObject=0x629f438*=0x520c4bc) returned 0x0 [0173.796] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x520c4bc, pProxy=0x51f15a8, pAuthnSvc=0x629f488, pAuthzSvc=0x629f484, pServerPrincName=0x629f47c, pAuthnLevel=0x629f480, pImpLevel=0x629f470, pAuthInfo=0x629f474, pCapabilites=0x629f478 | out: pAuthnSvc=0x629f488*=0xa, pAuthzSvc=0x629f484*=0x0, pServerPrincName=0x629f47c, pAuthnLevel=0x629f480*=0x6, pImpLevel=0x629f470*=0x2, pAuthInfo=0x629f474, pCapabilites=0x629f478*=0x1) returned 0x0 [0173.796] WbemLocator:IUnknown:Release (This=0x520c4bc) returned 0x1 [0173.796] WbemLocator:IUnknown:QueryInterface (in: This=0x51f15a8, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f42c | out: ppvObject=0x629f42c*=0x520c4e0) returned 0x0 [0173.797] WbemLocator:IUnknown:QueryInterface (in: This=0x51f15a8, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f418 | out: ppvObject=0x629f418*=0x520c4bc) returned 0x0 [0173.797] WbemLocator:IClientSecurity:SetBlanket (This=0x520c4bc, pProxy=0x51f15a8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0173.797] WbemLocator:IUnknown:Release (This=0x520c4bc) returned 0x2 [0173.797] WbemLocator:IUnknown:Release (This=0x520c4e0) returned 0x1 [0173.797] CoTaskMemFree (pv=0x51f8a68) [0173.797] WbemLocator:IUnknown:Release (This=0x51de7c8) returned 0x0 [0173.797] WbemLocator:IUnknown:QueryInterface (in: This=0x51f15a8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f028 | out: ppvObject=0x629f028*=0x520c4e0) returned 0x0 [0173.797] WbemLocator:IUnknown:QueryInterface (in: This=0x520c4e0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x629efe4 | out: ppvObject=0x629efe4*=0x0) returned 0x80004002 [0173.798] WbemLocator:IUnknown:QueryInterface (in: This=0x520c4e0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x629ee04 | out: ppvObject=0x629ee04*=0x0) returned 0x80004002 [0173.798] WbemLocator:IUnknown:QueryInterface (in: This=0x51f15a8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x629ebdc | out: ppvObject=0x629ebdc*=0x0) returned 0x80004002 [0173.798] WbemLocator:IUnknown:AddRef (This=0x520c4e0) returned 0x3 [0173.798] WbemLocator:IUnknown:QueryInterface (in: This=0x520c4e0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x629e93c | out: ppvObject=0x629e93c*=0x0) returned 0x80004002 [0173.798] WbemLocator:IUnknown:QueryInterface (in: This=0x520c4e0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x629e8ec | out: ppvObject=0x629e8ec*=0x0) returned 0x80004002 [0173.798] WbemLocator:IUnknown:QueryInterface (in: This=0x520c4e0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629e8f8 | out: ppvObject=0x629e8f8*=0x520c43c) returned 0x0 [0173.799] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520c43c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x629e900 | out: pCid=0x629e900*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0173.799] WbemLocator:IUnknown:Release (This=0x520c43c) returned 0x3 [0173.799] CoGetContextToken (in: pToken=0x629e958 | out: pToken=0x629e958) returned 0x0 [0173.799] CoGetContextToken (in: pToken=0x629ed60 | out: pToken=0x629ed60) returned 0x0 [0173.799] WbemLocator:IUnknown:QueryInterface (in: This=0x520c4e0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629edec | out: ppvObject=0x629edec*=0x520c4c4) returned 0x0 [0173.799] WbemLocator:IRpcOptions:Query (in: This=0x520c4c4, pPrx=0x520c4e0, dwProperty=2, pdwValue=0x629edf8 | out: pdwValue=0x629edf8) returned 0x80004002 [0173.799] WbemLocator:IUnknown:Release (This=0x520c4c4) returned 0x3 [0173.799] WbemLocator:IUnknown:Release (This=0x520c4e0) returned 0x2 [0173.799] CoGetContextToken (in: pToken=0x629f338 | out: pToken=0x629f338) returned 0x0 [0173.799] CoGetContextToken (in: pToken=0x629f298 | out: pToken=0x629f298) returned 0x0 [0173.799] WbemLocator:IUnknown:QueryInterface (in: This=0x520c4e0, riid=0x629f368*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x629f364 | out: ppvObject=0x629f364*=0x51f15a8) returned 0x0 [0173.799] WbemLocator:IUnknown:AddRef (This=0x51f15a8) returned 0x4 [0173.799] WbemLocator:IUnknown:Release (This=0x51f15a8) returned 0x3 [0173.799] WbemLocator:IUnknown:Release (This=0x51f15a8) returned 0x2 [0173.799] SysStringLen (param_1=0x0) returned 0x0 [0173.800] CoUninitialize () Thread: id = 120 os_tid = 0x1374 [0173.886] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0173.887] RoInitialize () returned 0x1 [0173.887] RoUninitialize () returned 0x0 [0173.888] CoGetClassObject (in: rclsid=0x51ca074*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x629f200 | out: ppv=0x629f200*=0x5210450) returned 0x0 [0173.888] WbemLocator:IUnknown:QueryInterface (in: This=0x5210450, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x629f41c | out: ppvObject=0x629f41c*=0x0) returned 0x80004002 [0173.888] WbemLocator:IClassFactory:CreateInstance (in: This=0x5210450, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f428 | out: ppvObject=0x629f428*=0x51de8d8) returned 0x0 [0173.888] WbemLocator:IUnknown:Release (This=0x5210450) returned 0x0 [0173.888] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8d8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f04c | out: ppvObject=0x629f04c*=0x51de8d8) returned 0x0 [0173.888] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8d8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x629f008 | out: ppvObject=0x629f008*=0x0) returned 0x80004002 [0173.888] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8d8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x629ebfc | out: ppvObject=0x629ebfc*=0x0) returned 0x80004002 [0173.888] WbemLocator:IUnknown:AddRef (This=0x51de8d8) returned 0x3 [0173.888] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8d8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x629e95c | out: ppvObject=0x629e95c*=0x0) returned 0x80004002 [0173.888] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8d8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x629e90c | out: ppvObject=0x629e90c*=0x0) returned 0x80004002 [0173.888] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8d8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629e918 | out: ppvObject=0x629e918*=0x0) returned 0x80004002 [0173.888] CoGetContextToken (in: pToken=0x629e978 | out: pToken=0x629e978) returned 0x0 [0173.889] CoGetContextToken (in: pToken=0x629ed80 | out: pToken=0x629ed80) returned 0x0 [0173.889] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8d8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629ee0c | out: ppvObject=0x629ee0c*=0x0) returned 0x80004002 [0173.889] WbemLocator:IUnknown:Release (This=0x51de8d8) returned 0x2 [0173.889] WbemLocator:IUnknown:Release (This=0x51de8d8) returned 0x1 [0173.889] CoGetContextToken (in: pToken=0x629f408 | out: pToken=0x629f408) returned 0x0 [0173.889] CoGetContextToken (in: pToken=0x629f368 | out: pToken=0x629f368) returned 0x0 [0173.889] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8d8, riid=0x629f438*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x629f434 | out: ppvObject=0x629f434*=0x51de8d8) returned 0x0 [0173.889] WbemLocator:IUnknown:AddRef (This=0x51de8d8) returned 0x3 [0173.889] WbemLocator:IUnknown:Release (This=0x51de8d8) returned 0x2 [0173.889] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7e80, puCount=0x629f5cc | out: puCount=0x629f5cc*=0x2) returned 0x0 [0173.889] WbemDefPath:IWbemPath:GetText (in: This=0x51d7e80, lFlags=8, puBuffLength=0x629f5c8*=0x0, pszText=0x0 | out: puBuffLength=0x629f5c8*=0x19, pszText=0x0) returned 0x0 [0173.889] WbemDefPath:IWbemPath:GetText (in: This=0x51d7e80, lFlags=8, puBuffLength=0x629f5c8*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x629f5c8*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0173.889] CoCreateInstance (in: rclsid=0x688d13b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x688d1414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x629f490 | out: ppv=0x629f490*=0x51de798) returned 0x0 [0173.889] WbemLocator:IWbemLocator:ConnectServer (in: This=0x51de798, strNetworkResource="\\\\.\\ROOT\\SecurityCenter2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x629f538 | out: ppNamespace=0x629f538*=0x51f1918) returned 0x0 [0173.946] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1918, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f3b8 | out: ppvObject=0x629f3b8*=0x520c0bc) returned 0x0 [0173.947] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x520c0bc, pProxy=0x51f1918, pAuthnSvc=0x629f408, pAuthzSvc=0x629f404, pServerPrincName=0x629f3fc, pAuthnLevel=0x629f400, pImpLevel=0x629f3f0, pAuthInfo=0x629f3f4, pCapabilites=0x629f3f8 | out: pAuthnSvc=0x629f408*=0xa, pAuthzSvc=0x629f404*=0x0, pServerPrincName=0x629f3fc, pAuthnLevel=0x629f400*=0x6, pImpLevel=0x629f3f0*=0x2, pAuthInfo=0x629f3f4, pCapabilites=0x629f3f8*=0x1) returned 0x0 [0173.947] WbemLocator:IUnknown:Release (This=0x520c0bc) returned 0x1 [0173.947] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1918, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f3ac | out: ppvObject=0x629f3ac*=0x520c0e0) returned 0x0 [0173.947] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1918, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f398 | out: ppvObject=0x629f398*=0x520c0bc) returned 0x0 [0173.947] WbemLocator:IClientSecurity:SetBlanket (This=0x520c0bc, pProxy=0x51f1918, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0173.947] WbemLocator:IUnknown:Release (This=0x520c0bc) returned 0x2 [0173.947] WbemLocator:IUnknown:Release (This=0x520c0e0) returned 0x1 [0173.947] CoTaskMemFree (pv=0x51f8a98) [0173.947] WbemLocator:IUnknown:Release (This=0x51de798) returned 0x0 [0173.948] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1918, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629efa8 | out: ppvObject=0x629efa8*=0x520c0e0) returned 0x0 [0173.948] WbemLocator:IUnknown:QueryInterface (in: This=0x520c0e0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x629ef64 | out: ppvObject=0x629ef64*=0x0) returned 0x80004002 [0173.948] WbemLocator:IUnknown:QueryInterface (in: This=0x520c0e0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x629ed84 | out: ppvObject=0x629ed84*=0x0) returned 0x80004002 [0173.949] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1918, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x629eb5c | out: ppvObject=0x629eb5c*=0x0) returned 0x80004002 [0173.949] WbemLocator:IUnknown:AddRef (This=0x520c0e0) returned 0x3 [0173.949] WbemLocator:IUnknown:QueryInterface (in: This=0x520c0e0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x629e8bc | out: ppvObject=0x629e8bc*=0x0) returned 0x80004002 [0173.949] WbemLocator:IUnknown:QueryInterface (in: This=0x520c0e0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x629e86c | out: ppvObject=0x629e86c*=0x0) returned 0x80004002 [0173.949] WbemLocator:IUnknown:QueryInterface (in: This=0x520c0e0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629e878 | out: ppvObject=0x629e878*=0x520c03c) returned 0x0 [0173.950] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520c03c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x629e880 | out: pCid=0x629e880*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0173.950] WbemLocator:IUnknown:Release (This=0x520c03c) returned 0x3 [0173.950] CoGetContextToken (in: pToken=0x629e8d8 | out: pToken=0x629e8d8) returned 0x0 [0173.950] CoGetContextToken (in: pToken=0x629ece0 | out: pToken=0x629ece0) returned 0x0 [0173.950] WbemLocator:IUnknown:QueryInterface (in: This=0x520c0e0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629ed6c | out: ppvObject=0x629ed6c*=0x520c0c4) returned 0x0 [0173.951] WbemLocator:IRpcOptions:Query (in: This=0x520c0c4, pPrx=0x520c0e0, dwProperty=2, pdwValue=0x629ed78 | out: pdwValue=0x629ed78) returned 0x80004002 [0173.951] WbemLocator:IUnknown:Release (This=0x520c0c4) returned 0x3 [0173.951] WbemLocator:IUnknown:Release (This=0x520c0e0) returned 0x2 [0173.951] CoGetContextToken (in: pToken=0x629f2b8 | out: pToken=0x629f2b8) returned 0x0 [0173.951] CoGetContextToken (in: pToken=0x629f218 | out: pToken=0x629f218) returned 0x0 [0173.951] WbemLocator:IUnknown:QueryInterface (in: This=0x520c0e0, riid=0x629f2e8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x629f2e4 | out: ppvObject=0x629f2e4*=0x51f1918) returned 0x0 [0173.951] WbemLocator:IUnknown:AddRef (This=0x51f1918) returned 0x4 [0173.951] WbemLocator:IUnknown:Release (This=0x51f1918) returned 0x3 [0173.951] WbemLocator:IUnknown:Release (This=0x51f1918) returned 0x2 [0173.951] SysStringLen (param_1=0x0) returned 0x0 [0173.951] CoUninitialize () Thread: id = 121 os_tid = 0x137c [0174.006] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0174.006] RoInitialize () returned 0x1 [0174.006] RoUninitialize () returned 0x0 [0174.007] CoGetClassObject (in: rclsid=0x51ca074*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x629f180 | out: ppv=0x629f180*=0x5210648) returned 0x0 [0174.007] WbemLocator:IUnknown:QueryInterface (in: This=0x5210648, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x629f39c | out: ppvObject=0x629f39c*=0x0) returned 0x80004002 [0174.007] WbemLocator:IClassFactory:CreateInstance (in: This=0x5210648, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f3a8 | out: ppvObject=0x629f3a8*=0x51de8e8) returned 0x0 [0174.008] WbemLocator:IUnknown:Release (This=0x5210648) returned 0x0 [0174.008] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8e8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629efcc | out: ppvObject=0x629efcc*=0x51de8e8) returned 0x0 [0174.008] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8e8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x629ef88 | out: ppvObject=0x629ef88*=0x0) returned 0x80004002 [0174.008] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8e8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x629eb7c | out: ppvObject=0x629eb7c*=0x0) returned 0x80004002 [0174.008] WbemLocator:IUnknown:AddRef (This=0x51de8e8) returned 0x3 [0174.008] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8e8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x629e8dc | out: ppvObject=0x629e8dc*=0x0) returned 0x80004002 [0174.008] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8e8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x629e88c | out: ppvObject=0x629e88c*=0x0) returned 0x80004002 [0174.008] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8e8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629e898 | out: ppvObject=0x629e898*=0x0) returned 0x80004002 [0174.008] CoGetContextToken (in: pToken=0x629e8f8 | out: pToken=0x629e8f8) returned 0x0 [0174.009] CoGetContextToken (in: pToken=0x629ed00 | out: pToken=0x629ed00) returned 0x0 [0174.009] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8e8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629ed8c | out: ppvObject=0x629ed8c*=0x0) returned 0x80004002 [0174.009] WbemLocator:IUnknown:Release (This=0x51de8e8) returned 0x2 [0174.009] WbemLocator:IUnknown:Release (This=0x51de8e8) returned 0x1 [0174.009] CoGetContextToken (in: pToken=0x629f388 | out: pToken=0x629f388) returned 0x0 [0174.009] CoGetContextToken (in: pToken=0x629f2e8 | out: pToken=0x629f2e8) returned 0x0 [0174.009] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8e8, riid=0x629f3b8*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x629f3b4 | out: ppvObject=0x629f3b4*=0x51de8e8) returned 0x0 [0174.009] WbemLocator:IUnknown:AddRef (This=0x51de8e8) returned 0x3 [0174.009] WbemLocator:IUnknown:Release (This=0x51de8e8) returned 0x2 [0174.009] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7a20, puCount=0x629f54c | out: puCount=0x629f54c*=0x2) returned 0x0 [0174.009] WbemDefPath:IWbemPath:GetText (in: This=0x51d7a20, lFlags=8, puBuffLength=0x629f548*=0x0, pszText=0x0 | out: puBuffLength=0x629f548*=0x19, pszText=0x0) returned 0x0 [0174.009] WbemDefPath:IWbemPath:GetText (in: This=0x51d7a20, lFlags=8, puBuffLength=0x629f548*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x629f548*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0174.009] CoCreateInstance (in: rclsid=0x688d13b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x688d1414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x629f410 | out: ppv=0x629f410*=0x51de948) returned 0x0 [0174.009] WbemLocator:IWbemLocator:ConnectServer (in: This=0x51de948, strNetworkResource="\\\\.\\ROOT\\SecurityCenter2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x629f4b8 | out: ppNamespace=0x629f4b8*=0x51f1a58) returned 0x0 [0174.038] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1a58, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f338 | out: ppvObject=0x629f338*=0x520cebc) returned 0x0 [0174.038] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x520cebc, pProxy=0x51f1a58, pAuthnSvc=0x629f388, pAuthzSvc=0x629f384, pServerPrincName=0x629f37c, pAuthnLevel=0x629f380, pImpLevel=0x629f370, pAuthInfo=0x629f374, pCapabilites=0x629f378 | out: pAuthnSvc=0x629f388*=0xa, pAuthzSvc=0x629f384*=0x0, pServerPrincName=0x629f37c, pAuthnLevel=0x629f380*=0x6, pImpLevel=0x629f370*=0x2, pAuthInfo=0x629f374, pCapabilites=0x629f378*=0x1) returned 0x0 [0174.038] WbemLocator:IUnknown:Release (This=0x520cebc) returned 0x1 [0174.038] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1a58, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f32c | out: ppvObject=0x629f32c*=0x520cee0) returned 0x0 [0174.038] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1a58, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629f318 | out: ppvObject=0x629f318*=0x520cebc) returned 0x0 [0174.038] WbemLocator:IClientSecurity:SetBlanket (This=0x520cebc, pProxy=0x51f1a58, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0174.039] WbemLocator:IUnknown:Release (This=0x520cebc) returned 0x2 [0174.039] WbemLocator:IUnknown:Release (This=0x520cee0) returned 0x1 [0174.039] CoTaskMemFree (pv=0x51f8fa8) [0174.039] WbemLocator:IUnknown:Release (This=0x51de948) returned 0x0 [0174.039] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1a58, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629ef28 | out: ppvObject=0x629ef28*=0x520cee0) returned 0x0 [0174.039] WbemLocator:IUnknown:QueryInterface (in: This=0x520cee0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x629eee4 | out: ppvObject=0x629eee4*=0x0) returned 0x80004002 [0174.040] WbemLocator:IUnknown:QueryInterface (in: This=0x520cee0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x629ed04 | out: ppvObject=0x629ed04*=0x0) returned 0x80004002 [0174.040] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1a58, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x629eadc | out: ppvObject=0x629eadc*=0x0) returned 0x80004002 [0174.041] WbemLocator:IUnknown:AddRef (This=0x520cee0) returned 0x3 [0174.041] WbemLocator:IUnknown:QueryInterface (in: This=0x520cee0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x629e83c | out: ppvObject=0x629e83c*=0x0) returned 0x80004002 [0174.041] WbemLocator:IUnknown:QueryInterface (in: This=0x520cee0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x629e7ec | out: ppvObject=0x629e7ec*=0x0) returned 0x80004002 [0174.041] WbemLocator:IUnknown:QueryInterface (in: This=0x520cee0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629e7f8 | out: ppvObject=0x629e7f8*=0x520ce3c) returned 0x0 [0174.041] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520ce3c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x629e800 | out: pCid=0x629e800*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0174.041] WbemLocator:IUnknown:Release (This=0x520ce3c) returned 0x3 [0174.041] CoGetContextToken (in: pToken=0x629e858 | out: pToken=0x629e858) returned 0x0 [0174.041] CoGetContextToken (in: pToken=0x629ec60 | out: pToken=0x629ec60) returned 0x0 [0174.041] WbemLocator:IUnknown:QueryInterface (in: This=0x520cee0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x629ecec | out: ppvObject=0x629ecec*=0x520cec4) returned 0x0 [0174.041] WbemLocator:IRpcOptions:Query (in: This=0x520cec4, pPrx=0x520cee0, dwProperty=2, pdwValue=0x629ecf8 | out: pdwValue=0x629ecf8) returned 0x80004002 [0174.041] WbemLocator:IUnknown:Release (This=0x520cec4) returned 0x3 [0174.041] WbemLocator:IUnknown:Release (This=0x520cee0) returned 0x2 [0174.041] CoGetContextToken (in: pToken=0x629f238 | out: pToken=0x629f238) returned 0x0 [0174.041] CoGetContextToken (in: pToken=0x629f198 | out: pToken=0x629f198) returned 0x0 [0174.042] WbemLocator:IUnknown:QueryInterface (in: This=0x520cee0, riid=0x629f268*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x629f264 | out: ppvObject=0x629f264*=0x51f1a58) returned 0x0 [0174.042] WbemLocator:IUnknown:AddRef (This=0x51f1a58) returned 0x4 [0174.042] WbemLocator:IUnknown:Release (This=0x51f1a58) returned 0x3 [0174.042] WbemLocator:IUnknown:Release (This=0x51f1a58) returned 0x2 [0174.042] SysStringLen (param_1=0x0) returned 0x0 [0174.042] CoUninitialize () Thread: id = 122 os_tid = 0x1380 [0174.453] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0174.453] RoInitialize () returned 0x1 [0174.453] RoUninitialize () returned 0x0 [0174.455] CoGetClassObject (in: rclsid=0x51ca074*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x639f100 | out: ppv=0x639f100*=0x52105e8) returned 0x0 [0174.456] WbemLocator:IUnknown:QueryInterface (in: This=0x52105e8, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x639f31c | out: ppvObject=0x639f31c*=0x0) returned 0x80004002 [0174.456] WbemLocator:IClassFactory:CreateInstance (in: This=0x52105e8, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639f328 | out: ppvObject=0x639f328*=0x51de898) returned 0x0 [0174.456] WbemLocator:IUnknown:Release (This=0x52105e8) returned 0x0 [0174.456] WbemLocator:IUnknown:QueryInterface (in: This=0x51de898, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639ef4c | out: ppvObject=0x639ef4c*=0x51de898) returned 0x0 [0174.456] WbemLocator:IUnknown:QueryInterface (in: This=0x51de898, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x639ef08 | out: ppvObject=0x639ef08*=0x0) returned 0x80004002 [0174.456] WbemLocator:IUnknown:QueryInterface (in: This=0x51de898, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x639eafc | out: ppvObject=0x639eafc*=0x0) returned 0x80004002 [0174.456] WbemLocator:IUnknown:AddRef (This=0x51de898) returned 0x3 [0174.456] WbemLocator:IUnknown:QueryInterface (in: This=0x51de898, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x639e85c | out: ppvObject=0x639e85c*=0x0) returned 0x80004002 [0174.456] WbemLocator:IUnknown:QueryInterface (in: This=0x51de898, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x639e80c | out: ppvObject=0x639e80c*=0x0) returned 0x80004002 [0174.456] WbemLocator:IUnknown:QueryInterface (in: This=0x51de898, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639e818 | out: ppvObject=0x639e818*=0x0) returned 0x80004002 [0174.456] CoGetContextToken (in: pToken=0x639e878 | out: pToken=0x639e878) returned 0x0 [0174.457] CoGetContextToken (in: pToken=0x639ec80 | out: pToken=0x639ec80) returned 0x0 [0174.457] WbemLocator:IUnknown:QueryInterface (in: This=0x51de898, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639ed0c | out: ppvObject=0x639ed0c*=0x0) returned 0x80004002 [0174.457] WbemLocator:IUnknown:Release (This=0x51de898) returned 0x2 [0174.457] WbemLocator:IUnknown:Release (This=0x51de898) returned 0x1 [0174.457] CoGetContextToken (in: pToken=0x639f308 | out: pToken=0x639f308) returned 0x0 [0174.457] CoGetContextToken (in: pToken=0x639f268 | out: pToken=0x639f268) returned 0x0 [0174.457] WbemLocator:IUnknown:QueryInterface (in: This=0x51de898, riid=0x639f338*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x639f334 | out: ppvObject=0x639f334*=0x51de898) returned 0x0 [0174.457] WbemLocator:IUnknown:AddRef (This=0x51de898) returned 0x3 [0174.457] WbemLocator:IUnknown:Release (This=0x51de898) returned 0x2 [0174.457] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x639f4cc | out: puCount=0x639f4cc*=0x2) returned 0x0 [0174.457] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=8, puBuffLength=0x639f4c8*=0x0, pszText=0x0 | out: puBuffLength=0x639f4c8*=0xf, pszText=0x0) returned 0x0 [0174.457] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=8, puBuffLength=0x639f4c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x639f4c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0174.457] CoCreateInstance (in: rclsid=0x688d13b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x688d1414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x639f3a4 | out: ppv=0x639f3a4*=0x51de858) returned 0x0 [0174.458] WbemLocator:IWbemLocator:ConnectServer (in: This=0x51de858, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x639f438 | out: ppNamespace=0x639f438*=0x51f1d78) returned 0x0 [0174.482] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1d78, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639f2cc | out: ppvObject=0x639f2cc*=0x520d0bc) returned 0x0 [0174.482] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x520d0bc, pProxy=0x51f1d78, pAuthnSvc=0x639f31c, pAuthzSvc=0x639f318, pServerPrincName=0x639f310, pAuthnLevel=0x639f314, pImpLevel=0x639f304, pAuthInfo=0x639f308, pCapabilites=0x639f30c | out: pAuthnSvc=0x639f31c*=0xa, pAuthzSvc=0x639f318*=0x0, pServerPrincName=0x639f310, pAuthnLevel=0x639f314*=0x6, pImpLevel=0x639f304*=0x2, pAuthInfo=0x639f308, pCapabilites=0x639f30c*=0x1) returned 0x0 [0174.482] WbemLocator:IUnknown:Release (This=0x520d0bc) returned 0x1 [0174.482] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1d78, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639f2c0 | out: ppvObject=0x639f2c0*=0x520d0e0) returned 0x0 [0174.483] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1d78, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639f2ac | out: ppvObject=0x639f2ac*=0x520d0bc) returned 0x0 [0174.483] WbemLocator:IClientSecurity:SetBlanket (This=0x520d0bc, pProxy=0x51f1d78, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0174.483] WbemLocator:IUnknown:Release (This=0x520d0bc) returned 0x2 [0174.483] WbemLocator:IUnknown:Release (This=0x520d0e0) returned 0x1 [0174.483] CoTaskMemFree (pv=0x51f9068) [0174.483] WbemLocator:IUnknown:Release (This=0x51de858) returned 0x0 [0174.483] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1d78, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639eebc | out: ppvObject=0x639eebc*=0x520d0e0) returned 0x0 [0174.483] WbemLocator:IUnknown:QueryInterface (in: This=0x520d0e0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x639ee78 | out: ppvObject=0x639ee78*=0x0) returned 0x80004002 [0174.484] WbemLocator:IUnknown:QueryInterface (in: This=0x520d0e0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x639ec94 | out: ppvObject=0x639ec94*=0x0) returned 0x80004002 [0174.484] WbemLocator:IUnknown:QueryInterface (in: This=0x51f1d78, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x639ea6c | out: ppvObject=0x639ea6c*=0x0) returned 0x80004002 [0174.485] WbemLocator:IUnknown:AddRef (This=0x520d0e0) returned 0x3 [0174.485] WbemLocator:IUnknown:QueryInterface (in: This=0x520d0e0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x639e7cc | out: ppvObject=0x639e7cc*=0x0) returned 0x80004002 [0174.485] WbemLocator:IUnknown:QueryInterface (in: This=0x520d0e0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x639e77c | out: ppvObject=0x639e77c*=0x0) returned 0x80004002 [0174.485] WbemLocator:IUnknown:QueryInterface (in: This=0x520d0e0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639e788 | out: ppvObject=0x639e788*=0x520d03c) returned 0x0 [0174.485] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520d03c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x639e790 | out: pCid=0x639e790*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0174.485] WbemLocator:IUnknown:Release (This=0x520d03c) returned 0x3 [0174.485] CoGetContextToken (in: pToken=0x639e7e8 | out: pToken=0x639e7e8) returned 0x0 [0174.485] CoGetContextToken (in: pToken=0x639ebf0 | out: pToken=0x639ebf0) returned 0x0 [0174.485] WbemLocator:IUnknown:QueryInterface (in: This=0x520d0e0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639ec7c | out: ppvObject=0x639ec7c*=0x520d0c4) returned 0x0 [0174.486] WbemLocator:IRpcOptions:Query (in: This=0x520d0c4, pPrx=0x520d0e0, dwProperty=2, pdwValue=0x639ec88 | out: pdwValue=0x639ec88) returned 0x80004002 [0174.486] WbemLocator:IUnknown:Release (This=0x520d0c4) returned 0x3 [0174.486] WbemLocator:IUnknown:Release (This=0x520d0e0) returned 0x2 [0174.486] CoGetContextToken (in: pToken=0x639f1d0 | out: pToken=0x639f1d0) returned 0x0 [0174.486] CoGetContextToken (in: pToken=0x639f130 | out: pToken=0x639f130) returned 0x0 [0174.486] WbemLocator:IUnknown:QueryInterface (in: This=0x520d0e0, riid=0x639f200*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x639f1fc | out: ppvObject=0x639f1fc*=0x51f1d78) returned 0x0 [0174.486] WbemLocator:IUnknown:AddRef (This=0x51f1d78) returned 0x4 [0174.486] WbemLocator:IUnknown:Release (This=0x51f1d78) returned 0x3 [0174.486] WbemLocator:IUnknown:Release (This=0x51f1d78) returned 0x2 [0174.486] SysStringLen (param_1=0x0) returned 0x0 [0174.486] CoUninitialize () Thread: id = 123 os_tid = 0x1384 [0178.210] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0178.210] RoInitialize () returned 0x1 [0178.210] RoUninitialize () returned 0x0 [0178.213] CoGetClassObject (in: rclsid=0x51ca074*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x639f080 | out: ppv=0x639f080*=0x52473c0) returned 0x0 [0178.213] WbemLocator:IUnknown:QueryInterface (in: This=0x52473c0, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x639f29c | out: ppvObject=0x639f29c*=0x0) returned 0x80004002 [0178.213] WbemLocator:IClassFactory:CreateInstance (in: This=0x52473c0, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639f2a8 | out: ppvObject=0x639f2a8*=0x51de598) returned 0x0 [0178.213] WbemLocator:IUnknown:Release (This=0x52473c0) returned 0x0 [0178.213] WbemLocator:IUnknown:QueryInterface (in: This=0x51de598, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639eecc | out: ppvObject=0x639eecc*=0x51de598) returned 0x0 [0178.214] WbemLocator:IUnknown:QueryInterface (in: This=0x51de598, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x639ee88 | out: ppvObject=0x639ee88*=0x0) returned 0x80004002 [0178.214] WbemLocator:IUnknown:QueryInterface (in: This=0x51de598, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x639ea7c | out: ppvObject=0x639ea7c*=0x0) returned 0x80004002 [0178.214] WbemLocator:IUnknown:AddRef (This=0x51de598) returned 0x3 [0178.214] WbemLocator:IUnknown:QueryInterface (in: This=0x51de598, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x639e7dc | out: ppvObject=0x639e7dc*=0x0) returned 0x80004002 [0178.214] WbemLocator:IUnknown:QueryInterface (in: This=0x51de598, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x639e78c | out: ppvObject=0x639e78c*=0x0) returned 0x80004002 [0178.214] WbemLocator:IUnknown:QueryInterface (in: This=0x51de598, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639e798 | out: ppvObject=0x639e798*=0x0) returned 0x80004002 [0178.214] CoGetContextToken (in: pToken=0x639e7f8 | out: pToken=0x639e7f8) returned 0x0 [0178.215] CoGetContextToken (in: pToken=0x639ec00 | out: pToken=0x639ec00) returned 0x0 [0178.215] WbemLocator:IUnknown:QueryInterface (in: This=0x51de598, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639ec8c | out: ppvObject=0x639ec8c*=0x0) returned 0x80004002 [0178.215] WbemLocator:IUnknown:Release (This=0x51de598) returned 0x2 [0178.215] WbemLocator:IUnknown:Release (This=0x51de598) returned 0x1 [0178.215] CoGetContextToken (in: pToken=0x639f288 | out: pToken=0x639f288) returned 0x0 [0178.215] CoGetContextToken (in: pToken=0x639f1e8 | out: pToken=0x639f1e8) returned 0x0 [0178.215] WbemLocator:IUnknown:QueryInterface (in: This=0x51de598, riid=0x639f2b8*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x639f2b4 | out: ppvObject=0x639f2b4*=0x51de598) returned 0x0 [0178.216] WbemLocator:IUnknown:AddRef (This=0x51de598) returned 0x3 [0178.216] WbemLocator:IUnknown:Release (This=0x51de598) returned 0x2 [0178.216] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x639f44c | out: puCount=0x639f44c*=0x2) returned 0x0 [0178.216] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=8, puBuffLength=0x639f448*=0x0, pszText=0x0 | out: puBuffLength=0x639f448*=0xf, pszText=0x0) returned 0x0 [0178.216] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=8, puBuffLength=0x639f448*=0xf, pszText="00000000000000" | out: puBuffLength=0x639f448*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0178.216] CoCreateInstance (in: rclsid=0x688d13b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x688d1414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x639f324 | out: ppv=0x639f324*=0x51de5a8) returned 0x0 [0178.216] WbemLocator:IWbemLocator:ConnectServer (in: This=0x51de5a8, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x639f3b8 | out: ppNamespace=0x639f3b8*=0x5248640) returned 0x0 [0178.247] WbemLocator:IUnknown:QueryInterface (in: This=0x5248640, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639f24c | out: ppvObject=0x639f24c*=0x520c9bc) returned 0x0 [0178.247] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x520c9bc, pProxy=0x5248640, pAuthnSvc=0x639f29c, pAuthzSvc=0x639f298, pServerPrincName=0x639f290, pAuthnLevel=0x639f294, pImpLevel=0x639f284, pAuthInfo=0x639f288, pCapabilites=0x639f28c | out: pAuthnSvc=0x639f29c*=0xa, pAuthzSvc=0x639f298*=0x0, pServerPrincName=0x639f290, pAuthnLevel=0x639f294*=0x6, pImpLevel=0x639f284*=0x2, pAuthInfo=0x639f288, pCapabilites=0x639f28c*=0x1) returned 0x0 [0178.247] WbemLocator:IUnknown:Release (This=0x520c9bc) returned 0x1 [0178.247] WbemLocator:IUnknown:QueryInterface (in: This=0x5248640, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639f240 | out: ppvObject=0x639f240*=0x520c9e0) returned 0x0 [0178.247] WbemLocator:IUnknown:QueryInterface (in: This=0x5248640, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639f22c | out: ppvObject=0x639f22c*=0x520c9bc) returned 0x0 [0178.247] WbemLocator:IClientSecurity:SetBlanket (This=0x520c9bc, pProxy=0x5248640, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0178.247] WbemLocator:IUnknown:Release (This=0x520c9bc) returned 0x2 [0178.247] WbemLocator:IUnknown:Release (This=0x520c9e0) returned 0x1 [0178.247] CoTaskMemFree (pv=0x51f8f78) [0178.248] WbemLocator:IUnknown:Release (This=0x51de5a8) returned 0x0 [0178.248] WbemLocator:IUnknown:QueryInterface (in: This=0x5248640, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639ee3c | out: ppvObject=0x639ee3c*=0x520c9e0) returned 0x0 [0178.248] WbemLocator:IUnknown:QueryInterface (in: This=0x520c9e0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x639edf8 | out: ppvObject=0x639edf8*=0x0) returned 0x80004002 [0178.248] WbemLocator:IUnknown:QueryInterface (in: This=0x520c9e0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x639ec14 | out: ppvObject=0x639ec14*=0x0) returned 0x80004002 [0178.249] WbemLocator:IUnknown:QueryInterface (in: This=0x5248640, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x639e9ec | out: ppvObject=0x639e9ec*=0x0) returned 0x80004002 [0178.249] WbemLocator:IUnknown:AddRef (This=0x520c9e0) returned 0x3 [0178.249] WbemLocator:IUnknown:QueryInterface (in: This=0x520c9e0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x639e74c | out: ppvObject=0x639e74c*=0x0) returned 0x80004002 [0178.249] WbemLocator:IUnknown:QueryInterface (in: This=0x520c9e0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x639e6fc | out: ppvObject=0x639e6fc*=0x0) returned 0x80004002 [0178.249] WbemLocator:IUnknown:QueryInterface (in: This=0x520c9e0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639e708 | out: ppvObject=0x639e708*=0x520c93c) returned 0x0 [0178.249] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520c93c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x639e710 | out: pCid=0x639e710*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0178.250] WbemLocator:IUnknown:Release (This=0x520c93c) returned 0x3 [0178.250] CoGetContextToken (in: pToken=0x639e768 | out: pToken=0x639e768) returned 0x0 [0178.250] CoGetContextToken (in: pToken=0x639eb70 | out: pToken=0x639eb70) returned 0x0 [0178.250] WbemLocator:IUnknown:QueryInterface (in: This=0x520c9e0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639ebfc | out: ppvObject=0x639ebfc*=0x520c9c4) returned 0x0 [0178.250] WbemLocator:IRpcOptions:Query (in: This=0x520c9c4, pPrx=0x520c9e0, dwProperty=2, pdwValue=0x639ec08 | out: pdwValue=0x639ec08) returned 0x80004002 [0178.250] WbemLocator:IUnknown:Release (This=0x520c9c4) returned 0x3 [0178.250] WbemLocator:IUnknown:Release (This=0x520c9e0) returned 0x2 [0178.250] CoGetContextToken (in: pToken=0x639f150 | out: pToken=0x639f150) returned 0x0 [0178.250] CoGetContextToken (in: pToken=0x639f0b0 | out: pToken=0x639f0b0) returned 0x0 [0178.250] WbemLocator:IUnknown:QueryInterface (in: This=0x520c9e0, riid=0x639f180*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x639f17c | out: ppvObject=0x639f17c*=0x5248640) returned 0x0 [0178.250] WbemLocator:IUnknown:AddRef (This=0x5248640) returned 0x4 [0178.250] WbemLocator:IUnknown:Release (This=0x5248640) returned 0x3 [0178.250] WbemLocator:IUnknown:Release (This=0x5248640) returned 0x2 [0178.250] SysStringLen (param_1=0x0) returned 0x0 [0178.250] CoUninitialize () Thread: id = 124 os_tid = 0x13a0 [0181.988] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0181.988] RoInitialize () returned 0x1 [0181.988] RoUninitialize () returned 0x0 [0181.989] CoGetClassObject (in: rclsid=0x51ca074*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x639f000 | out: ppv=0x639f000*=0x5276a58) returned 0x0 [0181.989] WbemLocator:IUnknown:QueryInterface (in: This=0x5276a58, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x639f21c | out: ppvObject=0x639f21c*=0x0) returned 0x80004002 [0181.989] WbemLocator:IClassFactory:CreateInstance (in: This=0x5276a58, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639f228 | out: ppvObject=0x639f228*=0x71d050) returned 0x0 [0181.990] WbemLocator:IUnknown:Release (This=0x5276a58) returned 0x0 [0181.990] WbemLocator:IUnknown:QueryInterface (in: This=0x71d050, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639ee4c | out: ppvObject=0x639ee4c*=0x71d050) returned 0x0 [0181.990] WbemLocator:IUnknown:QueryInterface (in: This=0x71d050, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x639ee08 | out: ppvObject=0x639ee08*=0x0) returned 0x80004002 [0181.990] WbemLocator:IUnknown:QueryInterface (in: This=0x71d050, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x639e9fc | out: ppvObject=0x639e9fc*=0x0) returned 0x80004002 [0181.990] WbemLocator:IUnknown:AddRef (This=0x71d050) returned 0x3 [0181.990] WbemLocator:IUnknown:QueryInterface (in: This=0x71d050, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x639e75c | out: ppvObject=0x639e75c*=0x0) returned 0x80004002 [0181.990] WbemLocator:IUnknown:QueryInterface (in: This=0x71d050, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x639e70c | out: ppvObject=0x639e70c*=0x0) returned 0x80004002 [0181.990] WbemLocator:IUnknown:QueryInterface (in: This=0x71d050, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639e718 | out: ppvObject=0x639e718*=0x0) returned 0x80004002 [0181.990] CoGetContextToken (in: pToken=0x639e778 | out: pToken=0x639e778) returned 0x0 [0181.993] CoGetContextToken (in: pToken=0x639eb80 | out: pToken=0x639eb80) returned 0x0 [0181.993] WbemLocator:IUnknown:QueryInterface (in: This=0x71d050, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639ec0c | out: ppvObject=0x639ec0c*=0x0) returned 0x80004002 [0181.993] WbemLocator:IUnknown:Release (This=0x71d050) returned 0x2 [0181.993] WbemLocator:IUnknown:Release (This=0x71d050) returned 0x1 [0181.993] CoGetContextToken (in: pToken=0x639f208 | out: pToken=0x639f208) returned 0x0 [0181.993] CoGetContextToken (in: pToken=0x639f168 | out: pToken=0x639f168) returned 0x0 [0181.993] WbemLocator:IUnknown:QueryInterface (in: This=0x71d050, riid=0x639f238*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x639f234 | out: ppvObject=0x639f234*=0x71d050) returned 0x0 [0181.993] WbemLocator:IUnknown:AddRef (This=0x71d050) returned 0x3 [0181.993] WbemLocator:IUnknown:Release (This=0x71d050) returned 0x2 [0181.993] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x639f3cc | out: puCount=0x639f3cc*=0x2) returned 0x0 [0181.993] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=8, puBuffLength=0x639f3c8*=0x0, pszText=0x0 | out: puBuffLength=0x639f3c8*=0xf, pszText=0x0) returned 0x0 [0181.993] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=8, puBuffLength=0x639f3c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x639f3c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0181.994] CoCreateInstance (in: rclsid=0x688d13b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x688d1414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x639f2a4 | out: ppv=0x639f2a4*=0x71d060) returned 0x0 [0181.994] WbemLocator:IWbemLocator:ConnectServer (in: This=0x71d060, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x639f338 | out: ppNamespace=0x639f338*=0x526e8c8) returned 0x0 [0182.014] WbemLocator:IUnknown:QueryInterface (in: This=0x526e8c8, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639f1cc | out: ppvObject=0x639f1cc*=0x520c7bc) returned 0x0 [0182.014] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x520c7bc, pProxy=0x526e8c8, pAuthnSvc=0x639f21c, pAuthzSvc=0x639f218, pServerPrincName=0x639f210, pAuthnLevel=0x639f214, pImpLevel=0x639f204, pAuthInfo=0x639f208, pCapabilites=0x639f20c | out: pAuthnSvc=0x639f21c*=0xa, pAuthzSvc=0x639f218*=0x0, pServerPrincName=0x639f210, pAuthnLevel=0x639f214*=0x6, pImpLevel=0x639f204*=0x2, pAuthInfo=0x639f208, pCapabilites=0x639f20c*=0x1) returned 0x0 [0182.014] WbemLocator:IUnknown:Release (This=0x520c7bc) returned 0x1 [0182.014] WbemLocator:IUnknown:QueryInterface (in: This=0x526e8c8, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639f1c0 | out: ppvObject=0x639f1c0*=0x520c7e0) returned 0x0 [0182.015] WbemLocator:IUnknown:QueryInterface (in: This=0x526e8c8, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639f1ac | out: ppvObject=0x639f1ac*=0x520c7bc) returned 0x0 [0182.015] WbemLocator:IClientSecurity:SetBlanket (This=0x520c7bc, pProxy=0x526e8c8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0182.015] WbemLocator:IUnknown:Release (This=0x520c7bc) returned 0x2 [0182.015] WbemLocator:IUnknown:Release (This=0x520c7e0) returned 0x1 [0182.015] CoTaskMemFree (pv=0x51f8f78) [0182.015] WbemLocator:IUnknown:Release (This=0x71d060) returned 0x0 [0182.015] WbemLocator:IUnknown:QueryInterface (in: This=0x526e8c8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639edbc | out: ppvObject=0x639edbc*=0x520c7e0) returned 0x0 [0182.015] WbemLocator:IUnknown:QueryInterface (in: This=0x520c7e0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x639ed78 | out: ppvObject=0x639ed78*=0x0) returned 0x80004002 [0182.016] WbemLocator:IUnknown:QueryInterface (in: This=0x520c7e0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x639eb94 | out: ppvObject=0x639eb94*=0x0) returned 0x80004002 [0182.016] WbemLocator:IUnknown:QueryInterface (in: This=0x526e8c8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x639e96c | out: ppvObject=0x639e96c*=0x0) returned 0x80004002 [0182.016] WbemLocator:IUnknown:AddRef (This=0x520c7e0) returned 0x3 [0182.016] WbemLocator:IUnknown:QueryInterface (in: This=0x520c7e0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x639e6cc | out: ppvObject=0x639e6cc*=0x0) returned 0x80004002 [0182.016] WbemLocator:IUnknown:QueryInterface (in: This=0x520c7e0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x639e67c | out: ppvObject=0x639e67c*=0x0) returned 0x80004002 [0182.016] WbemLocator:IUnknown:QueryInterface (in: This=0x520c7e0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639e688 | out: ppvObject=0x639e688*=0x520c73c) returned 0x0 [0182.017] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520c73c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x639e690 | out: pCid=0x639e690*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0182.017] WbemLocator:IUnknown:Release (This=0x520c73c) returned 0x3 [0182.017] CoGetContextToken (in: pToken=0x639e6e8 | out: pToken=0x639e6e8) returned 0x0 [0182.017] CoGetContextToken (in: pToken=0x639eaf0 | out: pToken=0x639eaf0) returned 0x0 [0182.017] WbemLocator:IUnknown:QueryInterface (in: This=0x520c7e0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639eb7c | out: ppvObject=0x639eb7c*=0x520c7c4) returned 0x0 [0182.017] WbemLocator:IRpcOptions:Query (in: This=0x520c7c4, pPrx=0x520c7e0, dwProperty=2, pdwValue=0x639eb88 | out: pdwValue=0x639eb88) returned 0x80004002 [0182.017] WbemLocator:IUnknown:Release (This=0x520c7c4) returned 0x3 [0182.017] WbemLocator:IUnknown:Release (This=0x520c7e0) returned 0x2 [0182.017] CoGetContextToken (in: pToken=0x639f0d0 | out: pToken=0x639f0d0) returned 0x0 [0182.017] CoGetContextToken (in: pToken=0x639f030 | out: pToken=0x639f030) returned 0x0 [0182.017] WbemLocator:IUnknown:QueryInterface (in: This=0x520c7e0, riid=0x639f100*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x639f0fc | out: ppvObject=0x639f0fc*=0x526e8c8) returned 0x0 [0182.017] WbemLocator:IUnknown:AddRef (This=0x526e8c8) returned 0x4 [0182.017] WbemLocator:IUnknown:Release (This=0x526e8c8) returned 0x3 [0182.017] WbemLocator:IUnknown:Release (This=0x526e8c8) returned 0x2 [0182.017] SysStringLen (param_1=0x0) returned 0x0 [0182.017] CoUninitialize () Thread: id = 125 os_tid = 0x13a4 [0188.290] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0188.291] RoInitialize () returned 0x1 [0188.291] RoUninitialize () returned 0x0 [0188.294] CoGetClassObject (in: rclsid=0x51ca074*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x639ef80 | out: ppv=0x639ef80*=0x5276da0) returned 0x0 [0188.294] WbemLocator:IUnknown:QueryInterface (in: This=0x5276da0, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x639f19c | out: ppvObject=0x639f19c*=0x0) returned 0x80004002 [0188.294] WbemLocator:IClassFactory:CreateInstance (in: This=0x5276da0, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639f1a8 | out: ppvObject=0x639f1a8*=0x51de898) returned 0x0 [0188.294] WbemLocator:IUnknown:Release (This=0x5276da0) returned 0x0 [0188.294] WbemLocator:IUnknown:QueryInterface (in: This=0x51de898, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639edcc | out: ppvObject=0x639edcc*=0x51de898) returned 0x0 [0188.294] WbemLocator:IUnknown:QueryInterface (in: This=0x51de898, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x639ed88 | out: ppvObject=0x639ed88*=0x0) returned 0x80004002 [0188.294] WbemLocator:IUnknown:QueryInterface (in: This=0x51de898, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x639e97c | out: ppvObject=0x639e97c*=0x0) returned 0x80004002 [0188.294] WbemLocator:IUnknown:AddRef (This=0x51de898) returned 0x3 [0188.295] WbemLocator:IUnknown:QueryInterface (in: This=0x51de898, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x639e6dc | out: ppvObject=0x639e6dc*=0x0) returned 0x80004002 [0188.295] WbemLocator:IUnknown:QueryInterface (in: This=0x51de898, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x639e68c | out: ppvObject=0x639e68c*=0x0) returned 0x80004002 [0188.295] WbemLocator:IUnknown:QueryInterface (in: This=0x51de898, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639e698 | out: ppvObject=0x639e698*=0x0) returned 0x80004002 [0188.295] CoGetContextToken (in: pToken=0x639e6f8 | out: pToken=0x639e6f8) returned 0x0 [0188.296] CoGetContextToken (in: pToken=0x639eb00 | out: pToken=0x639eb00) returned 0x0 [0188.296] WbemLocator:IUnknown:QueryInterface (in: This=0x51de898, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639eb8c | out: ppvObject=0x639eb8c*=0x0) returned 0x80004002 [0188.296] WbemLocator:IUnknown:Release (This=0x51de898) returned 0x2 [0188.296] WbemLocator:IUnknown:Release (This=0x51de898) returned 0x1 [0188.296] CoGetContextToken (in: pToken=0x639f188 | out: pToken=0x639f188) returned 0x0 [0188.296] CoGetContextToken (in: pToken=0x639f0e8 | out: pToken=0x639f0e8) returned 0x0 [0188.296] WbemLocator:IUnknown:QueryInterface (in: This=0x51de898, riid=0x639f1b8*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x639f1b4 | out: ppvObject=0x639f1b4*=0x51de898) returned 0x0 [0188.296] WbemLocator:IUnknown:AddRef (This=0x51de898) returned 0x3 [0188.296] WbemLocator:IUnknown:Release (This=0x51de898) returned 0x2 [0188.296] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5278158, puCount=0x639f34c | out: puCount=0x639f34c*=0x2) returned 0x0 [0188.296] WbemDefPath:IWbemPath:GetText (in: This=0x5278158, lFlags=8, puBuffLength=0x639f348*=0x0, pszText=0x0 | out: puBuffLength=0x639f348*=0xf, pszText=0x0) returned 0x0 [0188.296] WbemDefPath:IWbemPath:GetText (in: This=0x5278158, lFlags=8, puBuffLength=0x639f348*=0xf, pszText="00000000000000" | out: puBuffLength=0x639f348*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0188.296] CoCreateInstance (in: rclsid=0x688d13b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x688d1414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x639f224 | out: ppv=0x639f224*=0x51de848) returned 0x0 [0188.297] WbemLocator:IWbemLocator:ConnectServer (in: This=0x51de848, strNetworkResource="\\\\.\\root\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x639f2b8 | out: ppNamespace=0x639f2b8*=0x526e148) returned 0x0 [0188.333] WbemLocator:IUnknown:QueryInterface (in: This=0x526e148, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639f14c | out: ppvObject=0x639f14c*=0x520c8bc) returned 0x0 [0188.333] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x520c8bc, pProxy=0x526e148, pAuthnSvc=0x639f19c, pAuthzSvc=0x639f198, pServerPrincName=0x639f190, pAuthnLevel=0x639f194, pImpLevel=0x639f184, pAuthInfo=0x639f188, pCapabilites=0x639f18c | out: pAuthnSvc=0x639f19c*=0xa, pAuthzSvc=0x639f198*=0x0, pServerPrincName=0x639f190, pAuthnLevel=0x639f194*=0x6, pImpLevel=0x639f184*=0x2, pAuthInfo=0x639f188, pCapabilites=0x639f18c*=0x1) returned 0x0 [0188.333] WbemLocator:IUnknown:Release (This=0x520c8bc) returned 0x1 [0188.333] WbemLocator:IUnknown:QueryInterface (in: This=0x526e148, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639f140 | out: ppvObject=0x639f140*=0x520c8e0) returned 0x0 [0188.333] WbemLocator:IUnknown:QueryInterface (in: This=0x526e148, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639f12c | out: ppvObject=0x639f12c*=0x520c8bc) returned 0x0 [0188.333] WbemLocator:IClientSecurity:SetBlanket (This=0x520c8bc, pProxy=0x526e148, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0188.333] WbemLocator:IUnknown:Release (This=0x520c8bc) returned 0x2 [0188.333] WbemLocator:IUnknown:Release (This=0x520c8e0) returned 0x1 [0188.333] CoTaskMemFree (pv=0x51f8a38) [0188.334] WbemLocator:IUnknown:Release (This=0x51de848) returned 0x0 [0188.334] WbemLocator:IUnknown:QueryInterface (in: This=0x526e148, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639ed3c | out: ppvObject=0x639ed3c*=0x520c8e0) returned 0x0 [0188.334] WbemLocator:IUnknown:QueryInterface (in: This=0x520c8e0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x639ecf8 | out: ppvObject=0x639ecf8*=0x0) returned 0x80004002 [0188.334] WbemLocator:IUnknown:QueryInterface (in: This=0x520c8e0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x639eb14 | out: ppvObject=0x639eb14*=0x0) returned 0x80004002 [0188.335] WbemLocator:IUnknown:QueryInterface (in: This=0x526e148, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x639e8ec | out: ppvObject=0x639e8ec*=0x0) returned 0x80004002 [0188.335] WbemLocator:IUnknown:AddRef (This=0x520c8e0) returned 0x3 [0188.335] WbemLocator:IUnknown:QueryInterface (in: This=0x520c8e0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x639e64c | out: ppvObject=0x639e64c*=0x0) returned 0x80004002 [0188.335] WbemLocator:IUnknown:QueryInterface (in: This=0x520c8e0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x639e5fc | out: ppvObject=0x639e5fc*=0x0) returned 0x80004002 [0188.335] WbemLocator:IUnknown:QueryInterface (in: This=0x520c8e0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639e608 | out: ppvObject=0x639e608*=0x520c83c) returned 0x0 [0188.336] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520c83c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x639e610 | out: pCid=0x639e610*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0188.336] WbemLocator:IUnknown:Release (This=0x520c83c) returned 0x3 [0188.336] CoGetContextToken (in: pToken=0x639e668 | out: pToken=0x639e668) returned 0x0 [0188.336] CoGetContextToken (in: pToken=0x639ea70 | out: pToken=0x639ea70) returned 0x0 [0188.336] WbemLocator:IUnknown:QueryInterface (in: This=0x520c8e0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639eafc | out: ppvObject=0x639eafc*=0x520c8c4) returned 0x0 [0188.336] WbemLocator:IRpcOptions:Query (in: This=0x520c8c4, pPrx=0x520c8e0, dwProperty=2, pdwValue=0x639eb08 | out: pdwValue=0x639eb08) returned 0x80004002 [0188.336] WbemLocator:IUnknown:Release (This=0x520c8c4) returned 0x3 [0188.336] WbemLocator:IUnknown:Release (This=0x520c8e0) returned 0x2 [0188.336] CoGetContextToken (in: pToken=0x639f050 | out: pToken=0x639f050) returned 0x0 [0188.336] CoGetContextToken (in: pToken=0x639efb0 | out: pToken=0x639efb0) returned 0x0 [0188.336] WbemLocator:IUnknown:QueryInterface (in: This=0x520c8e0, riid=0x639f080*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x639f07c | out: ppvObject=0x639f07c*=0x526e148) returned 0x0 [0188.336] WbemLocator:IUnknown:AddRef (This=0x526e148) returned 0x4 [0188.336] WbemLocator:IUnknown:Release (This=0x526e148) returned 0x3 [0188.336] WbemLocator:IUnknown:Release (This=0x526e148) returned 0x2 [0188.336] SysStringLen (param_1=0x0) returned 0x0 [0188.337] CoUninitialize () Thread: id = 126 os_tid = 0x13a8 [0188.509] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0188.509] RoInitialize () returned 0x1 [0188.509] RoUninitialize () returned 0x0 [0188.510] CoGetClassObject (in: rclsid=0x51ca074*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f194d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x639ef00 | out: ppv=0x639ef00*=0x5277238) returned 0x0 [0188.510] WbemLocator:IUnknown:QueryInterface (in: This=0x5277238, riid=0x6f1779fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x639f11c | out: ppvObject=0x639f11c*=0x0) returned 0x80004002 [0188.510] WbemLocator:IClassFactory:CreateInstance (in: This=0x5277238, pUnkOuter=0x0, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639f128 | out: ppvObject=0x639f128*=0x51de8b8) returned 0x0 [0188.510] WbemLocator:IUnknown:Release (This=0x5277238) returned 0x0 [0188.510] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8b8, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639ed4c | out: ppvObject=0x639ed4c*=0x51de8b8) returned 0x0 [0188.510] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8b8, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x639ed08 | out: ppvObject=0x639ed08*=0x0) returned 0x80004002 [0188.510] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8b8, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x639e8fc | out: ppvObject=0x639e8fc*=0x0) returned 0x80004002 [0188.510] WbemLocator:IUnknown:AddRef (This=0x51de8b8) returned 0x3 [0188.510] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8b8, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x639e65c | out: ppvObject=0x639e65c*=0x0) returned 0x80004002 [0188.510] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8b8, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x639e60c | out: ppvObject=0x639e60c*=0x0) returned 0x80004002 [0188.510] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8b8, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639e618 | out: ppvObject=0x639e618*=0x0) returned 0x80004002 [0188.510] CoGetContextToken (in: pToken=0x639e678 | out: pToken=0x639e678) returned 0x0 [0188.511] CoGetContextToken (in: pToken=0x639ea80 | out: pToken=0x639ea80) returned 0x0 [0188.511] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8b8, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639eb0c | out: ppvObject=0x639eb0c*=0x0) returned 0x80004002 [0188.511] WbemLocator:IUnknown:Release (This=0x51de8b8) returned 0x2 [0188.511] WbemLocator:IUnknown:Release (This=0x51de8b8) returned 0x1 [0188.511] CoGetContextToken (in: pToken=0x639f108 | out: pToken=0x639f108) returned 0x0 [0188.512] CoGetContextToken (in: pToken=0x639f068 | out: pToken=0x639f068) returned 0x0 [0188.512] WbemLocator:IUnknown:QueryInterface (in: This=0x51de8b8, riid=0x639f138*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x639f134 | out: ppvObject=0x639f134*=0x51de8b8) returned 0x0 [0188.512] WbemLocator:IUnknown:AddRef (This=0x51de8b8) returned 0x3 [0188.512] WbemLocator:IUnknown:Release (This=0x51de8b8) returned 0x2 [0188.512] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x51d7b70, puCount=0x639f2cc | out: puCount=0x639f2cc*=0x2) returned 0x0 [0188.512] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=8, puBuffLength=0x639f2c8*=0x0, pszText=0x0 | out: puBuffLength=0x639f2c8*=0xf, pszText=0x0) returned 0x0 [0188.512] WbemDefPath:IWbemPath:GetText (in: This=0x51d7b70, lFlags=8, puBuffLength=0x639f2c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x639f2c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0188.512] CoCreateInstance (in: rclsid=0x688d13b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x688d1414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x639f1a4 | out: ppv=0x639f1a4*=0x51de848) returned 0x0 [0188.512] WbemLocator:IWbemLocator:ConnectServer (in: This=0x51de848, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x639f238 | out: ppNamespace=0x639f238*=0x526e828) returned 0x0 [0188.531] WbemLocator:IUnknown:QueryInterface (in: This=0x526e828, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639f0cc | out: ppvObject=0x639f0cc*=0x520b8bc) returned 0x0 [0188.531] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x520b8bc, pProxy=0x526e828, pAuthnSvc=0x639f11c, pAuthzSvc=0x639f118, pServerPrincName=0x639f110, pAuthnLevel=0x639f114, pImpLevel=0x639f104, pAuthInfo=0x639f108, pCapabilites=0x639f10c | out: pAuthnSvc=0x639f11c*=0xa, pAuthzSvc=0x639f118*=0x0, pServerPrincName=0x639f110, pAuthnLevel=0x639f114*=0x6, pImpLevel=0x639f104*=0x2, pAuthInfo=0x639f108, pCapabilites=0x639f10c*=0x1) returned 0x0 [0188.531] WbemLocator:IUnknown:Release (This=0x520b8bc) returned 0x1 [0188.531] WbemLocator:IUnknown:QueryInterface (in: This=0x526e828, riid=0x688d1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639f0c0 | out: ppvObject=0x639f0c0*=0x520b8e0) returned 0x0 [0188.531] WbemLocator:IUnknown:QueryInterface (in: This=0x526e828, riid=0x688d1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639f0ac | out: ppvObject=0x639f0ac*=0x520b8bc) returned 0x0 [0188.531] WbemLocator:IClientSecurity:SetBlanket (This=0x520b8bc, pProxy=0x526e828, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0188.531] WbemLocator:IUnknown:Release (This=0x520b8bc) returned 0x2 [0188.531] WbemLocator:IUnknown:Release (This=0x520b8e0) returned 0x1 [0188.531] CoTaskMemFree (pv=0x51f8a98) [0188.532] WbemLocator:IUnknown:Release (This=0x51de848) returned 0x0 [0188.532] WbemLocator:IUnknown:QueryInterface (in: This=0x526e828, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639ecbc | out: ppvObject=0x639ecbc*=0x520b8e0) returned 0x0 [0188.532] WbemLocator:IUnknown:QueryInterface (in: This=0x520b8e0, riid=0x6f1b9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x639ec78 | out: ppvObject=0x639ec78*=0x0) returned 0x80004002 [0188.532] WbemLocator:IUnknown:QueryInterface (in: This=0x520b8e0, riid=0x6f1b9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x639ea94 | out: ppvObject=0x639ea94*=0x0) returned 0x80004002 [0188.533] WbemLocator:IUnknown:QueryInterface (in: This=0x526e828, riid=0x6f1b9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x639e86c | out: ppvObject=0x639e86c*=0x0) returned 0x80004002 [0188.533] WbemLocator:IUnknown:AddRef (This=0x520b8e0) returned 0x3 [0188.533] WbemLocator:IUnknown:QueryInterface (in: This=0x520b8e0, riid=0x6f1b98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x639e5cc | out: ppvObject=0x639e5cc*=0x0) returned 0x80004002 [0188.533] WbemLocator:IUnknown:QueryInterface (in: This=0x520b8e0, riid=0x6f1b9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x639e57c | out: ppvObject=0x639e57c*=0x0) returned 0x80004002 [0188.533] WbemLocator:IUnknown:QueryInterface (in: This=0x520b8e0, riid=0x6f05a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639e588 | out: ppvObject=0x639e588*=0x520b83c) returned 0x0 [0188.534] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x520b83c, riid=0x6f04de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x639e590 | out: pCid=0x639e590*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0188.534] WbemLocator:IUnknown:Release (This=0x520b83c) returned 0x3 [0188.534] CoGetContextToken (in: pToken=0x639e5e8 | out: pToken=0x639e5e8) returned 0x0 [0188.534] CoGetContextToken (in: pToken=0x639e9f0 | out: pToken=0x639e9f0) returned 0x0 [0188.534] WbemLocator:IUnknown:QueryInterface (in: This=0x520b8e0, riid=0x6f1b9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x639ea7c | out: ppvObject=0x639ea7c*=0x520b8c4) returned 0x0 [0188.534] WbemLocator:IRpcOptions:Query (in: This=0x520b8c4, pPrx=0x520b8e0, dwProperty=2, pdwValue=0x639ea88 | out: pdwValue=0x639ea88) returned 0x80004002 [0188.534] WbemLocator:IUnknown:Release (This=0x520b8c4) returned 0x3 [0188.534] WbemLocator:IUnknown:Release (This=0x520b8e0) returned 0x2 [0188.534] CoGetContextToken (in: pToken=0x639efd0 | out: pToken=0x639efd0) returned 0x0 [0188.534] CoGetContextToken (in: pToken=0x639ef30 | out: pToken=0x639ef30) returned 0x0 [0188.534] WbemLocator:IUnknown:QueryInterface (in: This=0x520b8e0, riid=0x639f000*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x639effc | out: ppvObject=0x639effc*=0x526e828) returned 0x0 [0188.534] WbemLocator:IUnknown:AddRef (This=0x526e828) returned 0x4 [0188.534] WbemLocator:IUnknown:Release (This=0x526e828) returned 0x3 [0188.534] WbemLocator:IUnknown:Release (This=0x526e828) returned 0x2 [0188.534] SysStringLen (param_1=0x0) returned 0x0 [0188.534] CoUninitialize () Thread: id = 127 os_tid = 0x1090 Process: id = "2" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x75956000" os_pid = "0x360" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0x214" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000abff" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 2095 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2096 start_va = 0x20000 end_va = 0x20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 2097 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2098 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2099 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 2100 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 2101 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 2102 start_va = 0x100000 end_va = 0x1bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2103 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 2104 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 2105 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 2106 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 2107 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 2108 start_va = 0x400000 end_va = 0x400fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 2109 start_va = 0x410000 end_va = 0x410fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000410000" filename = "" Region: id = 2110 start_va = 0x420000 end_va = 0x421fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 2111 start_va = 0x440000 end_va = 0x441fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 2112 start_va = 0x450000 end_va = 0x454fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll" filename = "\\Windows\\System32\\winnlsres.dll" (normalized: "c:\\windows\\system32\\winnlsres.dll") Region: id = 2113 start_va = 0x460000 end_va = 0x46ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll.mui" filename = "\\Windows\\System32\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winnlsres.dll.mui") Region: id = 2114 start_va = 0x470000 end_va = 0x472fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mswsock.dll.mui" filename = "\\Windows\\System32\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mswsock.dll.mui") Region: id = 2115 start_va = 0x480000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000480000" filename = "" Region: id = 2116 start_va = 0x540000 end_va = 0x546fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2117 start_va = 0x550000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 2118 start_va = 0x5d0000 end_va = 0x5d6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 2119 start_va = 0x5f0000 end_va = 0x5f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 2120 start_va = 0x600000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 2121 start_va = 0x700000 end_va = 0x887fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000700000" filename = "" Region: id = 2122 start_va = 0x890000 end_va = 0x890fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000890000" filename = "" Region: id = 2123 start_va = 0x8a0000 end_va = 0x8a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008a0000" filename = "" Region: id = 2124 start_va = 0x8b0000 end_va = 0x8bcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\gpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\gpsvc.dll.mui") Region: id = 2125 start_va = 0x8c0000 end_va = 0x8c1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 2126 start_va = 0x8d0000 end_va = 0x8d9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "crypt32.dll.mui" filename = "\\Windows\\System32\\en-US\\crypt32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\crypt32.dll.mui") Region: id = 2127 start_va = 0x8e0000 end_va = 0x8e3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2128 start_va = 0x8f0000 end_va = 0x8f6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 2129 start_va = 0x900000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000900000" filename = "" Region: id = 2130 start_va = 0xa00000 end_va = 0xb80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a00000" filename = "" Region: id = 2131 start_va = 0xb90000 end_va = 0xc8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b90000" filename = "" Region: id = 2132 start_va = 0xc90000 end_va = 0xc93fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2133 start_va = 0xca0000 end_va = 0xcb0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 2134 start_va = 0xcc0000 end_va = 0xcc6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cc0000" filename = "" Region: id = 2135 start_va = 0xcd0000 end_va = 0xd14fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000c.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000c.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000c.db") Region: id = 2136 start_va = 0xd20000 end_va = 0xd2cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 2137 start_va = 0xd30000 end_va = 0xd36fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d30000" filename = "" Region: id = 2138 start_va = 0xdc0000 end_va = 0xdc8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vsstrace.dll.mui" filename = "\\Windows\\System32\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vsstrace.dll.mui") Region: id = 2139 start_va = 0xdd0000 end_va = 0xdd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dd0000" filename = "" Region: id = 2140 start_va = 0xde0000 end_va = 0xde1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "activeds.dll.mui" filename = "\\Windows\\System32\\en-US\\activeds.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\activeds.dll.mui") Region: id = 2141 start_va = 0xdf0000 end_va = 0xdf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000df0000" filename = "" Region: id = 2142 start_va = 0xe00000 end_va = 0xefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e00000" filename = "" Region: id = 2143 start_va = 0xf00000 end_va = 0xffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f00000" filename = "" Region: id = 2144 start_va = 0x1000000 end_va = 0x1336fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2145 start_va = 0x1340000 end_va = 0x13bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001340000" filename = "" Region: id = 2146 start_va = 0x13c0000 end_va = 0x13d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1256.nls" filename = "\\Windows\\System32\\C_1256.NLS" (normalized: "c:\\windows\\system32\\c_1256.nls") Region: id = 2147 start_va = 0x13f0000 end_va = 0x13f6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013f0000" filename = "" Region: id = 2148 start_va = 0x1400000 end_va = 0x1410fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1251.nls" filename = "\\Windows\\System32\\C_1251.NLS" (normalized: "c:\\windows\\system32\\c_1251.nls") Region: id = 2149 start_va = 0x1420000 end_va = 0x1430fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1254.nls" filename = "\\Windows\\System32\\C_1254.NLS" (normalized: "c:\\windows\\system32\\c_1254.nls") Region: id = 2150 start_va = 0x1440000 end_va = 0x153ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001440000" filename = "" Region: id = 2151 start_va = 0x1540000 end_va = 0x15bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001540000" filename = "" Region: id = 2152 start_va = 0x15c0000 end_va = 0x15c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000015c0000" filename = "" Region: id = 2153 start_va = 0x15e0000 end_va = 0x15e6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000015e0000" filename = "" Region: id = 2154 start_va = 0x15f0000 end_va = 0x15f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usocore.dll.mui" filename = "\\Windows\\System32\\en-US\\usocore.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\usocore.dll.mui") Region: id = 2155 start_va = 0x1600000 end_va = 0x16fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001600000" filename = "" Region: id = 2156 start_va = 0x1700000 end_va = 0x17fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001700000" filename = "" Region: id = 2157 start_va = 0x1800000 end_va = 0x18dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 2158 start_va = 0x18e0000 end_va = 0x18f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1250.nls" filename = "\\Windows\\System32\\C_1250.NLS" (normalized: "c:\\windows\\system32\\c_1250.nls") Region: id = 2159 start_va = 0x1900000 end_va = 0x19fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001900000" filename = "" Region: id = 2160 start_va = 0x1a00000 end_va = 0x1a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a00000" filename = "" Region: id = 2161 start_va = 0x1a80000 end_va = 0x1b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a80000" filename = "" Region: id = 2162 start_va = 0x1b80000 end_va = 0x1c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b80000" filename = "" Region: id = 2163 start_va = 0x1c80000 end_va = 0x1cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c80000" filename = "" Region: id = 2164 start_va = 0x1d00000 end_va = 0x1d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d00000" filename = "" Region: id = 2165 start_va = 0x1d80000 end_va = 0x1e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d80000" filename = "" Region: id = 2166 start_va = 0x1e80000 end_va = 0x1f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e80000" filename = "" Region: id = 2167 start_va = 0x1f80000 end_va = 0x207ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f80000" filename = "" Region: id = 2168 start_va = 0x2080000 end_va = 0x217ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002080000" filename = "" Region: id = 2169 start_va = 0x2180000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002180000" filename = "" Region: id = 2170 start_va = 0x2280000 end_va = 0x237ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 2171 start_va = 0x2380000 end_va = 0x247ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002380000" filename = "" Region: id = 2172 start_va = 0x2480000 end_va = 0x2490fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1253.nls" filename = "\\Windows\\System32\\C_1253.NLS" (normalized: "c:\\windows\\system32\\c_1253.nls") Region: id = 2173 start_va = 0x24a0000 end_va = 0x24b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1257.nls" filename = "\\Windows\\System32\\C_1257.NLS" (normalized: "c:\\windows\\system32\\c_1257.nls") Region: id = 2174 start_va = 0x24c0000 end_va = 0x24d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1255.nls" filename = "\\Windows\\System32\\C_1255.NLS" (normalized: "c:\\windows\\system32\\c_1255.nls") Region: id = 2175 start_va = 0x24e0000 end_va = 0x24f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_874.nls" filename = "\\Windows\\System32\\C_874.NLS" (normalized: "c:\\windows\\system32\\c_874.nls") Region: id = 2176 start_va = 0x2500000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 2177 start_va = 0x2600000 end_va = 0x26fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 2178 start_va = 0x2700000 end_va = 0x27fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002700000" filename = "" Region: id = 2179 start_va = 0x2800000 end_va = 0x28fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002800000" filename = "" Region: id = 2180 start_va = 0x2900000 end_va = 0x29fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 2181 start_va = 0x2a00000 end_va = 0x2afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 2182 start_va = 0x2b00000 end_va = 0x2bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b00000" filename = "" Region: id = 2183 start_va = 0x2c00000 end_va = 0x2c8dfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 2184 start_va = 0x2c90000 end_va = 0x2cb7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_932.nls" filename = "\\Windows\\System32\\C_932.NLS" (normalized: "c:\\windows\\system32\\c_932.nls") Region: id = 2185 start_va = 0x2cc0000 end_va = 0x2cf0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_949.nls" filename = "\\Windows\\System32\\C_949.NLS" (normalized: "c:\\windows\\system32\\c_949.nls") Region: id = 2186 start_va = 0x2d00000 end_va = 0x2d01fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002d00000" filename = "" Region: id = 2187 start_va = 0x2d10000 end_va = 0x2e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d10000" filename = "" Region: id = 2188 start_va = 0x2e10000 end_va = 0x2f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e10000" filename = "" Region: id = 2189 start_va = 0x2f10000 end_va = 0x300ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 2190 start_va = 0x3110000 end_va = 0x3120fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1258.nls" filename = "\\Windows\\System32\\C_1258.NLS" (normalized: "c:\\windows\\system32\\c_1258.nls") Region: id = 2191 start_va = 0x3130000 end_va = 0x3160fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_936.nls" filename = "\\Windows\\System32\\C_936.NLS" (normalized: "c:\\windows\\system32\\c_936.nls") Region: id = 2192 start_va = 0x3170000 end_va = 0x3187fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003170000" filename = "" Region: id = 2193 start_va = 0x3190000 end_va = 0x328ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003190000" filename = "" Region: id = 2194 start_va = 0x3290000 end_va = 0x330ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003290000" filename = "" Region: id = 2195 start_va = 0x3310000 end_va = 0x3340fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_950.nls" filename = "\\Windows\\System32\\C_950.NLS" (normalized: "c:\\windows\\system32\\c_950.nls") Region: id = 2196 start_va = 0x3390000 end_va = 0x3396fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003390000" filename = "" Region: id = 2197 start_va = 0x33a0000 end_va = 0x341ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000033a0000" filename = "" Region: id = 2198 start_va = 0x3480000 end_va = 0x3486fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003480000" filename = "" Region: id = 2199 start_va = 0x3490000 end_va = 0x350ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003490000" filename = "" Region: id = 2200 start_va = 0x3570000 end_va = 0x35effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003570000" filename = "" Region: id = 2201 start_va = 0x35f0000 end_va = 0x366ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000035f0000" filename = "" Region: id = 2202 start_va = 0x3670000 end_va = 0x376ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003670000" filename = "" Region: id = 2203 start_va = 0x3770000 end_va = 0x386ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003770000" filename = "" Region: id = 2204 start_va = 0x3870000 end_va = 0x38effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003870000" filename = "" Region: id = 2205 start_va = 0x3900000 end_va = 0x39fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003900000" filename = "" Region: id = 2206 start_va = 0x3a00000 end_va = 0x3afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a00000" filename = "" Region: id = 2207 start_va = 0x3b00000 end_va = 0x3bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b00000" filename = "" Region: id = 2208 start_va = 0x3c00000 end_va = 0x3c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003c00000" filename = "" Region: id = 2209 start_va = 0x3d00000 end_va = 0x3dfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003d00000" filename = "" Region: id = 2210 start_va = 0x3e00000 end_va = 0x3efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e00000" filename = "" Region: id = 2211 start_va = 0x3f00000 end_va = 0x3ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f00000" filename = "" Region: id = 2212 start_va = 0x4000000 end_va = 0x40fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004000000" filename = "" Region: id = 2213 start_va = 0x4100000 end_va = 0x41fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004100000" filename = "" Region: id = 2214 start_va = 0x4200000 end_va = 0x42fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004200000" filename = "" Region: id = 2215 start_va = 0x4300000 end_va = 0x43fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004300000" filename = "" Region: id = 2216 start_va = 0x4400000 end_va = 0x44fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004400000" filename = "" Region: id = 2217 start_va = 0x4500000 end_va = 0x45fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004500000" filename = "" Region: id = 2218 start_va = 0x4600000 end_va = 0x46fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004600000" filename = "" Region: id = 2219 start_va = 0x4700000 end_va = 0x47fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004700000" filename = "" Region: id = 2220 start_va = 0x4800000 end_va = 0x48fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004800000" filename = "" Region: id = 2221 start_va = 0x4900000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004900000" filename = "" Region: id = 2222 start_va = 0x4a00000 end_va = 0x4afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a00000" filename = "" Region: id = 2223 start_va = 0x4c00000 end_va = 0x4cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c00000" filename = "" Region: id = 2224 start_va = 0x4d00000 end_va = 0x4dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 2225 start_va = 0x4f00000 end_va = 0x4ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f00000" filename = "" Region: id = 2226 start_va = 0x5000000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005000000" filename = "" Region: id = 2227 start_va = 0x5300000 end_va = 0x53fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005300000" filename = "" Region: id = 2228 start_va = 0x5500000 end_va = 0x55fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005500000" filename = "" Region: id = 2229 start_va = 0x5600000 end_va = 0x56fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005600000" filename = "" Region: id = 2230 start_va = 0x5700000 end_va = 0x57fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005700000" filename = "" Region: id = 2231 start_va = 0x5800000 end_va = 0x58fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005800000" filename = "" Region: id = 2232 start_va = 0x5900000 end_va = 0x59fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005900000" filename = "" Region: id = 2233 start_va = 0x5a00000 end_va = 0x5afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a00000" filename = "" Region: id = 2234 start_va = 0x5b00000 end_va = 0x5bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b00000" filename = "" Region: id = 2235 start_va = 0x5c00000 end_va = 0x5cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005c00000" filename = "" Region: id = 2236 start_va = 0x5d00000 end_va = 0x5dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d00000" filename = "" Region: id = 2237 start_va = 0x5e00000 end_va = 0x5efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e00000" filename = "" Region: id = 2238 start_va = 0x5f00000 end_va = 0x5ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f00000" filename = "" Region: id = 2239 start_va = 0x6000000 end_va = 0x60fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006000000" filename = "" Region: id = 2240 start_va = 0x6100000 end_va = 0x61fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006100000" filename = "" Region: id = 2241 start_va = 0x6200000 end_va = 0x62fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006200000" filename = "" Region: id = 2242 start_va = 0x6300000 end_va = 0x63fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006300000" filename = "" Region: id = 2243 start_va = 0x6400000 end_va = 0x64fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006400000" filename = "" Region: id = 2244 start_va = 0x6500000 end_va = 0x65fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006500000" filename = "" Region: id = 2245 start_va = 0x6700000 end_va = 0x67fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006700000" filename = "" Region: id = 2246 start_va = 0x6800000 end_va = 0x68fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006800000" filename = "" Region: id = 2247 start_va = 0x6900000 end_va = 0x69fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006900000" filename = "" Region: id = 2248 start_va = 0x6b00000 end_va = 0x6bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006b00000" filename = "" Region: id = 2249 start_va = 0x6c00000 end_va = 0x6cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006c00000" filename = "" Region: id = 2250 start_va = 0x6d00000 end_va = 0x6dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006d00000" filename = "" Region: id = 2251 start_va = 0x6e00000 end_va = 0x6efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006e00000" filename = "" Region: id = 2252 start_va = 0x6f00000 end_va = 0x6ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006f00000" filename = "" Region: id = 2253 start_va = 0x7000000 end_va = 0x70fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007000000" filename = "" Region: id = 2254 start_va = 0x7100000 end_va = 0x71fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007100000" filename = "" Region: id = 2255 start_va = 0x7200000 end_va = 0x72fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007200000" filename = "" Region: id = 2256 start_va = 0x7300000 end_va = 0x73fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007300000" filename = "" Region: id = 2257 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2258 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 2259 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 2260 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 2261 start_va = 0x7ff681250000 end_va = 0x7ff68125cfff monitored = 0 entry_point = 0x7ff681253980 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 2262 start_va = 0x7ff9fbb40000 end_va = 0x7ff9fbb56fff monitored = 0 entry_point = 0x7ff9fbb47520 region_type = mapped_file name = "usoapi.dll" filename = "\\Windows\\System32\\usoapi.dll" (normalized: "c:\\windows\\system32\\usoapi.dll") Region: id = 2263 start_va = 0x7ff9fbb60000 end_va = 0x7ff9fbc34fff monitored = 0 entry_point = 0x7ff9fbb7cf80 region_type = mapped_file name = "wuapi.dll" filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll") Region: id = 2264 start_va = 0x7ff9fbc40000 end_va = 0x7ff9fbc83fff monitored = 0 entry_point = 0x7ff9fbc683e0 region_type = mapped_file name = "updatehandlers.dll" filename = "\\Windows\\System32\\updatehandlers.dll" (normalized: "c:\\windows\\system32\\updatehandlers.dll") Region: id = 2265 start_va = 0x7ff9fbc90000 end_va = 0x7ff9fbcb1fff monitored = 0 entry_point = 0x7ff9fbca2540 region_type = mapped_file name = "updatepolicy.dll" filename = "\\Windows\\System32\\updatepolicy.dll" (normalized: "c:\\windows\\system32\\updatepolicy.dll") Region: id = 2266 start_va = 0x7ff9fbcc0000 end_va = 0x7ff9fbcd7fff monitored = 0 entry_point = 0x7ff9fbccb850 region_type = mapped_file name = "dmcmnutils.dll" filename = "\\Windows\\System32\\dmcmnutils.dll" (normalized: "c:\\windows\\system32\\dmcmnutils.dll") Region: id = 2267 start_va = 0x7ff9fbce0000 end_va = 0x7ff9fbd3cfff monitored = 0 entry_point = 0x7ff9fbd0e510 region_type = mapped_file name = "usocore.dll" filename = "\\Windows\\System32\\usocore.dll" (normalized: "c:\\windows\\system32\\usocore.dll") Region: id = 2268 start_va = 0x7ff9fdcb0000 end_va = 0x7ff9fdf5ffff monitored = 0 entry_point = 0x7ff9fdcb1cf0 region_type = mapped_file name = "netshell.dll" filename = "\\Windows\\System32\\netshell.dll" (normalized: "c:\\windows\\system32\\netshell.dll") Region: id = 2269 start_va = 0x7ff9ff0b0000 end_va = 0x7ff9ff0e1fff monitored = 0 entry_point = 0x7ff9ff0bb0c0 region_type = mapped_file name = "shacct.dll" filename = "\\Windows\\System32\\shacct.dll" (normalized: "c:\\windows\\system32\\shacct.dll") Region: id = 2270 start_va = 0x7ff9ff950000 end_va = 0x7ff9ff98efff monitored = 0 entry_point = 0x7ff9ff9782d0 region_type = mapped_file name = "tcpipcfg.dll" filename = "\\Windows\\System32\\tcpipcfg.dll" (normalized: "c:\\windows\\system32\\tcpipcfg.dll") Region: id = 2271 start_va = 0x7ff9ff9c0000 end_va = 0x7ff9ffa3ffff monitored = 0 entry_point = 0x7ff9ff9ed280 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 2272 start_va = 0x7ff9ffa80000 end_va = 0x7ff9ffab5fff monitored = 0 entry_point = 0x7ff9ffa827f0 region_type = mapped_file name = "windows.networking.hostname.dll" filename = "\\Windows\\System32\\Windows.Networking.HostName.dll" (normalized: "c:\\windows\\system32\\windows.networking.hostname.dll") Region: id = 2273 start_va = 0x7ff9ffac0000 end_va = 0x7ff9ffb26fff monitored = 0 entry_point = 0x7ff9ffacb160 region_type = mapped_file name = "upnp.dll" filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll") Region: id = 2274 start_va = 0x7ff9ffbe0000 end_va = 0x7ff9ffceefff monitored = 0 entry_point = 0x7ff9ffc1c010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 2275 start_va = 0x7ffa01260000 end_va = 0x7ffa01270fff monitored = 0 entry_point = 0x7ffa012628d0 region_type = mapped_file name = "credentialmigrationhandler.dll" filename = "\\Windows\\System32\\CredentialMigrationHandler.dll" (normalized: "c:\\windows\\system32\\credentialmigrationhandler.dll") Region: id = 2276 start_va = 0x7ffa01280000 end_va = 0x7ffa01297fff monitored = 0 entry_point = 0x7ffa01281b10 region_type = mapped_file name = "locationframeworkinternalps.dll" filename = "\\Windows\\System32\\LocationFrameworkInternalPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkinternalps.dll") Region: id = 2277 start_va = 0x7ffa012a0000 end_va = 0x7ffa012bcfff monitored = 0 entry_point = 0x7ffa012a4f60 region_type = mapped_file name = "appinfo.dll" filename = "\\Windows\\System32\\appinfo.dll" (normalized: "c:\\windows\\system32\\appinfo.dll") Region: id = 2278 start_va = 0x7ffa01540000 end_va = 0x7ffa0165cfff monitored = 0 entry_point = 0x7ffa0156fe60 region_type = mapped_file name = "qmgr.dll" filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll") Region: id = 2279 start_va = 0x7ffa01690000 end_va = 0x7ffa016a3fff monitored = 0 entry_point = 0x7ffa01693710 region_type = mapped_file name = "mskeyprotect.dll" filename = "\\Windows\\System32\\mskeyprotect.dll" (normalized: "c:\\windows\\system32\\mskeyprotect.dll") Region: id = 2280 start_va = 0x7ffa01740000 end_va = 0x7ffa0175dfff monitored = 0 entry_point = 0x7ffa0174ef80 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\System32\\ncryptsslp.dll" (normalized: "c:\\windows\\system32\\ncryptsslp.dll") Region: id = 2281 start_va = 0x7ffa06940000 end_va = 0x7ffa06953fff monitored = 0 entry_point = 0x7ffa06942a00 region_type = mapped_file name = "bitsigd.dll" filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll") Region: id = 2282 start_va = 0x7ffa069a0000 end_va = 0x7ffa069b5fff monitored = 0 entry_point = 0x7ffa069a1d50 region_type = mapped_file name = "wwapi.dll" filename = "\\Windows\\System32\\wwapi.dll" (normalized: "c:\\windows\\system32\\wwapi.dll") Region: id = 2283 start_va = 0x7ffa07a20000 end_va = 0x7ffa07a30fff monitored = 0 entry_point = 0x7ffa07a27480 region_type = mapped_file name = "tetheringclient.dll" filename = "\\Windows\\System32\\tetheringclient.dll" (normalized: "c:\\windows\\system32\\tetheringclient.dll") Region: id = 2284 start_va = 0x7ffa07a40000 end_va = 0x7ffa07ac3fff monitored = 0 entry_point = 0x7ffa07a58d50 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 2285 start_va = 0x7ffa07ad0000 end_va = 0x7ffa07ae5fff monitored = 0 entry_point = 0x7ffa07ad55e0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 2286 start_va = 0x7ffa07af0000 end_va = 0x7ffa07bc5fff monitored = 0 entry_point = 0x7ffa07b1a800 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 2287 start_va = 0x7ffa07c20000 end_va = 0x7ffa07c83fff monitored = 0 entry_point = 0x7ffa07c3bed0 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 2288 start_va = 0x7ffa07c90000 end_va = 0x7ffa07cb4fff monitored = 0 entry_point = 0x7ffa07c99900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 2289 start_va = 0x7ffa07cc0000 end_va = 0x7ffa07cd3fff monitored = 0 entry_point = 0x7ffa07cc1800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 2290 start_va = 0x7ffa07ce0000 end_va = 0x7ffa07dd5fff monitored = 0 entry_point = 0x7ffa07d19590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 2291 start_va = 0x7ffa07de0000 end_va = 0x7ffa07e53fff monitored = 0 entry_point = 0x7ffa07df5eb0 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 2292 start_va = 0x7ffa07e60000 end_va = 0x7ffa07f96fff monitored = 0 entry_point = 0x7ffa07ea0480 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 2293 start_va = 0x7ffa08390000 end_va = 0x7ffa083a0fff monitored = 0 entry_point = 0x7ffa08392fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2294 start_va = 0x7ffa083b0000 end_va = 0x7ffa083cdfff monitored = 0 entry_point = 0x7ffa083b3a40 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 2295 start_va = 0x7ffa083d0000 end_va = 0x7ffa08451fff monitored = 0 entry_point = 0x7ffa083d2a10 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 2296 start_va = 0x7ffa08460000 end_va = 0x7ffa08475fff monitored = 0 entry_point = 0x7ffa08461af0 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 2297 start_va = 0x7ffa08480000 end_va = 0x7ffa08499fff monitored = 0 entry_point = 0x7ffa08482330 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 2298 start_va = 0x7ffa088d0000 end_va = 0x7ffa08915fff monitored = 0 entry_point = 0x7ffa088d79a0 region_type = mapped_file name = "adsldp.dll" filename = "\\Windows\\System32\\adsldp.dll" (normalized: "c:\\windows\\system32\\adsldp.dll") Region: id = 2299 start_va = 0x7ffa08940000 end_va = 0x7ffa0894efff monitored = 0 entry_point = 0x7ffa08944960 region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 2300 start_va = 0x7ffa08a00000 end_va = 0x7ffa08a0bfff monitored = 0 entry_point = 0x7ffa08a035c0 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2301 start_va = 0x7ffa08a10000 end_va = 0x7ffa08a4ffff monitored = 0 entry_point = 0x7ffa08a1cbe0 region_type = mapped_file name = "adsldpc.dll" filename = "\\Windows\\System32\\adsldpc.dll" (normalized: "c:\\windows\\system32\\adsldpc.dll") Region: id = 2302 start_va = 0x7ffa08a50000 end_va = 0x7ffa08a96fff monitored = 0 entry_point = 0x7ffa08a51d10 region_type = mapped_file name = "activeds.dll" filename = "\\Windows\\System32\\activeds.dll" (normalized: "c:\\windows\\system32\\activeds.dll") Region: id = 2303 start_va = 0x7ffa08ae0000 end_va = 0x7ffa08b21fff monitored = 0 entry_point = 0x7ffa08ae3670 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 2304 start_va = 0x7ffa08e00000 end_va = 0x7ffa08e1efff monitored = 0 entry_point = 0x7ffa08e037e0 region_type = mapped_file name = "netsetupapi.dll" filename = "\\Windows\\System32\\NetSetupApi.dll" (normalized: "c:\\windows\\system32\\netsetupapi.dll") Region: id = 2305 start_va = 0x7ffa08e20000 end_va = 0x7ffa08e98fff monitored = 0 entry_point = 0x7ffa08e276a0 region_type = mapped_file name = "netsetupshim.dll" filename = "\\Windows\\System32\\NetSetupShim.dll" (normalized: "c:\\windows\\system32\\netsetupshim.dll") Region: id = 2306 start_va = 0x7ffa08eb0000 end_va = 0x7ffa08eeffff monitored = 0 entry_point = 0x7ffa08ec6c60 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 2307 start_va = 0x7ffa08f10000 end_va = 0x7ffa08f27fff monitored = 0 entry_point = 0x7ffa08f14e10 region_type = mapped_file name = "adhsvc.dll" filename = "\\Windows\\System32\\adhsvc.dll" (normalized: "c:\\windows\\system32\\adhsvc.dll") Region: id = 2308 start_va = 0x7ffa08f30000 end_va = 0x7ffa08f54fff monitored = 0 entry_point = 0x7ffa08f35ca0 region_type = mapped_file name = "httpprxm.dll" filename = "\\Windows\\System32\\httpprxm.dll" (normalized: "c:\\windows\\system32\\httpprxm.dll") Region: id = 2309 start_va = 0x7ffa08f60000 end_va = 0x7ffa090e1fff monitored = 0 entry_point = 0x7ffa08f782a0 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 2310 start_va = 0x7ffa090f0000 end_va = 0x7ffa09192fff monitored = 0 entry_point = 0x7ffa090f2c10 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 2311 start_va = 0x7ffa091a0000 end_va = 0x7ffa091f1fff monitored = 0 entry_point = 0x7ffa091a5770 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 2312 start_va = 0x7ffa09200000 end_va = 0x7ffa0922dfff monitored = 1 entry_point = 0x7ffa09202300 region_type = mapped_file name = "wmidcom.dll" filename = "\\Windows\\System32\\wmidcom.dll" (normalized: "c:\\windows\\system32\\wmidcom.dll") Region: id = 2313 start_va = 0x7ffa09230000 end_va = 0x7ffa0928dfff monitored = 0 entry_point = 0x7ffa09235080 region_type = mapped_file name = "miutils.dll" filename = "\\Windows\\System32\\miutils.dll" (normalized: "c:\\windows\\system32\\miutils.dll") Region: id = 2314 start_va = 0x7ffa09290000 end_va = 0x7ffa092affff monitored = 0 entry_point = 0x7ffa09291f50 region_type = mapped_file name = "mi.dll" filename = "\\Windows\\System32\\mi.dll" (normalized: "c:\\windows\\system32\\mi.dll") Region: id = 2315 start_va = 0x7ffa092b0000 end_va = 0x7ffa092b8fff monitored = 0 entry_point = 0x7ffa092b18f0 region_type = mapped_file name = "sscoreext.dll" filename = "\\Windows\\System32\\sscoreext.dll" (normalized: "c:\\windows\\system32\\sscoreext.dll") Region: id = 2316 start_va = 0x7ffa092c0000 end_va = 0x7ffa092d0fff monitored = 0 entry_point = 0x7ffa092c1d30 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 2317 start_va = 0x7ffa09330000 end_va = 0x7ffa09347fff monitored = 0 entry_point = 0x7ffa09332000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 2318 start_va = 0x7ffa09350000 end_va = 0x7ffa09390fff monitored = 0 entry_point = 0x7ffa09353750 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 2319 start_va = 0x7ffa09430000 end_va = 0x7ffa0947bfff monitored = 0 entry_point = 0x7ffa09445310 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 2320 start_va = 0x7ffa09490000 end_va = 0x7ffa0950efff monitored = 0 entry_point = 0x7ffa094a7110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 2321 start_va = 0x7ffa09510000 end_va = 0x7ffa0954bfff monitored = 0 entry_point = 0x7ffa09516aa0 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 2322 start_va = 0x7ffa09c80000 end_va = 0x7ffa09c88fff monitored = 0 entry_point = 0x7ffa09c821d0 region_type = mapped_file name = "httpprxc.dll" filename = "\\Windows\\System32\\httpprxc.dll" (normalized: "c:\\windows\\system32\\httpprxc.dll") Region: id = 2323 start_va = 0x7ffa09c90000 end_va = 0x7ffa09cc4fff monitored = 0 entry_point = 0x7ffa09c9a270 region_type = mapped_file name = "fwpolicyiomgr.dll" filename = "\\Windows\\System32\\fwpolicyiomgr.dll" (normalized: "c:\\windows\\system32\\fwpolicyiomgr.dll") Region: id = 2324 start_va = 0x7ffa09db0000 end_va = 0x7ffa09db7fff monitored = 0 entry_point = 0x7ffa09db13b0 region_type = mapped_file name = "dmiso8601utils.dll" filename = "\\Windows\\System32\\dmiso8601utils.dll" (normalized: "c:\\windows\\system32\\dmiso8601utils.dll") Region: id = 2325 start_va = 0x7ffa0a560000 end_va = 0x7ffa0a652fff monitored = 0 entry_point = 0x7ffa0a585d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 2326 start_va = 0x7ffa0ac50000 end_va = 0x7ffa0ac59fff monitored = 0 entry_point = 0x7ffa0ac514c0 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 2327 start_va = 0x7ffa0afc0000 end_va = 0x7ffa0afd1fff monitored = 0 entry_point = 0x7ffa0afc3580 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 2328 start_va = 0x7ffa0b050000 end_va = 0x7ffa0b06afff monitored = 0 entry_point = 0x7ffa0b051040 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 2329 start_va = 0x7ffa0b300000 end_va = 0x7ffa0b314fff monitored = 0 entry_point = 0x7ffa0b302dc0 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll") Region: id = 2330 start_va = 0x7ffa0b320000 end_va = 0x7ffa0b32dfff monitored = 0 entry_point = 0x7ffa0b321460 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 2331 start_va = 0x7ffa0b330000 end_va = 0x7ffa0b33bfff monitored = 0 entry_point = 0x7ffa0b332830 region_type = mapped_file name = "bi.dll" filename = "\\Windows\\System32\\bi.dll" (normalized: "c:\\windows\\system32\\bi.dll") Region: id = 2332 start_va = 0x7ffa0b340000 end_va = 0x7ffa0b34ffff monitored = 0 entry_point = 0x7ffa0b341700 region_type = mapped_file name = "proximityservicepal.dll" filename = "\\Windows\\System32\\ProximityServicePal.dll" (normalized: "c:\\windows\\system32\\proximityservicepal.dll") Region: id = 2333 start_va = 0x7ffa0b350000 end_va = 0x7ffa0b358fff monitored = 0 entry_point = 0x7ffa0b351ed0 region_type = mapped_file name = "proximitycommonpal.dll" filename = "\\Windows\\System32\\ProximityCommonPal.dll" (normalized: "c:\\windows\\system32\\proximitycommonpal.dll") Region: id = 2334 start_va = 0x7ffa0b360000 end_va = 0x7ffa0b38cfff monitored = 0 entry_point = 0x7ffa0b362290 region_type = mapped_file name = "proximitycommon.dll" filename = "\\Windows\\System32\\ProximityCommon.dll" (normalized: "c:\\windows\\system32\\proximitycommon.dll") Region: id = 2335 start_va = 0x7ffa0b390000 end_va = 0x7ffa0b3e1fff monitored = 0 entry_point = 0x7ffa0b3938e0 region_type = mapped_file name = "proximityservice.dll" filename = "\\Windows\\System32\\ProximityService.dll" (normalized: "c:\\windows\\system32\\proximityservice.dll") Region: id = 2336 start_va = 0x7ffa0b4a0000 end_va = 0x7ffa0b4b4fff monitored = 0 entry_point = 0x7ffa0b4a3460 region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 2337 start_va = 0x7ffa0b4c0000 end_va = 0x7ffa0b559fff monitored = 0 entry_point = 0x7ffa0b4dada0 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 2338 start_va = 0x7ffa0b640000 end_va = 0x7ffa0b6a6fff monitored = 0 entry_point = 0x7ffa0b6463e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2339 start_va = 0x7ffa0b7a0000 end_va = 0x7ffa0b7aafff monitored = 0 entry_point = 0x7ffa0b7a1d30 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2340 start_va = 0x7ffa0b800000 end_va = 0x7ffa0b8bffff monitored = 0 entry_point = 0x7ffa0b82fd20 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 2341 start_va = 0x7ffa0b9f0000 end_va = 0x7ffa0ba09fff monitored = 0 entry_point = 0x7ffa0b9f2430 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 2342 start_va = 0x7ffa0ba10000 end_va = 0x7ffa0ba25fff monitored = 0 entry_point = 0x7ffa0ba119f0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 2343 start_va = 0x7ffa0baf0000 end_va = 0x7ffa0bb27fff monitored = 0 entry_point = 0x7ffa0bb08cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2344 start_va = 0x7ffa0bbe0000 end_va = 0x7ffa0bc8dfff monitored = 0 entry_point = 0x7ffa0bbf80c0 region_type = mapped_file name = "windows.networking.connectivity.dll" filename = "\\Windows\\System32\\Windows.Networking.Connectivity.dll" (normalized: "c:\\windows\\system32\\windows.networking.connectivity.dll") Region: id = 2345 start_va = 0x7ffa0bc90000 end_va = 0x7ffa0bca1fff monitored = 0 entry_point = 0x7ffa0bc99260 region_type = mapped_file name = "rilproxy.dll" filename = "\\Windows\\System32\\rilproxy.dll" (normalized: "c:\\windows\\system32\\rilproxy.dll") Region: id = 2346 start_va = 0x7ffa0bcb0000 end_va = 0x7ffa0bd60fff monitored = 0 entry_point = 0x7ffa0bd288b0 region_type = mapped_file name = "cellularapi.dll" filename = "\\Windows\\System32\\CellularAPI.dll" (normalized: "c:\\windows\\system32\\cellularapi.dll") Region: id = 2347 start_va = 0x7ffa0bd70000 end_va = 0x7ffa0bd83fff monitored = 0 entry_point = 0x7ffa0bd72d50 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 2348 start_va = 0x7ffa0c070000 end_va = 0x7ffa0c102fff monitored = 0 entry_point = 0x7ffa0c079680 region_type = mapped_file name = "msvcp_win.dll" filename = "\\Windows\\System32\\msvcp_win.dll" (normalized: "c:\\windows\\system32\\msvcp_win.dll") Region: id = 2349 start_va = 0x7ffa0c2b0000 end_va = 0x7ffa0c2d4fff monitored = 0 entry_point = 0x7ffa0c2c2f20 region_type = mapped_file name = "wificonnapi.dll" filename = "\\Windows\\System32\\wificonnapi.dll" (normalized: "c:\\windows\\system32\\wificonnapi.dll") Region: id = 2350 start_va = 0x7ffa0c2e0000 end_va = 0x7ffa0c2f0fff monitored = 0 entry_point = 0x7ffa0c2e7ea0 region_type = mapped_file name = "dcpapi.dll" filename = "\\Windows\\System32\\dcpapi.dll" (normalized: "c:\\windows\\system32\\dcpapi.dll") Region: id = 2351 start_va = 0x7ffa0c300000 end_va = 0x7ffa0c318fff monitored = 0 entry_point = 0x7ffa0c304520 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 2352 start_va = 0x7ffa0c9a0000 end_va = 0x7ffa0c9befff monitored = 0 entry_point = 0x7ffa0c9a4960 region_type = mapped_file name = "ncprov.dll" filename = "\\Windows\\System32\\wbem\\NCProv.dll" (normalized: "c:\\windows\\system32\\wbem\\ncprov.dll") Region: id = 2353 start_va = 0x7ffa0ca80000 end_va = 0x7ffa0ca99fff monitored = 0 entry_point = 0x7ffa0ca82cf0 region_type = mapped_file name = "locationpelegacywinlocation.dll" filename = "\\Windows\\System32\\LocationPeLegacyWinLocation.dll" (normalized: "c:\\windows\\system32\\locationpelegacywinlocation.dll") Region: id = 2354 start_va = 0x7ffa0ce40000 end_va = 0x7ffa0d1c1fff monitored = 0 entry_point = 0x7ffa0ce91220 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 2355 start_va = 0x7ffa0e2c0000 end_va = 0x7ffa0e3cdfff monitored = 0 entry_point = 0x7ffa0e30eaa0 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 2356 start_va = 0x7ffa0e460000 end_va = 0x7ffa0e471fff monitored = 0 entry_point = 0x7ffa0e461a80 region_type = mapped_file name = "bitsproxy.dll" filename = "\\Windows\\System32\\BitsProxy.dll" (normalized: "c:\\windows\\system32\\bitsproxy.dll") Region: id = 2357 start_va = 0x7ffa0e6d0000 end_va = 0x7ffa0e724fff monitored = 0 entry_point = 0x7ffa0e6d3fb0 region_type = mapped_file name = "policymanager.dll" filename = "\\Windows\\System32\\policymanager.dll" (normalized: "c:\\windows\\system32\\policymanager.dll") Region: id = 2358 start_va = 0x7ffa0e730000 end_va = 0x7ffa0e766fff monitored = 0 entry_point = 0x7ffa0e736020 region_type = mapped_file name = "gnssadapter.dll" filename = "\\Windows\\System32\\GnssAdapter.dll" (normalized: "c:\\windows\\system32\\gnssadapter.dll") Region: id = 2359 start_va = 0x7ffa0e770000 end_va = 0x7ffa0e78ffff monitored = 0 entry_point = 0x7ffa0e7739a0 region_type = mapped_file name = "locationwinpalmisc.dll" filename = "\\Windows\\System32\\LocationWinPalMisc.dll" (normalized: "c:\\windows\\system32\\locationwinpalmisc.dll") Region: id = 2360 start_va = 0x7ffa0e790000 end_va = 0x7ffa0e7a6fff monitored = 0 entry_point = 0x7ffa0e795630 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 2361 start_va = 0x7ffa0e7b0000 end_va = 0x7ffa0e7c2fff monitored = 0 entry_point = 0x7ffa0e7b57f0 region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 2362 start_va = 0x7ffa0e7d0000 end_va = 0x7ffa0e849fff monitored = 0 entry_point = 0x7ffa0e7f7630 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 2363 start_va = 0x7ffa0e850000 end_va = 0x7ffa0e87dfff monitored = 0 entry_point = 0x7ffa0e857550 region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 2364 start_va = 0x7ffa0e880000 end_va = 0x7ffa0e895fff monitored = 0 entry_point = 0x7ffa0e881b60 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2365 start_va = 0x7ffa0e8a0000 end_va = 0x7ffa0e903fff monitored = 0 entry_point = 0x7ffa0e8b5ae0 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 2366 start_va = 0x7ffa0ead0000 end_va = 0x7ffa0eb10fff monitored = 0 entry_point = 0x7ffa0ead4840 region_type = mapped_file name = "usermgrproxy.dll" filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll") Region: id = 2367 start_va = 0x7ffa0eb20000 end_va = 0x7ffa0eb2bfff monitored = 0 entry_point = 0x7ffa0eb214d0 region_type = mapped_file name = "locationframeworkps.dll" filename = "\\Windows\\System32\\LocationFrameworkPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkps.dll") Region: id = 2368 start_va = 0x7ffa0eb30000 end_va = 0x7ffa0ec65fff monitored = 0 entry_point = 0x7ffa0eb5f350 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 2369 start_va = 0x7ffa0ec70000 end_va = 0x7ffa0ed55fff monitored = 0 entry_point = 0x7ffa0ec8cf10 region_type = mapped_file name = "usermgr.dll" filename = "\\Windows\\System32\\usermgr.dll" (normalized: "c:\\windows\\system32\\usermgr.dll") Region: id = 2370 start_va = 0x7ffa0ed60000 end_va = 0x7ffa0ee27fff monitored = 0 entry_point = 0x7ffa0eda13f0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 2371 start_va = 0x7ffa0ee30000 end_va = 0x7ffa0ee90fff monitored = 0 entry_point = 0x7ffa0ee34b50 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 2372 start_va = 0x7ffa0eea0000 end_va = 0x7ffa0f01bfff monitored = 0 entry_point = 0x7ffa0eef1650 region_type = mapped_file name = "locationframework.dll" filename = "\\Windows\\System32\\LocationFramework.dll" (normalized: "c:\\windows\\system32\\locationframework.dll") Region: id = 2373 start_va = 0x7ffa0f020000 end_va = 0x7ffa0f02afff monitored = 0 entry_point = 0x7ffa0f021770 region_type = mapped_file name = "lfsvc.dll" filename = "\\Windows\\System32\\lfsvc.dll" (normalized: "c:\\windows\\system32\\lfsvc.dll") Region: id = 2374 start_va = 0x7ffa0f030000 end_va = 0x7ffa0f06dfff monitored = 0 entry_point = 0x7ffa0f03a050 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 2375 start_va = 0x7ffa0f070000 end_va = 0x7ffa0f096fff monitored = 0 entry_point = 0x7ffa0f073bf0 region_type = mapped_file name = "profsvcext.dll" filename = "\\Windows\\System32\\profsvcext.dll" (normalized: "c:\\windows\\system32\\profsvcext.dll") Region: id = 2376 start_va = 0x7ffa0f0a0000 end_va = 0x7ffa0f0e9fff monitored = 0 entry_point = 0x7ffa0f0aac30 region_type = mapped_file name = "deviceaccess.dll" filename = "\\Windows\\System32\\deviceaccess.dll" (normalized: "c:\\windows\\system32\\deviceaccess.dll") Region: id = 2377 start_va = 0x7ffa0f0f0000 end_va = 0x7ffa0f144fff monitored = 0 entry_point = 0x7ffa0f0ffc00 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 2378 start_va = 0x7ffa0f190000 end_va = 0x7ffa0f221fff monitored = 0 entry_point = 0x7ffa0f1da780 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 2379 start_va = 0x7ffa0f2b0000 end_va = 0x7ffa0f2bcfff monitored = 0 entry_point = 0x7ffa0f2b1420 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 2380 start_va = 0x7ffa0f2d0000 end_va = 0x7ffa0f2dffff monitored = 0 entry_point = 0x7ffa0f2d2c60 region_type = mapped_file name = "usermgrcli.dll" filename = "\\Windows\\System32\\usermgrcli.dll" (normalized: "c:\\windows\\system32\\usermgrcli.dll") Region: id = 2381 start_va = 0x7ffa0f2e0000 end_va = 0x7ffa0f2ecfff monitored = 0 entry_point = 0x7ffa0f2e2ca0 region_type = mapped_file name = "csystemeventsbrokerclient.dll" filename = "\\Windows\\System32\\CSystemEventsBrokerClient.dll" (normalized: "c:\\windows\\system32\\csystemeventsbrokerclient.dll") Region: id = 2382 start_va = 0x7ffa0f2f0000 end_va = 0x7ffa0f31efff monitored = 0 entry_point = 0x7ffa0f2f8910 region_type = mapped_file name = "wptaskscheduler.dll" filename = "\\Windows\\System32\\WPTaskScheduler.dll" (normalized: "c:\\windows\\system32\\wptaskscheduler.dll") Region: id = 2383 start_va = 0x7ffa0f370000 end_va = 0x7ffa0f3ddfff monitored = 0 entry_point = 0x7ffa0f377f60 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 2384 start_va = 0x7ffa0f3e0000 end_va = 0x7ffa0f3f0fff monitored = 0 entry_point = 0x7ffa0f3e3320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 2385 start_va = 0x7ffa0f430000 end_va = 0x7ffa0f465fff monitored = 0 entry_point = 0x7ffa0f440070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 2386 start_va = 0x7ffa0fc30000 end_va = 0x7ffa0fc70fff monitored = 0 entry_point = 0x7ffa0fc47eb0 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 2387 start_va = 0x7ffa0fc80000 end_va = 0x7ffa0fd7bfff monitored = 0 entry_point = 0x7ffa0fcb6df0 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 2388 start_va = 0x7ffa0fe10000 end_va = 0x7ffa0fecefff monitored = 0 entry_point = 0x7ffa0fe31c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2389 start_va = 0x7ffa0ff20000 end_va = 0x7ffa0ff29fff monitored = 0 entry_point = 0x7ffa0ff21660 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 2390 start_va = 0x7ffa0ff30000 end_va = 0x7ffa0ff47fff monitored = 0 entry_point = 0x7ffa0ff35910 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 2391 start_va = 0x7ffa0ff50000 end_va = 0x7ffa1009cfff monitored = 0 entry_point = 0x7ffa0ff93da0 region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 2392 start_va = 0x7ffa10cc0000 end_va = 0x7ffa11152fff monitored = 0 entry_point = 0x7ffa10ccf760 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 2393 start_va = 0x7ffa11160000 end_va = 0x7ffa111c6fff monitored = 0 entry_point = 0x7ffa1117e710 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 2394 start_va = 0x7ffa11220000 end_va = 0x7ffa113a5fff monitored = 0 entry_point = 0x7ffa1126d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 2395 start_va = 0x7ffa113b0000 end_va = 0x7ffa113cbfff monitored = 0 entry_point = 0x7ffa113b37a0 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 2396 start_va = 0x7ffa113d0000 end_va = 0x7ffa113dafff monitored = 0 entry_point = 0x7ffa113d1de0 region_type = mapped_file name = "bitsperf.dll" filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll") Region: id = 2397 start_va = 0x7ffa11410000 end_va = 0x7ffa11422fff monitored = 0 entry_point = 0x7ffa11412760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 2398 start_va = 0x7ffa114c0000 end_va = 0x7ffa114c9fff monitored = 0 entry_point = 0x7ffa114c1350 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2399 start_va = 0x7ffa11580000 end_va = 0x7ffa115f8fff monitored = 0 entry_point = 0x7ffa1159fb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 2400 start_va = 0x7ffa11600000 end_va = 0x7ffa11607fff monitored = 0 entry_point = 0x7ffa116013e0 region_type = mapped_file name = "dabapi.dll" filename = "\\Windows\\System32\\dabapi.dll" (normalized: "c:\\windows\\system32\\dabapi.dll") Region: id = 2401 start_va = 0x7ffa11640000 end_va = 0x7ffa1167ffff monitored = 0 entry_point = 0x7ffa11651960 region_type = mapped_file name = "brokerlib.dll" filename = "\\Windows\\System32\\BrokerLib.dll" (normalized: "c:\\windows\\system32\\brokerlib.dll") Region: id = 2402 start_va = 0x7ffa117d0000 end_va = 0x7ffa117f6fff monitored = 0 entry_point = 0x7ffa117d7940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 2403 start_va = 0x7ffa11800000 end_va = 0x7ffa118a9fff monitored = 0 entry_point = 0x7ffa11827910 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2404 start_va = 0x7ffa118b0000 end_va = 0x7ffa119affff monitored = 0 entry_point = 0x7ffa118f0f80 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 2405 start_va = 0x7ffa11a40000 end_va = 0x7ffa11a4bfff monitored = 0 entry_point = 0x7ffa11a42480 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 2406 start_va = 0x7ffa11b10000 end_va = 0x7ffa11b41fff monitored = 0 entry_point = 0x7ffa11b22340 region_type = mapped_file name = "fwbase.dll" filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll") Region: id = 2407 start_va = 0x7ffa11d80000 end_va = 0x7ffa11d8bfff monitored = 0 entry_point = 0x7ffa11d82790 region_type = mapped_file name = "hid.dll" filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll") Region: id = 2408 start_va = 0x7ffa11d90000 end_va = 0x7ffa11db3fff monitored = 0 entry_point = 0x7ffa11d93260 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 2409 start_va = 0x7ffa11f30000 end_va = 0x7ffa12023fff monitored = 0 entry_point = 0x7ffa11f3a960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 2410 start_va = 0x7ffa12080000 end_va = 0x7ffa120c8fff monitored = 0 entry_point = 0x7ffa1208a090 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 2411 start_va = 0x7ffa121a0000 end_va = 0x7ffa121abfff monitored = 0 entry_point = 0x7ffa121a27e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2412 start_va = 0x7ffa12280000 end_va = 0x7ffa122b0fff monitored = 0 entry_point = 0x7ffa12287d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2413 start_va = 0x7ffa122e0000 end_va = 0x7ffa12359fff monitored = 0 entry_point = 0x7ffa12301a50 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 2414 start_va = 0x7ffa123a0000 end_va = 0x7ffa123d3fff monitored = 0 entry_point = 0x7ffa123bae70 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2415 start_va = 0x7ffa123e0000 end_va = 0x7ffa123e9fff monitored = 0 entry_point = 0x7ffa123e1830 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll") Region: id = 2416 start_va = 0x7ffa124f0000 end_va = 0x7ffa1250efff monitored = 0 entry_point = 0x7ffa124f5d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2417 start_va = 0x7ffa12660000 end_va = 0x7ffa126bbfff monitored = 0 entry_point = 0x7ffa12676f70 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 2418 start_va = 0x7ffa12710000 end_va = 0x7ffa12726fff monitored = 0 entry_point = 0x7ffa127179d0 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2419 start_va = 0x7ffa12830000 end_va = 0x7ffa1283afff monitored = 0 entry_point = 0x7ffa128319a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2420 start_va = 0x7ffa12870000 end_va = 0x7ffa12890fff monitored = 0 entry_point = 0x7ffa12880250 region_type = mapped_file name = "joinutil.dll" filename = "\\Windows\\System32\\joinutil.dll" (normalized: "c:\\windows\\system32\\joinutil.dll") Region: id = 2421 start_va = 0x7ffa128c0000 end_va = 0x7ffa128f9fff monitored = 0 entry_point = 0x7ffa128c8d20 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll") Region: id = 2422 start_va = 0x7ffa12900000 end_va = 0x7ffa12926fff monitored = 0 entry_point = 0x7ffa12910aa0 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 2423 start_va = 0x7ffa12a10000 end_va = 0x7ffa12a3cfff monitored = 0 entry_point = 0x7ffa12a29d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2424 start_va = 0x7ffa12ba0000 end_va = 0x7ffa12bf5fff monitored = 0 entry_point = 0x7ffa12bb0bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 2425 start_va = 0x7ffa12c00000 end_va = 0x7ffa12c18fff monitored = 0 entry_point = 0x7ffa12c05e10 region_type = mapped_file name = "eventaggregation.dll" filename = "\\Windows\\System32\\EventAggregation.dll" (normalized: "c:\\windows\\system32\\eventaggregation.dll") Region: id = 2426 start_va = 0x7ffa12c20000 end_va = 0x7ffa12c48fff monitored = 0 entry_point = 0x7ffa12c34530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2427 start_va = 0x7ffa12c50000 end_va = 0x7ffa12ce8fff monitored = 0 entry_point = 0x7ffa12c7f4e0 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 2428 start_va = 0x7ffa12d90000 end_va = 0x7ffa12da3fff monitored = 0 entry_point = 0x7ffa12d952e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2429 start_va = 0x7ffa12db0000 end_va = 0x7ffa12dbffff monitored = 0 entry_point = 0x7ffa12db56e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 2430 start_va = 0x7ffa12dc0000 end_va = 0x7ffa12e0afff monitored = 0 entry_point = 0x7ffa12dc35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 2431 start_va = 0x7ffa12e10000 end_va = 0x7ffa12e1efff monitored = 0 entry_point = 0x7ffa12e13210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2432 start_va = 0x7ffa12e20000 end_va = 0x7ffa12e74fff monitored = 0 entry_point = 0x7ffa12e37970 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 2433 start_va = 0x7ffa12e80000 end_va = 0x7ffa12f34fff monitored = 0 entry_point = 0x7ffa12ec22e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 2434 start_va = 0x7ffa12f40000 end_va = 0x7ffa13106fff monitored = 0 entry_point = 0x7ffa12f9db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 2435 start_va = 0x7ffa13110000 end_va = 0x7ffa13126fff monitored = 0 entry_point = 0x7ffa13111390 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2436 start_va = 0x7ffa13130000 end_va = 0x7ffa13317fff monitored = 0 entry_point = 0x7ffa1315ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2437 start_va = 0x7ffa13320000 end_va = 0x7ffa13389fff monitored = 0 entry_point = 0x7ffa13356d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2438 start_va = 0x7ffa13390000 end_va = 0x7ffa133d2fff monitored = 0 entry_point = 0x7ffa133a4b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2439 start_va = 0x7ffa133e0000 end_va = 0x7ffa13465fff monitored = 0 entry_point = 0x7ffa133ed8f0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 2440 start_va = 0x7ffa13520000 end_va = 0x7ffa13b63fff monitored = 0 entry_point = 0x7ffa136e64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 2441 start_va = 0x7ffa13b70000 end_va = 0x7ffa13cb2fff monitored = 0 entry_point = 0x7ffa13b98210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2442 start_va = 0x7ffa13cc0000 end_va = 0x7ffa13d5cfff monitored = 0 entry_point = 0x7ffa13cc78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2443 start_va = 0x7ffa13d60000 end_va = 0x7ffa13d67fff monitored = 0 entry_point = 0x7ffa13d61ea0 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2444 start_va = 0x7ffa13d80000 end_va = 0x7ffa13ed5fff monitored = 0 entry_point = 0x7ffa13d8a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2445 start_va = 0x7ffa13ee0000 end_va = 0x7ffa14065fff monitored = 0 entry_point = 0x7ffa13f2ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2446 start_va = 0x7ffa14070000 end_va = 0x7ffa140cafff monitored = 0 entry_point = 0x7ffa140838b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2447 start_va = 0x7ffa14220000 end_va = 0x7ffa142c6fff monitored = 0 entry_point = 0x7ffa1422b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2448 start_va = 0x7ffa14340000 end_va = 0x7ffa145bcfff monitored = 0 entry_point = 0x7ffa14414970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2449 start_va = 0x7ffa145c0000 end_va = 0x7ffa146dbfff monitored = 0 entry_point = 0x7ffa146002b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2450 start_va = 0x7ffa146e0000 end_va = 0x7ffa1474afff monitored = 0 entry_point = 0x7ffa146f90c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2451 start_va = 0x7ffa147c0000 end_va = 0x7ffa14880fff monitored = 0 entry_point = 0x7ffa147e0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2452 start_va = 0x7ffa14ba0000 end_va = 0x7ffa14bf1fff monitored = 0 entry_point = 0x7ffa14baf530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2453 start_va = 0x7ffa14c00000 end_va = 0x7ffa15028fff monitored = 0 entry_point = 0x7ffa14c28740 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 2454 start_va = 0x7ffa15030000 end_va = 0x7ffa1508bfff monitored = 0 entry_point = 0x7ffa1504b720 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 2455 start_va = 0x7ffa15090000 end_va = 0x7ffa15136fff monitored = 0 entry_point = 0x7ffa150a58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2456 start_va = 0x7ffa15160000 end_va = 0x7ffa1520cfff monitored = 0 entry_point = 0x7ffa151781a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2457 start_va = 0x7ffa15210000 end_va = 0x7ffa1676efff monitored = 0 entry_point = 0x7ffa153711f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 2458 start_va = 0x7ffa16770000 end_va = 0x7ffa16930fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2610 start_va = 0x7500000 end_va = 0x75fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007500000" filename = "" Region: id = 2611 start_va = 0x7600000 end_va = 0x76fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007600000" filename = "" Region: id = 2612 start_va = 0x7700000 end_va = 0x77fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007700000" filename = "" Region: id = 2613 start_va = 0x7800000 end_va = 0x78fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007800000" filename = "" Region: id = 2614 start_va = 0x7900000 end_va = 0x79fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007900000" filename = "" Region: id = 2615 start_va = 0x7a00000 end_va = 0x7afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007a00000" filename = "" Region: id = 2665 start_va = 0x430000 end_va = 0x437fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 2666 start_va = 0x5e0000 end_va = 0x5e2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005e0000" filename = "" Region: id = 2670 start_va = 0x430000 end_va = 0x435fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 2672 start_va = 0x430000 end_va = 0x435fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 2673 start_va = 0x430000 end_va = 0x431fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 2682 start_va = 0x430000 end_va = 0x437fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 2683 start_va = 0x5e0000 end_va = 0x5e2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005e0000" filename = "" Region: id = 2685 start_va = 0x430000 end_va = 0x435fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 2686 start_va = 0x430000 end_va = 0x435fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 2687 start_va = 0x430000 end_va = 0x431fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 2691 start_va = 0x430000 end_va = 0x434fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 2788 start_va = 0x430000 end_va = 0x432fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 2789 start_va = 0x440000 end_va = 0x442fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 2796 start_va = 0x430000 end_va = 0x432fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 2808 start_va = 0x430000 end_va = 0x430fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 2811 start_va = 0x7b00000 end_va = 0x7bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007b00000" filename = "" Region: id = 2812 start_va = 0x7c00000 end_va = 0x7cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c00000" filename = "" Region: id = 2813 start_va = 0xd40000 end_va = 0xd60fff monitored = 0 entry_point = 0xd42300 region_type = mapped_file name = "sppc.dll" filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll") Region: id = 2814 start_va = 0x430000 end_va = 0x442fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sppc.dll.mui" filename = "\\Windows\\System32\\en-US\\sppc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\sppc.dll.mui") Region: id = 2815 start_va = 0xd40000 end_va = 0xd60fff monitored = 0 entry_point = 0xd42300 region_type = mapped_file name = "sppc.dll" filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll") Region: id = 2816 start_va = 0x430000 end_va = 0x442fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sppc.dll.mui" filename = "\\Windows\\System32\\en-US\\sppc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\sppc.dll.mui") Region: id = 2817 start_va = 0xd40000 end_va = 0xd60fff monitored = 0 entry_point = 0xd42300 region_type = mapped_file name = "sppc.dll" filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll") Region: id = 2818 start_va = 0x430000 end_va = 0x442fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sppc.dll.mui" filename = "\\Windows\\System32\\en-US\\sppc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\sppc.dll.mui") Region: id = 2819 start_va = 0x430000 end_va = 0x434fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 2820 start_va = 0x440000 end_va = 0x441fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Thread: id = 15 os_tid = 0x1214 Thread: id = 16 os_tid = 0x448 Thread: id = 17 os_tid = 0xd48 Thread: id = 18 os_tid = 0x660 Thread: id = 19 os_tid = 0xb4c Thread: id = 20 os_tid = 0xb0c Thread: id = 21 os_tid = 0x500 Thread: id = 22 os_tid = 0x7f8 Thread: id = 23 os_tid = 0x5a0 Thread: id = 24 os_tid = 0x828 Thread: id = 25 os_tid = 0x224 Thread: id = 26 os_tid = 0x230 Thread: id = 27 os_tid = 0x29c Thread: id = 28 os_tid = 0x46c Thread: id = 29 os_tid = 0x128 Thread: id = 30 os_tid = 0x618 Thread: id = 31 os_tid = 0x2f8 Thread: id = 32 os_tid = 0x388 Thread: id = 33 os_tid = 0x6f4 Thread: id = 34 os_tid = 0x384 Thread: id = 35 os_tid = 0x144 Thread: id = 36 os_tid = 0x254 Thread: id = 37 os_tid = 0x34c Thread: id = 38 os_tid = 0x238 Thread: id = 39 os_tid = 0xbe0 Thread: id = 40 os_tid = 0x804 Thread: id = 41 os_tid = 0x820 Thread: id = 42 os_tid = 0x824 Thread: id = 43 os_tid = 0x72c Thread: id = 44 os_tid = 0x32c Thread: id = 45 os_tid = 0xa84 Thread: id = 46 os_tid = 0x7a0 Thread: id = 47 os_tid = 0x7ac Thread: id = 48 os_tid = 0xac8 Thread: id = 49 os_tid = 0xa88 Thread: id = 50 os_tid = 0xa08 Thread: id = 51 os_tid = 0xad4 Thread: id = 52 os_tid = 0xaa4 Thread: id = 53 os_tid = 0xa98 Thread: id = 54 os_tid = 0xbb4 Thread: id = 55 os_tid = 0x668 Thread: id = 56 os_tid = 0x5ec Thread: id = 57 os_tid = 0x780 Thread: id = 58 os_tid = 0x5e0 Thread: id = 59 os_tid = 0x508 Thread: id = 60 os_tid = 0x4f8 Thread: id = 61 os_tid = 0x7e4 Thread: id = 62 os_tid = 0x7dc Thread: id = 63 os_tid = 0x7d8 Thread: id = 64 os_tid = 0x7cc Thread: id = 65 os_tid = 0x7b0 Thread: id = 66 os_tid = 0x788 Thread: id = 67 os_tid = 0x744 Thread: id = 68 os_tid = 0x448 Thread: id = 69 os_tid = 0x6f8 Thread: id = 70 os_tid = 0x6d4 Thread: id = 71 os_tid = 0x648 Thread: id = 72 os_tid = 0x640 Thread: id = 73 os_tid = 0x62c Thread: id = 74 os_tid = 0x534 Thread: id = 75 os_tid = 0x530 Thread: id = 76 os_tid = 0x4a8 Thread: id = 77 os_tid = 0x2ac Thread: id = 78 os_tid = 0x270 Thread: id = 79 os_tid = 0x154 Thread: id = 80 os_tid = 0x1b8 Thread: id = 81 os_tid = 0x1bc Thread: id = 82 os_tid = 0x180 Thread: id = 83 os_tid = 0x188 Thread: id = 84 os_tid = 0x148 Thread: id = 85 os_tid = 0x12c Thread: id = 86 os_tid = 0xfc Thread: id = 87 os_tid = 0x60 Thread: id = 88 os_tid = 0x3f0 Thread: id = 89 os_tid = 0x3e8 Thread: id = 90 os_tid = 0x364 Thread: id = 109 os_tid = 0x1334 Thread: id = 110 os_tid = 0x1338 Thread: id = 111 os_tid = 0x133c Thread: id = 112 os_tid = 0x1340 Thread: id = 113 os_tid = 0x1344 Thread: id = 114 os_tid = 0x1348 Thread: id = 128 os_tid = 0x108c Thread: id = 129 os_tid = 0x1088 Process: id = "3" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x5a74f000" os_pid = "0xbe8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x274" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:0005737e" [0xc000000f] Region: id = 2522 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2523 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2524 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2525 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2526 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 2527 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 2528 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 2529 start_va = 0x100000 end_va = 0x1bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2530 start_va = 0x1c0000 end_va = 0x1c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 2531 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 2532 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 2533 start_va = 0x1f0000 end_va = 0x1f4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 2534 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 2535 start_va = 0x480000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000480000" filename = "" Region: id = 2536 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2537 start_va = 0x550000 end_va = 0x550fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 2538 start_va = 0x560000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 2539 start_va = 0x660000 end_va = 0x7e7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000660000" filename = "" Region: id = 2540 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 2541 start_va = 0x800000 end_va = 0xb36fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2542 start_va = 0xb40000 end_va = 0xcc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b40000" filename = "" Region: id = 2543 start_va = 0xcd0000 end_va = 0xd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cd0000" filename = "" Region: id = 2544 start_va = 0xd50000 end_va = 0xe4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d50000" filename = "" Region: id = 2545 start_va = 0xe50000 end_va = 0xe50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e50000" filename = "" Region: id = 2546 start_va = 0xe60000 end_va = 0xedffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e60000" filename = "" Region: id = 2547 start_va = 0xee0000 end_va = 0xf5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ee0000" filename = "" Region: id = 2548 start_va = 0xf60000 end_va = 0xfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f60000" filename = "" Region: id = 2549 start_va = 0xfe0000 end_va = 0x105ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 2550 start_va = 0x1060000 end_va = 0x10dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001060000" filename = "" Region: id = 2551 start_va = 0x10e0000 end_va = 0x115ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010e0000" filename = "" Region: id = 2552 start_va = 0x1160000 end_va = 0x11dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001160000" filename = "" Region: id = 2553 start_va = 0x11f0000 end_va = 0x11f2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "security.dll" filename = "\\Windows\\System32\\security.dll" (normalized: "c:\\windows\\system32\\security.dll") Region: id = 2554 start_va = 0x1210000 end_va = 0x130ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001210000" filename = "" Region: id = 2555 start_va = 0x1310000 end_va = 0x1312fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cimwin32.dll.mui" filename = "\\Windows\\System32\\wbem\\en-US\\cimwin32.dll.mui" (normalized: "c:\\windows\\system32\\wbem\\en-us\\cimwin32.dll.mui") Region: id = 2556 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2557 start_va = 0x180000000 end_va = 0x180002fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wmi.dll" filename = "\\Windows\\System32\\wmi.dll" (normalized: "c:\\windows\\system32\\wmi.dll") Region: id = 2558 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 2559 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 2560 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 2561 start_va = 0x7ff7aedf0000 end_va = 0x7ff7aee6ffff monitored = 0 entry_point = 0x7ff7aee05f50 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 2562 start_va = 0x7ff9fbd40000 end_va = 0x7ff9fbd4dfff monitored = 0 entry_point = 0x7ff9fbd41da0 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 2563 start_va = 0x7ff9fc0c0000 end_va = 0x7ff9fc0cafff monitored = 0 entry_point = 0x7ff9fc0c12b0 region_type = mapped_file name = "schedcli.dll" filename = "\\Windows\\System32\\schedcli.dll" (normalized: "c:\\windows\\system32\\schedcli.dll") Region: id = 2564 start_va = 0x7ff9fc0d0000 end_va = 0x7ff9fc29efff monitored = 1 entry_point = 0x7ff9fc0f7df0 region_type = mapped_file name = "cimwin32.dll" filename = "\\Windows\\System32\\wbem\\cimwin32.dll" (normalized: "c:\\windows\\system32\\wbem\\cimwin32.dll") Region: id = 2565 start_va = 0x7ff9fdb40000 end_va = 0x7ff9fdb53fff monitored = 0 entry_point = 0x7ff9fdb41310 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\System32\\browcli.dll" (normalized: "c:\\windows\\system32\\browcli.dll") Region: id = 2566 start_va = 0x7ffa06830000 end_va = 0x7ffa06855fff monitored = 0 entry_point = 0x7ffa06831cf0 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2567 start_va = 0x7ffa07ad0000 end_va = 0x7ffa07ae5fff monitored = 0 entry_point = 0x7ffa07ad55e0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 2568 start_va = 0x7ffa07c90000 end_va = 0x7ffa07cb4fff monitored = 0 entry_point = 0x7ffa07c99900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 2569 start_va = 0x7ffa07cc0000 end_va = 0x7ffa07cd3fff monitored = 0 entry_point = 0x7ffa07cc1800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 2570 start_va = 0x7ffa07ce0000 end_va = 0x7ffa07dd5fff monitored = 0 entry_point = 0x7ffa07d19590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 2571 start_va = 0x7ffa08390000 end_va = 0x7ffa083a0fff monitored = 0 entry_point = 0x7ffa08392fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2572 start_va = 0x7ffa08a00000 end_va = 0x7ffa08a0bfff monitored = 0 entry_point = 0x7ffa08a035c0 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2573 start_va = 0x7ffa09490000 end_va = 0x7ffa0950efff monitored = 1 entry_point = 0x7ffa094a7110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 2574 start_va = 0x7ffa0afc0000 end_va = 0x7ffa0afd1fff monitored = 0 entry_point = 0x7ffa0afc3580 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 2575 start_va = 0x7ffa0b750000 end_va = 0x7ffa0b79dfff monitored = 0 entry_point = 0x7ffa0b761ce0 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 2576 start_va = 0x7ffa0c300000 end_va = 0x7ffa0c318fff monitored = 0 entry_point = 0x7ffa0c304520 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 2577 start_va = 0x7ffa0e880000 end_va = 0x7ffa0e895fff monitored = 0 entry_point = 0x7ffa0e881b60 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2578 start_va = 0x7ffa0f030000 end_va = 0x7ffa0f06dfff monitored = 0 entry_point = 0x7ffa0f03a050 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 2579 start_va = 0x7ffa0f3e0000 end_va = 0x7ffa0f3f0fff monitored = 0 entry_point = 0x7ffa0f3e3320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 2580 start_va = 0x7ffa0ff20000 end_va = 0x7ffa0ff29fff monitored = 0 entry_point = 0x7ffa0ff21660 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 2581 start_va = 0x7ffa11410000 end_va = 0x7ffa11422fff monitored = 0 entry_point = 0x7ffa11412760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 2582 start_va = 0x7ffa117d0000 end_va = 0x7ffa117f6fff monitored = 0 entry_point = 0x7ffa117d7940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 2583 start_va = 0x7ffa121a0000 end_va = 0x7ffa121abfff monitored = 0 entry_point = 0x7ffa121a27e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2584 start_va = 0x7ffa122e0000 end_va = 0x7ffa12359fff monitored = 0 entry_point = 0x7ffa12301a50 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 2585 start_va = 0x7ffa12a10000 end_va = 0x7ffa12a3cfff monitored = 0 entry_point = 0x7ffa12a29d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2586 start_va = 0x7ffa12ba0000 end_va = 0x7ffa12bf5fff monitored = 0 entry_point = 0x7ffa12bb0bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 2587 start_va = 0x7ffa12c20000 end_va = 0x7ffa12c48fff monitored = 0 entry_point = 0x7ffa12c34530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2588 start_va = 0x7ffa12db0000 end_va = 0x7ffa12dbffff monitored = 0 entry_point = 0x7ffa12db56e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 2589 start_va = 0x7ffa12dc0000 end_va = 0x7ffa12e0afff monitored = 0 entry_point = 0x7ffa12dc35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 2590 start_va = 0x7ffa12e10000 end_va = 0x7ffa12e1efff monitored = 0 entry_point = 0x7ffa12e13210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2591 start_va = 0x7ffa12f40000 end_va = 0x7ffa13106fff monitored = 0 entry_point = 0x7ffa12f9db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 2592 start_va = 0x7ffa13110000 end_va = 0x7ffa13126fff monitored = 0 entry_point = 0x7ffa13111390 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2593 start_va = 0x7ffa13130000 end_va = 0x7ffa13317fff monitored = 0 entry_point = 0x7ffa1315ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2594 start_va = 0x7ffa13320000 end_va = 0x7ffa13389fff monitored = 0 entry_point = 0x7ffa13356d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2595 start_va = 0x7ffa13390000 end_va = 0x7ffa133d2fff monitored = 0 entry_point = 0x7ffa133a4b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2596 start_va = 0x7ffa13cc0000 end_va = 0x7ffa13d5cfff monitored = 0 entry_point = 0x7ffa13cc78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2597 start_va = 0x7ffa13d80000 end_va = 0x7ffa13ed5fff monitored = 0 entry_point = 0x7ffa13d8a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2598 start_va = 0x7ffa13ee0000 end_va = 0x7ffa14065fff monitored = 0 entry_point = 0x7ffa13f2ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2599 start_va = 0x7ffa14070000 end_va = 0x7ffa140cafff monitored = 0 entry_point = 0x7ffa140838b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2600 start_va = 0x7ffa14220000 end_va = 0x7ffa142c6fff monitored = 0 entry_point = 0x7ffa1422b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2601 start_va = 0x7ffa14340000 end_va = 0x7ffa145bcfff monitored = 0 entry_point = 0x7ffa14414970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2602 start_va = 0x7ffa145c0000 end_va = 0x7ffa146dbfff monitored = 0 entry_point = 0x7ffa146002b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2603 start_va = 0x7ffa146e0000 end_va = 0x7ffa1474afff monitored = 0 entry_point = 0x7ffa146f90c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2604 start_va = 0x7ffa147c0000 end_va = 0x7ffa14880fff monitored = 0 entry_point = 0x7ffa147e0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2605 start_va = 0x7ffa15090000 end_va = 0x7ffa15136fff monitored = 0 entry_point = 0x7ffa150a58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2606 start_va = 0x7ffa15160000 end_va = 0x7ffa1520cfff monitored = 0 entry_point = 0x7ffa151781a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2607 start_va = 0x7ffa16770000 end_va = 0x7ffa16930fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2667 start_va = 0x400000 end_va = 0x402fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 2668 start_va = 0x410000 end_va = 0x417fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000410000" filename = "" Region: id = 2671 start_va = 0x420000 end_va = 0x425fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2681 start_va = 0x430000 end_va = 0x431fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 2692 start_va = 0x1320000 end_va = 0x141ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001320000" filename = "" Region: id = 2693 start_va = 0x440000 end_va = 0x455fff monitored = 0 entry_point = 0x450420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 2694 start_va = 0x460000 end_va = 0x462fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 2695 start_va = 0x440000 end_va = 0x455fff monitored = 0 entry_point = 0x450420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 2696 start_va = 0x460000 end_va = 0x462fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 2697 start_va = 0x440000 end_va = 0x455fff monitored = 0 entry_point = 0x450420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 2698 start_va = 0x460000 end_va = 0x462fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 2699 start_va = 0x440000 end_va = 0x455fff monitored = 0 entry_point = 0x450420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 2700 start_va = 0x460000 end_va = 0x462fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 2701 start_va = 0x440000 end_va = 0x459fff monitored = 1 entry_point = 0x441190 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 2702 start_va = 0x460000 end_va = 0x465fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 2703 start_va = 0x440000 end_va = 0x459fff monitored = 1 entry_point = 0x441190 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 2704 start_va = 0x460000 end_va = 0x465fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 2705 start_va = 0x440000 end_va = 0x442fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lsm.dll.mui" filename = "\\Windows\\System32\\en-US\\lsm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\lsm.dll.mui") Region: id = 2706 start_va = 0x1420000 end_va = 0x14dbfff monitored = 0 entry_point = 0x145c480 region_type = mapped_file name = "lsm.dll" filename = "\\Windows\\System32\\lsm.dll" (normalized: "c:\\windows\\system32\\lsm.dll") Region: id = 2707 start_va = 0x440000 end_va = 0x442fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lsm.dll.mui" filename = "\\Windows\\System32\\en-US\\lsm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\lsm.dll.mui") Region: id = 2708 start_va = 0x1420000 end_va = 0x14dbfff monitored = 0 entry_point = 0x145c480 region_type = mapped_file name = "lsm.dll" filename = "\\Windows\\System32\\lsm.dll" (normalized: "c:\\windows\\system32\\lsm.dll") Region: id = 2709 start_va = 0x440000 end_va = 0x46afff monitored = 0 entry_point = 0x45d000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 2710 start_va = 0x470000 end_va = 0x474fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 2711 start_va = 0x440000 end_va = 0x46afff monitored = 0 entry_point = 0x45d000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 2712 start_va = 0x470000 end_va = 0x474fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 2713 start_va = 0x440000 end_va = 0x46afff monitored = 0 entry_point = 0x45d000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 2714 start_va = 0x470000 end_va = 0x474fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 2715 start_va = 0x440000 end_va = 0x46afff monitored = 0 entry_point = 0x45d000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 2716 start_va = 0x470000 end_va = 0x474fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 2717 start_va = 0x440000 end_va = 0x45cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 2718 start_va = 0x1420000 end_va = 0x1486fff monitored = 0 entry_point = 0x14263e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2719 start_va = 0x440000 end_va = 0x45cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 2720 start_va = 0x1420000 end_va = 0x1486fff monitored = 0 entry_point = 0x14263e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2721 start_va = 0x440000 end_va = 0x45cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 2722 start_va = 0x1420000 end_va = 0x1486fff monitored = 0 entry_point = 0x14263e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2723 start_va = 0x440000 end_va = 0x45cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 2724 start_va = 0x1420000 end_va = 0x1486fff monitored = 0 entry_point = 0x14263e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2725 start_va = 0x440000 end_va = 0x45cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 2726 start_va = 0x1420000 end_va = 0x1486fff monitored = 0 entry_point = 0x14263e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2727 start_va = 0x440000 end_va = 0x45cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 2728 start_va = 0x1420000 end_va = 0x1486fff monitored = 0 entry_point = 0x14263e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2729 start_va = 0x440000 end_va = 0x45cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 2730 start_va = 0x1420000 end_va = 0x1486fff monitored = 0 entry_point = 0x14263e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2731 start_va = 0x440000 end_va = 0x45cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 2732 start_va = 0x1420000 end_va = 0x1486fff monitored = 0 entry_point = 0x14263e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2733 start_va = 0x440000 end_va = 0x45cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 2734 start_va = 0x1420000 end_va = 0x1486fff monitored = 0 entry_point = 0x14263e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2735 start_va = 0x440000 end_va = 0x45cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 2736 start_va = 0x1420000 end_va = 0x1486fff monitored = 0 entry_point = 0x14263e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2737 start_va = 0x440000 end_va = 0x45cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 2738 start_va = 0x1420000 end_va = 0x1486fff monitored = 0 entry_point = 0x14263e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2739 start_va = 0x440000 end_va = 0x45cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 2740 start_va = 0x1420000 end_va = 0x1486fff monitored = 0 entry_point = 0x14263e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2741 start_va = 0x440000 end_va = 0x45cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 2742 start_va = 0x1420000 end_va = 0x1486fff monitored = 0 entry_point = 0x14263e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2743 start_va = 0x440000 end_va = 0x45cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 2744 start_va = 0x1420000 end_va = 0x1486fff monitored = 0 entry_point = 0x14263e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2745 start_va = 0x440000 end_va = 0x45cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 2746 start_va = 0x1420000 end_va = 0x1486fff monitored = 0 entry_point = 0x14263e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2747 start_va = 0x440000 end_va = 0x45cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 2748 start_va = 0x1420000 end_va = 0x1486fff monitored = 0 entry_point = 0x14263e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2749 start_va = 0x440000 end_va = 0x45cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 2750 start_va = 0x1420000 end_va = 0x1486fff monitored = 0 entry_point = 0x14263e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2751 start_va = 0x440000 end_va = 0x45cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 2752 start_va = 0x1420000 end_va = 0x1486fff monitored = 0 entry_point = 0x14263e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2753 start_va = 0x440000 end_va = 0x45cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 2754 start_va = 0x1420000 end_va = 0x1486fff monitored = 0 entry_point = 0x14263e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2755 start_va = 0x440000 end_va = 0x45cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 2756 start_va = 0x1420000 end_va = 0x1486fff monitored = 0 entry_point = 0x14263e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2757 start_va = 0x440000 end_va = 0x45cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 2758 start_va = 0x1420000 end_va = 0x1486fff monitored = 0 entry_point = 0x14263e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2759 start_va = 0x440000 end_va = 0x45cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 2760 start_va = 0x1420000 end_va = 0x1486fff monitored = 0 entry_point = 0x14263e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2761 start_va = 0x440000 end_va = 0x45cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 2762 start_va = 0x1420000 end_va = 0x1486fff monitored = 0 entry_point = 0x14263e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2763 start_va = 0x440000 end_va = 0x45cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 2764 start_va = 0x1420000 end_va = 0x1486fff monitored = 0 entry_point = 0x14263e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2765 start_va = 0x440000 end_va = 0x443fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pnrpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\pnrpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\pnrpsvc.dll.mui") Region: id = 2766 start_va = 0x1420000 end_va = 0x1479fff monitored = 0 entry_point = 0x1465b00 region_type = mapped_file name = "pnrpsvc.dll" filename = "\\Windows\\System32\\pnrpsvc.dll" (normalized: "c:\\windows\\system32\\pnrpsvc.dll") Region: id = 2767 start_va = 0x440000 end_va = 0x443fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pnrpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\pnrpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\pnrpsvc.dll.mui") Region: id = 2768 start_va = 0x1420000 end_va = 0x1479fff monitored = 0 entry_point = 0x1465b00 region_type = mapped_file name = "pnrpsvc.dll" filename = "\\Windows\\System32\\pnrpsvc.dll" (normalized: "c:\\windows\\system32\\pnrpsvc.dll") Region: id = 2769 start_va = 0x440000 end_va = 0x440fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "azroles.dll.mui" filename = "\\Windows\\System32\\en-US\\azroles.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\azroles.dll.mui") Region: id = 2770 start_va = 0x1420000 end_va = 0x1501fff monitored = 0 entry_point = 0x147d100 region_type = mapped_file name = "azroles.dll" filename = "\\Windows\\System32\\azroles.dll" (normalized: "c:\\windows\\system32\\azroles.dll") Region: id = 2771 start_va = 0x440000 end_va = 0x440fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "azroles.dll.mui" filename = "\\Windows\\System32\\en-US\\azroles.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\azroles.dll.mui") Region: id = 2772 start_va = 0x1420000 end_va = 0x1501fff monitored = 0 entry_point = 0x147d100 region_type = mapped_file name = "azroles.dll" filename = "\\Windows\\System32\\azroles.dll" (normalized: "c:\\windows\\system32\\azroles.dll") Region: id = 2773 start_va = 0x440000 end_va = 0x468fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 2774 start_va = 0x1420000 end_va = 0x1503fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 2775 start_va = 0x440000 end_va = 0x468fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 2776 start_va = 0x1420000 end_va = 0x1503fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 2777 start_va = 0x440000 end_va = 0x445fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 2778 start_va = 0x1420000 end_va = 0x14b2fff monitored = 0 entry_point = 0x1499000 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 2779 start_va = 0x440000 end_va = 0x445fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 2780 start_va = 0x1420000 end_va = 0x14b2fff monitored = 0 entry_point = 0x1499000 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 2781 start_va = 0x440000 end_va = 0x445fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fvevol.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui") Region: id = 2782 start_va = 0x1420000 end_va = 0x14c0fff monitored = 0 entry_point = 0x14b3000 region_type = mapped_file name = "fvevol.sys" filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys") Region: id = 2786 start_va = 0x1420000 end_va = 0x161ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001420000" filename = "" Region: id = 2787 start_va = 0x7ffa0b9e0000 end_va = 0x7ffa0b9edfff monitored = 0 entry_point = 0x7ffa0b9e2b10 region_type = mapped_file name = "perfos.dll" filename = "\\Windows\\System32\\perfos.dll" (normalized: "c:\\windows\\system32\\perfos.dll") Thread: id = 91 os_tid = 0xd7c [0174.659] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x11dff60 | out: lpSystemTimeAsFileTime=0x11dff60*(dwLowDateTime=0x1f45bed5, dwHighDateTime=0x1d8a8f7)) [0174.661] free (_Block=0xd6f9a0) [0174.661] FreeLibrary (hLibModule=0x180000000) returned 1 [0174.664] free (_Block=0xd731c0) [0174.664] free (_Block=0xd6d320) [0174.664] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x11dff60 | out: lpSystemTimeAsFileTime=0x11dff60*(dwLowDateTime=0x1f45bed5, dwHighDateTime=0x1d8a8f7)) [0174.664] free (_Block=0xd76330) [0174.664] FreeLibrary (hLibModule=0x11f0000) returned 1 [0174.666] free (_Block=0xd6c9c0) [0174.667] free (_Block=0xd71ec0) [0174.667] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x11dff60 | out: lpSystemTimeAsFileTime=0x11dff60*(dwLowDateTime=0x1f45bed5, dwHighDateTime=0x1d8a8f7)) [0174.667] free (_Block=0xd76670) [0174.667] FreeLibrary (hLibModule=0x7ffa15160000) returned 1 [0174.667] free (_Block=0xd75780) [0174.667] free (_Block=0xd71970) [0174.667] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x11dff60 | out: lpSystemTimeAsFileTime=0x11dff60*(dwLowDateTime=0x1f45bed5, dwHighDateTime=0x1d8a8f7)) [0174.667] free (_Block=0xd6fa20) [0174.668] FreeLibrary (hLibModule=0x7ffa13110000) returned 1 [0174.677] free (_Block=0xd74e80) [0174.678] free (_Block=0xd71b00) [0174.678] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x11dff60 | out: lpSystemTimeAsFileTime=0x11dff60*(dwLowDateTime=0x1f481fc2, dwHighDateTime=0x1d8a8f7)) [0174.678] free (_Block=0xd76390) [0174.678] FreeLibrary (hLibModule=0x7ffa13390000) returned 1 [0174.678] free (_Block=0xd767f0) [0174.678] free (_Block=0xd71d80) [0174.678] WaitForSingleObjectEx (hHandle=0x260, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0177.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x11dff60 | out: lpSystemTimeAsFileTime=0x11dff60*(dwLowDateTime=0x20d95dd6, dwHighDateTime=0x1d8a8f7)) [0177.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x11dff68 | out: lpSystemTimeAsFileTime=0x11dff68*(dwLowDateTime=0x20d95dd6, dwHighDateTime=0x1d8a8f7)) [0177.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x11dff70 | out: lpSystemTimeAsFileTime=0x11dff70*(dwLowDateTime=0x20d95dd6, dwHighDateTime=0x1d8a8f7)) [0177.304] WaitForSingleObjectEx (hHandle=0x260, dwMilliseconds=0x493e0, bAlertable=0) returned 0x0 [0178.516] WaitForSingleObjectEx (hHandle=0x260, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.386] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x11dff60 | out: lpSystemTimeAsFileTime=0x11dff60*(dwLowDateTime=0x2347faab, dwHighDateTime=0x1d8a8f7)) [0181.386] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x11dff68 | out: lpSystemTimeAsFileTime=0x11dff68*(dwLowDateTime=0x2347faab, dwHighDateTime=0x1d8a8f7)) [0181.386] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x11dff70 | out: lpSystemTimeAsFileTime=0x11dff70*(dwLowDateTime=0x2347faab, dwHighDateTime=0x1d8a8f7)) [0181.386] WaitForSingleObjectEx (hHandle=0x260, dwMilliseconds=0x2710, bAlertable=0) returned 0x102 [0191.384] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x11dff60 | out: lpSystemTimeAsFileTime=0x11dff60*(dwLowDateTime=0x293ea8e1, dwHighDateTime=0x1d8a8f7)) [0191.384] free (_Block=0xd76190) [0191.384] FreeLibrary (hLibModule=0x7ffa16770000) returned 1 [0191.384] free (_Block=0xd770e0) [0191.385] free (_Block=0xd6d320) [0191.385] WaitForSingleObjectEx (hHandle=0x260, dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 92 os_tid = 0xd70 Thread: id = 93 os_tid = 0xd84 Thread: id = 94 os_tid = 0xd6c [0165.941] DllCanUnloadNow () returned 0x1 [0285.956] DllCanUnloadNow () returned 0x1 Thread: id = 95 os_tid = 0xd64 Thread: id = 96 os_tid = 0xd80 Thread: id = 97 os_tid = 0xd74 [0167.145] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0174.564] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0174.654] RtlRestoreLastWin32Error () returned 0x2d5000 [0174.654] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xede0f8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xeddff0 | out: pulNumLanguages=0xede0f8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xeddff0) returned 1 [0174.654] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x589fc0 [0174.654] RtlRestoreLastWin32Error () returned 0x2d5000 [0174.654] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xede0f8, pwszLanguagesBuffer=0x589fc0, pcchLanguagesBuffer=0xeddff0 | out: pulNumLanguages=0xede0f8, pwszLanguagesBuffer=0x589fc0, pcchLanguagesBuffer=0xeddff0) returned 1 [0174.654] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a0d0 [0174.654] RtlFreeHeap (HeapHandle=0x560000, Flags=0x0, BaseAddress=0x589fc0) returned 1 [0174.654] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x14) returned 0x5bd7c0 [0174.654] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x5bd7c0, pulNumLanguages=0xede0f8 | out: pulNumLanguages=0xede0f8) returned 1 [0174.654] RtlFreeHeap (HeapHandle=0x560000, Flags=0x0, BaseAddress=0x5bd7c0) returned 1 [0174.658] SetEvent (hEvent=0x260) returned 1 [0174.658] free (_Block=0xd720a0) [0174.658] GetCurrentThread () returned 0xfffffffffffffffe [0174.658] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0xedd660 | out: TokenHandle=0xedd660*=0x130) returned 1 [0174.658] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0xedd69c | out: lpLuid=0xedd69c*(LowPart=0x14, HighPart=0)) returned 1 [0174.681] RtlRestoreLastWin32Error () returned 0x2d5000 [0174.681] AdjustTokenPrivileges (in: TokenHandle=0x130, DisableAllPrivileges=0, NewState=0xedd698*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0174.681] GetLastError () returned 0x0 [0174.681] CloseHandle (hObject=0x130) returned 1 [0174.681] malloc (_Size=0x8000) returned 0xd791d0 [0174.681] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xd791d0, Length=0x8000, ResultLength=0x0 | out: SystemInformation=0xd791d0, ResultLength=0x0) returned 0xc0000004 [0174.682] free (_Block=0xd791d0) [0174.683] malloc (_Size=0x10000) returned 0xd791d0 [0174.685] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xd791d0, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0xd791d0, ResultLength=0x0) returned 0xc0000004 [0174.687] free (_Block=0xd791d0) [0174.687] malloc (_Size=0x18000) returned 0xd791d0 [0174.688] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xd791d0, Length=0x18000, ResultLength=0x0 | out: SystemInformation=0xd791d0, ResultLength=0x0) returned 0xc0000004 [0174.691] free (_Block=0xd791d0) [0174.691] malloc (_Size=0x20000) returned 0xd791d0 [0174.691] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xd791d0, Length=0x20000, ResultLength=0x0 | out: SystemInformation=0xd791d0, ResultLength=0x0) returned 0x0 [0174.693] _ui64tow_s (in: _Value=0x0, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="0") returned 0x0 [0174.698] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="0") returned 1 [0174.705] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x16792958, dwBuildNumber=0x7ffa, dwPlatformId=0x0, szCSDVersion="\n") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0174.705] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0174.722] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0174.722] CloseHandle (hObject=0x0) returned 0 [0174.722] _ui64tow_s (in: _Value=0x4, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="4") returned 0x0 [0174.726] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="4") returned 1 [0174.727] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0174.727] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0174.739] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0174.739] CloseHandle (hObject=0x0) returned 0 [0174.740] _ui64tow_s (in: _Value=0x138, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="312") returned 0x0 [0174.743] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="312") returned 3 [0174.744] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0174.744] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0174.757] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x138) returned 0x0 [0174.757] CloseHandle (hObject=0x0) returned 0 [0174.758] _ui64tow_s (in: _Value=0x184, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="388") returned 0x0 [0174.761] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="388") returned 3 [0174.762] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0174.762] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0174.774] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0174.774] CloseHandle (hObject=0x0) returned 0 [0174.775] _ui64tow_s (in: _Value=0x1c0, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="448") returned 0x0 [0174.779] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="448") returned 3 [0174.779] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0174.779] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0174.792] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1c0) returned 0x0 [0174.792] CloseHandle (hObject=0x0) returned 0 [0174.792] _ui64tow_s (in: _Value=0x1c8, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="456") returned 0x0 [0174.800] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="456") returned 3 [0174.801] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0174.801] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0174.814] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1c8) returned 0x0 [0174.814] CloseHandle (hObject=0x0) returned 0 [0174.814] _ui64tow_s (in: _Value=0x1fc, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="508") returned 0x0 [0174.817] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="508") returned 3 [0174.818] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0174.818] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0174.831] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1fc) returned 0x130 [0174.831] GetLastError () returned 0x0 [0174.831] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0174.831] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x389018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0174.831] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0174.831] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x591630, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0174.832] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x591340, lpBuffer=0xedc580, nSize=0x42, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0174.832] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0174.833] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0174.833] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x389020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0174.833] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x590d20, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0174.833] malloc (_Size=0x1c) returned 0xd76980 [0174.834] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x591382, lpBuffer=0xd76980, nSize=0x1a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd76980*, lpNumberOfBytesRead=0x0) returned 1 [0174.834] free (_Block=0xd76980) [0174.834] CloseHandle (hObject=0x130) returned 1 [0174.835] _ui64tow_s (in: _Value=0x214, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="532") returned 0x0 [0174.838] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="532") returned 3 [0174.839] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0174.839] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0174.852] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x214) returned 0x0 [0174.853] CloseHandle (hObject=0x0) returned 0 [0174.853] _ui64tow_s (in: _Value=0x21c, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="540") returned 0x0 [0174.857] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="540") returned 3 [0174.858] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0174.858] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0174.870] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x21c) returned 0x130 [0174.870] GetLastError () returned 0x0 [0174.870] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0174.870] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x345018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0174.870] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0174.870] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603240, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0174.871] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x602e98, lpBuffer=0xedc580, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0174.871] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0174.872] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0174.872] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x345020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0174.873] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x602880, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0174.873] malloc (_Size=0x3e) returned 0xd6c8d0 [0174.873] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x602ed4, lpBuffer=0xd6c8d0, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd6c8d0*, lpNumberOfBytesRead=0x0) returned 1 [0174.873] free (_Block=0xd6c8d0) [0174.874] CloseHandle (hObject=0x130) returned 1 [0174.874] _ui64tow_s (in: _Value=0x274, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="628") returned 0x0 [0174.878] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="628") returned 3 [0174.878] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0174.878] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0174.892] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x274) returned 0x130 [0174.892] GetLastError () returned 0x0 [0174.893] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0174.893] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3e3018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0174.893] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0174.893] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603370, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0174.893] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x602fd8, lpBuffer=0xedc580, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0174.894] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0174.895] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0174.895] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3e3020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0174.895] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x6029c0, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0174.895] malloc (_Size=0x5e) returned 0xd70570 [0174.895] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603018, lpBuffer=0xd70570, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd70570*, lpNumberOfBytesRead=0x0) returned 1 [0174.896] free (_Block=0xd70570) [0174.896] CloseHandle (hObject=0x130) returned 1 [0174.897] _ui64tow_s (in: _Value=0x294, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="660") returned 0x0 [0174.900] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="660") returned 3 [0174.901] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0174.901] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0174.915] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x294) returned 0x130 [0174.915] GetLastError () returned 0x0 [0174.915] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0174.915] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2e8018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0174.915] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0174.915] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4033e0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0174.915] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403058, lpBuffer=0xedc580, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0174.916] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0174.917] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0174.917] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2e8020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0174.917] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x402a40, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0174.917] malloc (_Size=0x54) returned 0xd77c40 [0174.917] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403098, lpBuffer=0xd77c40, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd77c40*, lpNumberOfBytesRead=0x0) returned 1 [0174.918] free (_Block=0xd77c40) [0174.919] CloseHandle (hObject=0x130) returned 1 [0174.920] _ui64tow_s (in: _Value=0x30c, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="780") returned 0x0 [0174.923] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="780") returned 3 [0174.924] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0174.924] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0174.936] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x30c) returned 0x130 [0174.936] GetLastError () returned 0x0 [0174.936] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0174.936] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x21e018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0174.936] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0174.936] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x421980, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0174.936] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x421678, lpBuffer=0xedc580, nSize=0x38, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0174.937] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0174.938] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0174.938] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x21e020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0174.938] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x421060, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0174.938] malloc (_Size=0x16) returned 0xd76350 [0174.938] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4216b0, lpBuffer=0xd76350, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd76350*, lpNumberOfBytesRead=0x0) returned 1 [0174.939] free (_Block=0xd76350) [0174.939] CloseHandle (hObject=0x130) returned 1 [0174.940] _ui64tow_s (in: _Value=0x360, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="864") returned 0x0 [0174.943] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="864") returned 3 [0174.944] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0174.944] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0174.956] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x360) returned 0x130 [0174.957] GetLastError () returned 0x0 [0174.957] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0174.957] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x21f018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0174.957] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0174.957] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603370, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0174.957] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x602fd8, lpBuffer=0xedc580, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0174.958] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0174.958] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0174.959] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x21f020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0174.959] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x6029c0, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0174.959] malloc (_Size=0x58) returned 0xd78240 [0174.959] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603018, lpBuffer=0xd78240, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd78240*, lpNumberOfBytesRead=0x0) returned 1 [0174.959] free (_Block=0xd78240) [0174.960] CloseHandle (hObject=0x130) returned 1 [0174.960] _ui64tow_s (in: _Value=0x378, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="888") returned 0x0 [0174.964] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="888") returned 3 [0174.965] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0174.965] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0174.977] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x378) returned 0x130 [0174.977] GetLastError () returned 0x0 [0174.977] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0174.977] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x334018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0174.977] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0174.978] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403400, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0174.978] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403058, lpBuffer=0xedc580, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0174.978] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0174.979] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0174.979] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x334020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0174.980] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x402a40, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0174.980] malloc (_Size=0x74) returned 0xd731c0 [0174.980] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403098, lpBuffer=0xd731c0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd731c0*, lpNumberOfBytesRead=0x0) returned 1 [0174.980] free (_Block=0xd731c0) [0174.981] CloseHandle (hObject=0x130) returned 1 [0174.982] _ui64tow_s (in: _Value=0x390, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="912") returned 0x0 [0174.986] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="912") returned 3 [0174.987] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0174.987] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.000] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x390) returned 0x130 [0175.000] GetLastError () returned 0x0 [0175.000] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.000] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x315018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.001] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.001] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603410, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.001] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603058, lpBuffer=0xedc580, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.001] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.002] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.002] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x315020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.002] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x602a40, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.003] malloc (_Size=0x84) returned 0xd731c0 [0175.003] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603098, lpBuffer=0xd731c0, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd731c0*, lpNumberOfBytesRead=0x0) returned 1 [0175.003] free (_Block=0xd731c0) [0175.004] CloseHandle (hObject=0x130) returned 1 [0175.004] _ui64tow_s (in: _Value=0x3a0, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="928") returned 0x0 [0175.008] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="928") returned 3 [0175.008] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.009] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.021] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3a0) returned 0x130 [0175.021] GetLastError () returned 0x0 [0175.021] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.022] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x37b018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.022] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.022] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403410, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.022] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403058, lpBuffer=0xedc580, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.023] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.024] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.024] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x37b020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.024] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x402a40, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.024] malloc (_Size=0x86) returned 0xd731c0 [0175.024] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403098, lpBuffer=0xd731c0, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd731c0*, lpNumberOfBytesRead=0x0) returned 1 [0175.025] free (_Block=0xd731c0) [0175.025] CloseHandle (hObject=0x130) returned 1 [0175.026] _ui64tow_s (in: _Value=0x3f4, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1012") returned 0x0 [0175.032] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1012") returned 4 [0175.033] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.033] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.045] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3f4) returned 0x130 [0175.045] GetLastError () returned 0x0 [0175.045] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.045] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x291018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.045] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.045] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x6033f0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.046] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603058, lpBuffer=0xedc580, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.046] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.047] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.047] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x291020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.048] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x602a40, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.048] malloc (_Size=0x62) returned 0xd6ff50 [0175.048] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603098, lpBuffer=0xd6ff50, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd6ff50*, lpNumberOfBytesRead=0x0) returned 1 [0175.048] free (_Block=0xd6ff50) [0175.049] CloseHandle (hObject=0x130) returned 1 [0175.049] _ui64tow_s (in: _Value=0x210, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="528") returned 0x0 [0175.052] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="528") returned 3 [0175.053] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.053] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.068] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x210) returned 0x130 [0175.068] GetLastError () returned 0x0 [0175.068] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.068] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2e4018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.068] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.068] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403390, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.068] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x402fd8, lpBuffer=0xedc580, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.069] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.070] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.070] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2e4020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.070] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4029c0, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.070] malloc (_Size=0x82) returned 0xd731c0 [0175.070] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403018, lpBuffer=0xd731c0, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd731c0*, lpNumberOfBytesRead=0x0) returned 1 [0175.071] free (_Block=0xd731c0) [0175.071] CloseHandle (hObject=0x130) returned 1 [0175.072] _ui64tow_s (in: _Value=0x460, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1120") returned 0x0 [0175.076] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1120") returned 4 [0175.077] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.077] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.089] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x460) returned 0x130 [0175.089] GetLastError () returned 0x0 [0175.089] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.090] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3c1018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.090] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.090] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x6033f0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.090] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603058, lpBuffer=0xedc580, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.091] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.092] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.092] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3c1020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.092] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x602a40, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.092] malloc (_Size=0x66) returned 0xd702d0 [0175.092] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603098, lpBuffer=0xd702d0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd702d0*, lpNumberOfBytesRead=0x0) returned 1 [0175.093] free (_Block=0xd702d0) [0175.093] CloseHandle (hObject=0x130) returned 1 [0175.094] _ui64tow_s (in: _Value=0x4e0, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1248") returned 0x0 [0175.097] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1248") returned 4 [0175.098] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.098] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.110] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4e0) returned 0x130 [0175.110] GetLastError () returned 0x0 [0175.110] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.110] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3a1018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.111] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.111] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x501b00, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.111] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5017a8, lpBuffer=0xedc580, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.112] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.112] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.112] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3a1020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.113] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x501190, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.113] malloc (_Size=0x42) returned 0xd6c9c0 [0175.113] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5017e8, lpBuffer=0xd6c9c0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd6c9c0*, lpNumberOfBytesRead=0x0) returned 1 [0175.113] free (_Block=0xd6c9c0) [0175.114] CloseHandle (hObject=0x130) returned 1 [0175.114] _ui64tow_s (in: _Value=0x54c, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1356") returned 0x0 [0175.117] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1356") returned 4 [0175.118] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.118] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.160] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x54c) returned 0x130 [0175.160] GetLastError () returned 0x0 [0175.160] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.160] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x207018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.161] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.161] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x571b70, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.161] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x571848, lpBuffer=0xedc580, nSize=0x3e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.162] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.163] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.163] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x207020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.163] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x571230, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.163] malloc (_Size=0x18) returned 0xd764f0 [0175.163] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x571886, lpBuffer=0xd764f0, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd764f0*, lpNumberOfBytesRead=0x0) returned 1 [0175.163] free (_Block=0xd764f0) [0175.164] CloseHandle (hObject=0x130) returned 1 [0175.165] _ui64tow_s (in: _Value=0x604, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1540") returned 0x0 [0175.169] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1540") returned 4 [0175.170] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.171] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.187] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x604) returned 0x130 [0175.187] GetLastError () returned 0x0 [0175.188] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.188] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3c2018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.188] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.188] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603430, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.188] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603078, lpBuffer=0xedc580, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.189] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.190] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.190] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3c2020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.191] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x602a60, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.191] malloc (_Size=0x64) returned 0xd702d0 [0175.191] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x6030c4, lpBuffer=0xd702d0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd702d0*, lpNumberOfBytesRead=0x0) returned 1 [0175.191] free (_Block=0xd702d0) [0175.192] CloseHandle (hObject=0x130) returned 1 [0175.193] _ui64tow_s (in: _Value=0x64c, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1612") returned 0x0 [0175.197] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1612") returned 4 [0175.199] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.199] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.217] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x64c) returned 0x130 [0175.217] GetLastError () returned 0x0 [0175.217] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.217] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x20d018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.217] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.217] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403370, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.218] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x402fd8, lpBuffer=0xedc580, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.218] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.220] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.220] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x20d020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.220] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4029c0, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.220] malloc (_Size=0x5a) returned 0xd70340 [0175.220] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403018, lpBuffer=0xd70340, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd70340*, lpNumberOfBytesRead=0x0) returned 1 [0175.221] free (_Block=0xd70340) [0175.221] CloseHandle (hObject=0x130) returned 1 [0175.222] _ui64tow_s (in: _Value=0x7b4, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1972") returned 0x0 [0175.226] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1972") returned 4 [0175.227] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.227] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.242] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7b4) returned 0x130 [0175.242] GetLastError () returned 0x0 [0175.243] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.243] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2f6018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.243] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.243] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x431be0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.243] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x431878, lpBuffer=0xedc580, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.244] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.245] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.245] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2f6020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.245] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x431260, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.246] malloc (_Size=0x32) returned 0xd71140 [0175.246] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4318a8, lpBuffer=0xd71140, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd71140*, lpNumberOfBytesRead=0x0) returned 1 [0175.246] free (_Block=0xd71140) [0175.247] CloseHandle (hObject=0x130) returned 1 [0175.248] _ui64tow_s (in: _Value=0x7ec, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="2028") returned 0x0 [0175.252] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="2028") returned 4 [0175.253] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.253] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.268] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7ec) returned 0x130 [0175.268] GetLastError () returned 0x0 [0175.268] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.268] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2bb018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.269] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.269] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4c1bf0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.269] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4c1848, lpBuffer=0xedc580, nSize=0x44, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.270] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.271] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.271] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2bb020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.271] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4c1230, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.271] malloc (_Size=0x6c) returned 0xd731c0 [0175.271] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4c188c, lpBuffer=0xd731c0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd731c0*, lpNumberOfBytesRead=0x0) returned 1 [0175.272] free (_Block=0xd731c0) [0175.272] CloseHandle (hObject=0x130) returned 1 [0175.273] _ui64tow_s (in: _Value=0x894, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="2196") returned 0x0 [0175.276] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="2196") returned 4 [0175.277] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.277] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.293] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x894) returned 0x130 [0175.293] GetLastError () returned 0x0 [0175.293] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.293] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2a8018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.294] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.295] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603710, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.296] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603278, lpBuffer=0xedc580, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.297] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.298] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.298] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2a8020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.298] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x602bf0, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.299] malloc (_Size=0x118) returned 0xd74e80 [0175.299] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603318, lpBuffer=0xd74e80, nSize=0x116, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0175.300] free (_Block=0xd74e80) [0175.301] CloseHandle (hObject=0x130) returned 1 [0175.301] _ui64tow_s (in: _Value=0x908, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="2312") returned 0x0 [0175.305] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="2312") returned 4 [0175.306] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.306] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.320] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x908) returned 0x130 [0175.320] GetLastError () returned 0x0 [0175.320] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.320] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3fd018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.321] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.321] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x6036b0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.321] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603234, lpBuffer=0xedc580, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.322] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.323] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.323] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3fd020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.323] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x602ba0, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.323] malloc (_Size=0x11a) returned 0xd74e80 [0175.323] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x6032ca, lpBuffer=0xd74e80, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0175.324] free (_Block=0xd74e80) [0175.324] CloseHandle (hObject=0x130) returned 1 [0175.325] _ui64tow_s (in: _Value=0x8d8, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="2264") returned 0x0 [0175.328] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="2264") returned 4 [0175.329] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.329] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.343] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8d8) returned 0x130 [0175.343] GetLastError () returned 0x0 [0175.343] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.343] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3b2018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.343] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.344] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403420, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.344] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403078, lpBuffer=0xedc580, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.345] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.346] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.346] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3b2020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.346] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x402a60, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.346] malloc (_Size=0x6a) returned 0xd731c0 [0175.346] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4030b8, lpBuffer=0xd731c0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd731c0*, lpNumberOfBytesRead=0x0) returned 1 [0175.347] free (_Block=0xd731c0) [0175.347] CloseHandle (hObject=0x130) returned 1 [0175.349] _ui64tow_s (in: _Value=0xb8c, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="2956") returned 0x0 [0175.353] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="2956") returned 4 [0175.353] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.353] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.366] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb8c) returned 0x0 [0175.366] CloseHandle (hObject=0x0) returned 0 [0175.367] _ui64tow_s (in: _Value=0x404, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1028") returned 0x0 [0175.371] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1028") returned 4 [0175.375] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.375] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.392] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x404) returned 0x130 [0175.392] GetLastError () returned 0x0 [0175.392] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.392] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3f8018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.392] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.392] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x571b10, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.392] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5717a8, lpBuffer=0xedc580, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.393] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.395] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.395] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3f8020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.395] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x571190, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.395] malloc (_Size=0x2c) returned 0xd70680 [0175.395] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5717fa, lpBuffer=0xd70680, nSize=0x2a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd70680*, lpNumberOfBytesRead=0x0) returned 1 [0175.396] free (_Block=0xd70680) [0175.396] CloseHandle (hObject=0x130) returned 1 [0175.444] _ui64tow_s (in: _Value=0x3b8, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="952") returned 0x0 [0175.449] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="952") returned 3 [0175.460] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x143cec4f, dwBuildNumber=0x7ffa, dwPlatformId=0xedcb30, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.460] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.477] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3b8) returned 0x130 [0175.477] GetLastError () returned 0x0 [0175.478] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.478] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x26a018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.478] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.478] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x551b60, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.478] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5517a8, lpBuffer=0xedc580, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.479] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.481] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.481] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x26a020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.481] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x551190, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.481] malloc (_Size=0x64) returned 0xd702d0 [0175.481] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5517f4, lpBuffer=0xd702d0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd702d0*, lpNumberOfBytesRead=0x0) returned 1 [0175.482] free (_Block=0xd702d0) [0175.483] CloseHandle (hObject=0x130) returned 1 [0175.483] _ui64tow_s (in: _Value=0x644, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1604") returned 0x0 [0175.487] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1604") returned 4 [0175.487] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.487] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.506] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x644) returned 0x130 [0175.506] GetLastError () returned 0x0 [0175.506] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.506] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x283018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.506] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.506] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5f1cc0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.506] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5f18d8, lpBuffer=0xedc580, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.507] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.508] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.508] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x283020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.508] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5f12c0, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.508] malloc (_Size=0x7e) returned 0xd767f0 [0175.508] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5f1938, lpBuffer=0xd767f0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0175.509] free (_Block=0xd767f0) [0175.510] CloseHandle (hObject=0x130) returned 1 [0175.511] _ui64tow_s (in: _Value=0x3b0, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="944") returned 0x0 [0175.516] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="944") returned 3 [0175.517] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.517] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.529] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3b0) returned 0x130 [0175.530] GetLastError () returned 0x0 [0175.530] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.530] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x455a018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.530] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.530] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4361dd0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.530] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4361988, lpBuffer=0xedc580, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.531] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.532] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.532] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x455a020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.532] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4361370, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.532] malloc (_Size=0xbc) returned 0xd767f0 [0175.532] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x43619f4, lpBuffer=0xd767f0, nSize=0xba, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0175.532] free (_Block=0xd767f0) [0175.533] CloseHandle (hObject=0x130) returned 1 [0175.534] _ui64tow_s (in: _Value=0x66c, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1644") returned 0x0 [0175.537] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1644") returned 4 [0175.538] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.538] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.555] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x66c) returned 0x130 [0175.555] GetLastError () returned 0x0 [0175.555] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.555] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3da018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.555] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.555] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x591ca0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.556] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x591888, lpBuffer=0xedc580, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.556] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.557] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.557] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3da020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.557] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x591270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.557] malloc (_Size=0x7e) returned 0xd767f0 [0175.557] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5918fe, lpBuffer=0xd767f0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0175.558] free (_Block=0xd767f0) [0175.559] CloseHandle (hObject=0x130) returned 1 [0175.559] _ui64tow_s (in: _Value=0x9d4, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="2516") returned 0x0 [0175.563] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="2516") returned 4 [0175.564] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.564] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.576] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9d4) returned 0x130 [0175.576] GetLastError () returned 0x0 [0175.576] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.576] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2cb018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.577] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.577] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4e1c70, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.577] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4e1888, lpBuffer=0xedc580, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.578] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.578] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.578] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2cb020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.579] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4e1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.579] malloc (_Size=0x70) returned 0xd767f0 [0175.579] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4e18f0, lpBuffer=0xd767f0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0175.579] free (_Block=0xd767f0) [0175.580] CloseHandle (hObject=0x130) returned 1 [0175.580] _ui64tow_s (in: _Value=0x14c, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="332") returned 0x0 [0175.584] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="332") returned 3 [0175.585] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.585] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.603] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14c) returned 0x130 [0175.603] GetLastError () returned 0x0 [0175.603] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.603] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x316018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.603] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.604] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5c1c90, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.604] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5c1888, lpBuffer=0xedc580, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.604] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.605] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.605] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x316020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.605] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5c1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.605] malloc (_Size=0x78) returned 0xd767f0 [0175.605] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5c18f8, lpBuffer=0xd767f0, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0175.606] free (_Block=0xd767f0) [0175.608] CloseHandle (hObject=0x130) returned 1 [0175.609] _ui64tow_s (in: _Value=0x5e4, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1508") returned 0x0 [0175.615] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1508") returned 4 [0175.616] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.616] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.628] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5e4) returned 0x130 [0175.628] GetLastError () returned 0x0 [0175.628] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.628] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x39a018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.628] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.629] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a1c40, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.629] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a1888, lpBuffer=0xedc580, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.629] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.630] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.630] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x39a020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.630] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.631] malloc (_Size=0x60) returned 0xd70500 [0175.631] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a18e0, lpBuffer=0xd70500, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd70500*, lpNumberOfBytesRead=0x0) returned 1 [0175.631] free (_Block=0xd70500) [0175.632] CloseHandle (hObject=0x130) returned 1 [0175.632] _ui64tow_s (in: _Value=0x79c, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1948") returned 0x0 [0175.636] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1948") returned 4 [0175.637] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.637] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.654] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x79c) returned 0x130 [0175.654] GetLastError () returned 0x0 [0175.654] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.654] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x333018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.654] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.654] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x431c30, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.654] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x431888, lpBuffer=0xedc580, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.655] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.656] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.656] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x333020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.656] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x431270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.656] malloc (_Size=0x58) returned 0xd77d00 [0175.656] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4318d8, lpBuffer=0xd77d00, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd77d00*, lpNumberOfBytesRead=0x0) returned 1 [0175.657] free (_Block=0xd77d00) [0175.657] CloseHandle (hObject=0x130) returned 1 [0175.658] _ui64tow_s (in: _Value=0x440, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1088") returned 0x0 [0175.662] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1088") returned 4 [0175.663] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.663] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.676] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x440) returned 0x130 [0175.677] GetLastError () returned 0x0 [0175.677] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.677] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3e7018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.677] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.677] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5b1ca0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.677] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5b1888, lpBuffer=0xedc580, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.678] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.679] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.679] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3e7020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.679] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5b1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.679] malloc (_Size=0x7e) returned 0xd767f0 [0175.679] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5b18fe, lpBuffer=0xd767f0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0175.680] free (_Block=0xd767f0) [0175.680] CloseHandle (hObject=0x130) returned 1 [0175.680] _ui64tow_s (in: _Value=0xc08, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3080") returned 0x0 [0175.688] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3080") returned 4 [0175.689] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.689] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.702] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc08) returned 0x130 [0175.702] GetLastError () returned 0x0 [0175.702] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.702] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x27e018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.703] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.703] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x561c90, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.703] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x561888, lpBuffer=0xedc580, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.704] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.705] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.705] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x27e020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.705] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x561270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.705] malloc (_Size=0x78) returned 0xd767f0 [0175.705] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5618f8, lpBuffer=0xd767f0, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0175.706] free (_Block=0xd767f0) [0175.706] CloseHandle (hObject=0x130) returned 1 [0175.707] _ui64tow_s (in: _Value=0xc10, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3088") returned 0x0 [0175.711] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3088") returned 4 [0175.712] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.712] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.727] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc10) returned 0x130 [0175.727] GetLastError () returned 0x0 [0175.727] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.728] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2e7018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.728] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.728] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5e1c60, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.728] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5e1888, lpBuffer=0xedc580, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.729] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.730] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.730] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2e7020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.730] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5e1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.730] malloc (_Size=0x68) returned 0xd702d0 [0175.730] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5e18e8, lpBuffer=0xd702d0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd702d0*, lpNumberOfBytesRead=0x0) returned 1 [0175.731] free (_Block=0xd702d0) [0175.738] CloseHandle (hObject=0x130) returned 1 [0175.738] _ui64tow_s (in: _Value=0xc18, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3096") returned 0x0 [0175.742] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3096") returned 4 [0175.743] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.743] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.758] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc18) returned 0x130 [0175.758] GetLastError () returned 0x0 [0175.758] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.758] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5cb018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.758] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.758] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x251c70, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.759] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x251888, lpBuffer=0xedc580, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.759] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.760] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.760] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5cb020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.761] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x251270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.761] malloc (_Size=0x6c) returned 0xd767f0 [0175.761] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2518ec, lpBuffer=0xd767f0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0175.761] free (_Block=0xd767f0) [0175.763] CloseHandle (hObject=0x130) returned 1 [0175.763] _ui64tow_s (in: _Value=0xc20, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3104") returned 0x0 [0175.767] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3104") returned 4 [0175.768] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.768] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.786] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc20) returned 0x130 [0175.786] GetLastError () returned 0x0 [0175.787] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.787] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3bf018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.787] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.787] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x451c90, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.787] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x451888, lpBuffer=0xedc580, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.788] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.789] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.789] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3bf020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.789] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x451270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.789] malloc (_Size=0x76) returned 0xd767f0 [0175.789] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4518f6, lpBuffer=0xd767f0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0175.790] free (_Block=0xd767f0) [0175.791] CloseHandle (hObject=0x130) returned 1 [0175.791] _ui64tow_s (in: _Value=0xc28, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3112") returned 0x0 [0175.796] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3112") returned 4 [0175.797] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.797] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.811] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc28) returned 0x130 [0175.811] GetLastError () returned 0x0 [0175.811] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.811] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x289018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.811] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.811] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x531c30, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.812] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x531888, lpBuffer=0xedc580, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.812] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.813] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.814] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x289020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.814] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x531270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.814] malloc (_Size=0x5a) returned 0xd70340 [0175.814] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5318da, lpBuffer=0xd70340, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd70340*, lpNumberOfBytesRead=0x0) returned 1 [0175.815] free (_Block=0xd70340) [0175.815] CloseHandle (hObject=0x130) returned 1 [0175.816] _ui64tow_s (in: _Value=0xc30, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3120") returned 0x0 [0175.820] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3120") returned 4 [0175.821] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.821] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.843] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc30) returned 0x130 [0175.843] GetLastError () returned 0x0 [0175.843] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.843] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3fb018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.844] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.844] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5a1ca0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.844] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5a1888, lpBuffer=0xedc580, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.845] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.846] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.846] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3fb020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.846] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5a1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.846] malloc (_Size=0x7e) returned 0xd767f0 [0175.846] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5a18fe, lpBuffer=0xd767f0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0175.847] free (_Block=0xd767f0) [0175.847] CloseHandle (hObject=0x130) returned 1 [0175.848] _ui64tow_s (in: _Value=0xc38, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3128") returned 0x0 [0175.852] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3128") returned 4 [0175.853] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.853] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.867] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc38) returned 0x130 [0175.867] GetLastError () returned 0x0 [0175.867] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.867] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x317018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.867] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.868] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a1c50, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.868] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a1888, lpBuffer=0xedc580, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.868] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.870] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.870] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x317020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.870] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.870] malloc (_Size=0x62) returned 0xd70500 [0175.870] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a18e2, lpBuffer=0xd70500, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd70500*, lpNumberOfBytesRead=0x0) returned 1 [0175.870] free (_Block=0xd70500) [0175.871] CloseHandle (hObject=0x130) returned 1 [0175.891] _ui64tow_s (in: _Value=0xc40, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3136") returned 0x0 [0175.895] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3136") returned 4 [0175.896] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.896] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.910] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc40) returned 0x130 [0175.910] GetLastError () returned 0x0 [0175.910] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.910] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x27c018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.910] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.911] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x501cd0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.911] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x501888, lpBuffer=0xedc580, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.911] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.913] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.913] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x27c020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.913] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x501270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.913] malloc (_Size=0x8c) returned 0xd767f0 [0175.913] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x50190c, lpBuffer=0xd767f0, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0175.914] free (_Block=0xd767f0) [0175.914] CloseHandle (hObject=0x130) returned 1 [0175.915] _ui64tow_s (in: _Value=0xc4c, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3148") returned 0x0 [0175.919] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3148") returned 4 [0175.920] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.921] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.943] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc4c) returned 0x130 [0175.943] GetLastError () returned 0x0 [0175.944] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.944] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x244018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.944] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.944] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x561cf0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.944] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x561888, lpBuffer=0xedc580, nSize=0x90, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.945] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.946] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.946] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x244020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.946] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x561270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.947] malloc (_Size=0x98) returned 0xd767f0 [0175.947] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x561918, lpBuffer=0xd767f0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0175.947] free (_Block=0xd767f0) [0175.948] CloseHandle (hObject=0x130) returned 1 [0175.948] _ui64tow_s (in: _Value=0xdc0, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3520") returned 0x0 [0175.953] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3520") returned 4 [0175.954] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.954] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.969] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdc0) returned 0x130 [0175.969] GetLastError () returned 0x0 [0175.969] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.969] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x564018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.969] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.969] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x371c90, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.969] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x371888, lpBuffer=0xedc580, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.970] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.971] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.971] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x564020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.971] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x371270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.971] malloc (_Size=0x7a) returned 0xd767f0 [0175.971] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3718fa, lpBuffer=0xd767f0, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0175.972] free (_Block=0xd767f0) [0175.972] CloseHandle (hObject=0x130) returned 1 [0175.973] _ui64tow_s (in: _Value=0xdc8, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3528") returned 0x0 [0175.976] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3528") returned 4 [0175.977] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.977] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0175.993] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdc8) returned 0x130 [0175.993] GetLastError () returned 0x0 [0175.993] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0175.993] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x395018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0175.993] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0175.993] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x581c20, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0175.993] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x581888, lpBuffer=0xedc580, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0175.994] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0175.995] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0175.995] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x395020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0175.995] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x581270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0175.995] malloc (_Size=0x54) returned 0xd782a0 [0175.995] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5818d4, lpBuffer=0xd782a0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd782a0*, lpNumberOfBytesRead=0x0) returned 1 [0175.995] free (_Block=0xd782a0) [0175.996] CloseHandle (hObject=0x130) returned 1 [0175.997] _ui64tow_s (in: _Value=0xdd0, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3536") returned 0x0 [0176.000] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3536") returned 4 [0176.001] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.001] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.023] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdd0) returned 0x130 [0176.023] GetLastError () returned 0x0 [0176.023] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.023] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2a8018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.023] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.023] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x521c80, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.024] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x521888, lpBuffer=0xedc580, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.024] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.025] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.025] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2a8020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.026] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x521270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.026] malloc (_Size=0x72) returned 0xd767f0 [0176.026] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5218f2, lpBuffer=0xd767f0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0176.026] free (_Block=0xd767f0) [0176.027] CloseHandle (hObject=0x130) returned 1 [0176.027] _ui64tow_s (in: _Value=0xdd8, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3544") returned 0x0 [0176.043] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3544") returned 4 [0176.044] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.044] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.060] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdd8) returned 0x130 [0176.060] GetLastError () returned 0x0 [0176.060] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.060] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5ef018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.060] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.061] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1e1c90, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.061] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1e1888, lpBuffer=0xedc580, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.061] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.063] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.063] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5ef020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.063] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1e1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.063] malloc (_Size=0x78) returned 0xd767f0 [0176.063] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1e18f8, lpBuffer=0xd767f0, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0176.064] free (_Block=0xd767f0) [0176.065] CloseHandle (hObject=0x130) returned 1 [0176.066] _ui64tow_s (in: _Value=0xde0, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3552") returned 0x0 [0176.072] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3552") returned 4 [0176.073] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.073] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.102] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xde0) returned 0x130 [0176.102] GetLastError () returned 0x0 [0176.102] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.102] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x32a018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.103] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.103] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a1ca0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.103] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a1888, lpBuffer=0xedc580, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.104] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.104] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.105] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x32a020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.105] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.105] malloc (_Size=0x7e) returned 0xd767f0 [0176.105] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a18fe, lpBuffer=0xd767f0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0176.105] free (_Block=0xd767f0) [0176.106] CloseHandle (hObject=0x130) returned 1 [0176.106] _ui64tow_s (in: _Value=0xde8, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3560") returned 0x0 [0176.110] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3560") returned 4 [0176.110] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.111] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.148] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xde8) returned 0x130 [0176.149] GetLastError () returned 0x0 [0176.149] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.149] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2d2018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.149] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.149] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4b1c40, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.149] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4b1888, lpBuffer=0xedc580, nSize=0x54, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.150] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.151] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.151] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2d2020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.151] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4b1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.151] malloc (_Size=0x5c) returned 0xd6ff50 [0176.152] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4b18dc, lpBuffer=0xd6ff50, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd6ff50*, lpNumberOfBytesRead=0x0) returned 1 [0176.152] free (_Block=0xd6ff50) [0176.159] CloseHandle (hObject=0x130) returned 1 [0176.160] _ui64tow_s (in: _Value=0xdf0, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3568") returned 0x0 [0176.164] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3568") returned 4 [0176.165] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.165] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.180] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdf0) returned 0x130 [0176.180] GetLastError () returned 0x0 [0176.180] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.180] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3d5018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.180] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.180] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x471c50, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.181] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x471888, lpBuffer=0xedc580, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.181] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.182] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.183] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3d5020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.183] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x471270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.183] malloc (_Size=0x64) returned 0xd70570 [0176.183] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4718e4, lpBuffer=0xd70570, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd70570*, lpNumberOfBytesRead=0x0) returned 1 [0176.184] free (_Block=0xd70570) [0176.185] CloseHandle (hObject=0x130) returned 1 [0176.185] _ui64tow_s (in: _Value=0xdf8, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3576") returned 0x0 [0176.189] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3576") returned 4 [0176.190] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.190] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.206] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdf8) returned 0x130 [0176.206] GetLastError () returned 0x0 [0176.206] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.206] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x365018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.206] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.206] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x511c60, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.206] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x511888, lpBuffer=0xedc580, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.207] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.208] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.208] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x365020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.208] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x511270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.208] malloc (_Size=0x68) returned 0xd702d0 [0176.208] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5118e8, lpBuffer=0xd702d0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd702d0*, lpNumberOfBytesRead=0x0) returned 1 [0176.209] free (_Block=0xd702d0) [0176.209] CloseHandle (hObject=0x130) returned 1 [0176.210] _ui64tow_s (in: _Value=0xe00, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3584") returned 0x0 [0176.214] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3584") returned 4 [0176.215] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.215] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.232] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe00) returned 0x130 [0176.232] GetLastError () returned 0x0 [0176.232] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.232] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x313018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.232] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.233] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4f1c80, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.233] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4f1888, lpBuffer=0xedc580, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.234] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.235] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.235] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x313020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.235] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4f1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.235] malloc (_Size=0x74) returned 0xd767f0 [0176.235] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4f18f4, lpBuffer=0xd767f0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0176.236] free (_Block=0xd767f0) [0176.236] CloseHandle (hObject=0x130) returned 1 [0176.237] _ui64tow_s (in: _Value=0xe08, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3592") returned 0x0 [0176.241] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3592") returned 4 [0176.241] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.241] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.259] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe08) returned 0x130 [0176.259] GetLastError () returned 0x0 [0176.259] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.259] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x200018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.260] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.260] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x471c90, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.260] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x471888, lpBuffer=0xedc580, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.260] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.261] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.261] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x200020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.261] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x471270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.262] malloc (_Size=0x78) returned 0xd767f0 [0176.262] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4718f8, lpBuffer=0xd767f0, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0176.262] free (_Block=0xd767f0) [0176.263] CloseHandle (hObject=0x130) returned 1 [0176.263] _ui64tow_s (in: _Value=0xe10, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3600") returned 0x0 [0176.266] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3600") returned 4 [0176.267] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.267] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.279] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe10) returned 0x130 [0176.280] GetLastError () returned 0x0 [0176.280] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.280] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x288018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.280] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.280] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0xd1c40, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.280] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0xd1888, lpBuffer=0xedc580, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.282] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.283] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.283] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x288020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.283] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0xd1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.283] malloc (_Size=0x5e) returned 0xd702d0 [0176.283] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0xd18de, lpBuffer=0xd702d0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd702d0*, lpNumberOfBytesRead=0x0) returned 1 [0176.284] free (_Block=0xd702d0) [0176.284] CloseHandle (hObject=0x130) returned 1 [0176.285] _ui64tow_s (in: _Value=0xe18, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3608") returned 0x0 [0176.288] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3608") returned 4 [0176.289] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.289] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.305] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe18) returned 0x130 [0176.305] GetLastError () returned 0x0 [0176.305] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.305] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x393018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.305] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.305] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x6e1c90, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.305] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x6e1888, lpBuffer=0xedc580, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.306] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.307] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.307] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x393020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.307] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x6e1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.307] malloc (_Size=0x76) returned 0xd767f0 [0176.307] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x6e18f6, lpBuffer=0xd767f0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0176.308] free (_Block=0xd767f0) [0176.308] CloseHandle (hObject=0x130) returned 1 [0176.333] _ui64tow_s (in: _Value=0xe20, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3616") returned 0x0 [0176.337] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3616") returned 4 [0176.338] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.338] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.350] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe20) returned 0x130 [0176.350] GetLastError () returned 0x0 [0176.350] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.350] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2c9018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.350] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.351] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x471c60, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.351] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x471888, lpBuffer=0xedc580, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.351] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.352] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.352] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2c9020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.352] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x471270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.352] malloc (_Size=0x68) returned 0xd6ff50 [0176.353] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4718e8, lpBuffer=0xd6ff50, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd6ff50*, lpNumberOfBytesRead=0x0) returned 1 [0176.353] free (_Block=0xd6ff50) [0176.354] CloseHandle (hObject=0x130) returned 1 [0176.354] _ui64tow_s (in: _Value=0xe28, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3624") returned 0x0 [0176.362] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3624") returned 4 [0176.363] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.363] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.376] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe28) returned 0x130 [0176.376] GetLastError () returned 0x0 [0176.376] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.376] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x25c018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.376] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.376] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x561c90, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.376] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x561888, lpBuffer=0xedc580, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.377] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.378] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.378] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x25c020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.378] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x561270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.378] malloc (_Size=0x7a) returned 0xd767f0 [0176.378] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5618fa, lpBuffer=0xd767f0, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0176.379] free (_Block=0xd767f0) [0176.380] CloseHandle (hObject=0x130) returned 1 [0176.380] _ui64tow_s (in: _Value=0xe30, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3632") returned 0x0 [0176.384] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3632") returned 4 [0176.384] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.385] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.397] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe30) returned 0x130 [0176.397] GetLastError () returned 0x0 [0176.397] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.397] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x21e018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.397] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.397] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a1c80, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.397] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a1888, lpBuffer=0xedc580, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.398] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.399] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.399] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x21e020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.399] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.399] malloc (_Size=0x74) returned 0xd767f0 [0176.399] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a18f4, lpBuffer=0xd767f0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0176.400] free (_Block=0xd767f0) [0176.400] CloseHandle (hObject=0x130) returned 1 [0176.401] _ui64tow_s (in: _Value=0xe38, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3640") returned 0x0 [0176.413] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3640") returned 4 [0176.414] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.414] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.436] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe38) returned 0x130 [0176.436] GetLastError () returned 0x0 [0176.436] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.436] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x34a018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.436] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.436] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x461c90, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.436] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x461888, lpBuffer=0xedc580, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.437] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.438] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.438] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x34a020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.438] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x461270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.438] malloc (_Size=0x78) returned 0xd767f0 [0176.438] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4618f8, lpBuffer=0xd767f0, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0176.439] free (_Block=0xd767f0) [0176.439] CloseHandle (hObject=0x130) returned 1 [0176.439] _ui64tow_s (in: _Value=0xe40, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3648") returned 0x0 [0176.443] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3648") returned 4 [0176.444] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.444] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.456] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe40) returned 0x130 [0176.456] GetLastError () returned 0x0 [0176.456] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.456] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x38c018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.457] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.457] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1d1c60, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.457] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1d1888, lpBuffer=0xedc580, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.457] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.458] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.458] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x38c020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.458] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1d1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.459] malloc (_Size=0x66) returned 0xd702d0 [0176.459] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1d18e6, lpBuffer=0xd702d0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd702d0*, lpNumberOfBytesRead=0x0) returned 1 [0176.459] free (_Block=0xd702d0) [0176.460] CloseHandle (hObject=0x130) returned 1 [0176.460] _ui64tow_s (in: _Value=0xe48, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3656") returned 0x0 [0176.464] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3656") returned 4 [0176.480] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.480] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.503] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe48) returned 0x130 [0176.503] GetLastError () returned 0x0 [0176.503] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.503] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3a3018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.503] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.504] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x461cb0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.504] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4618e8, lpBuffer=0xedc580, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.505] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.506] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.506] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3a3020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.506] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4612d0, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.506] malloc (_Size=0x62) returned 0xd70500 [0176.506] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x461942, lpBuffer=0xd70500, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd70500*, lpNumberOfBytesRead=0x0) returned 1 [0176.507] free (_Block=0xd70500) [0176.507] CloseHandle (hObject=0x130) returned 1 [0176.508] _ui64tow_s (in: _Value=0xe50, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3664") returned 0x0 [0176.513] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3664") returned 4 [0176.514] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.514] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.532] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe50) returned 0x130 [0176.532] GetLastError () returned 0x0 [0176.533] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.533] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x353018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.533] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.533] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4d1c70, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.533] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4d1888, lpBuffer=0xedc580, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.534] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.535] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.535] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x353020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.535] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4d1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.535] malloc (_Size=0x6c) returned 0xd767f0 [0176.535] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4d18ec, lpBuffer=0xd767f0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0176.536] free (_Block=0xd767f0) [0176.537] CloseHandle (hObject=0x130) returned 1 [0176.537] _ui64tow_s (in: _Value=0xe58, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3672") returned 0x0 [0176.541] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3672") returned 4 [0176.542] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.543] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.556] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe58) returned 0x130 [0176.556] GetLastError () returned 0x0 [0176.557] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.557] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x37b018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.557] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.557] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5e1c60, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.557] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5e1888, lpBuffer=0xedc580, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.558] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.559] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.559] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x37b020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.559] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5e1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.559] malloc (_Size=0x6a) returned 0xd767f0 [0176.559] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5e18ea, lpBuffer=0xd767f0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0176.560] free (_Block=0xd767f0) [0176.560] CloseHandle (hObject=0x130) returned 1 [0176.561] _ui64tow_s (in: _Value=0xe60, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3680") returned 0x0 [0176.564] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3680") returned 4 [0176.565] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.566] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.589] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe60) returned 0x130 [0176.589] GetLastError () returned 0x0 [0176.590] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.590] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x20e018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.590] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.590] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a1c50, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.590] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a1888, lpBuffer=0xedc580, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.591] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.592] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.592] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x20e020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.592] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.593] malloc (_Size=0x62) returned 0xd702d0 [0176.593] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a18e2, lpBuffer=0xd702d0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd702d0*, lpNumberOfBytesRead=0x0) returned 1 [0176.593] free (_Block=0xd702d0) [0176.594] CloseHandle (hObject=0x130) returned 1 [0176.594] _ui64tow_s (in: _Value=0xe68, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3688") returned 0x0 [0176.598] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3688") returned 4 [0176.599] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.599] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.614] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe68) returned 0x130 [0176.614] GetLastError () returned 0x0 [0176.614] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.614] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x305018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.615] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.615] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x501c80, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.615] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x501888, lpBuffer=0xedc580, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.616] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.617] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.617] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x305020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.617] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x501270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.617] malloc (_Size=0x72) returned 0xd767f0 [0176.617] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5018f2, lpBuffer=0xd767f0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0176.618] free (_Block=0xd767f0) [0176.619] CloseHandle (hObject=0x130) returned 1 [0176.619] _ui64tow_s (in: _Value=0xe70, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3696") returned 0x0 [0176.628] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3696") returned 4 [0176.629] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.629] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.647] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe70) returned 0x130 [0176.647] GetLastError () returned 0x0 [0176.647] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.647] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4bb018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.647] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.648] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x271c70, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.648] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x271888, lpBuffer=0xedc580, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.649] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.650] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.650] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4bb020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.650] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x271270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.650] malloc (_Size=0x70) returned 0xd767f0 [0176.651] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2718f0, lpBuffer=0xd767f0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0176.651] free (_Block=0xd767f0) [0176.652] CloseHandle (hObject=0x130) returned 1 [0176.653] _ui64tow_s (in: _Value=0xe78, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3704") returned 0x0 [0176.658] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3704") returned 4 [0176.659] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.659] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.680] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe78) returned 0x130 [0176.680] GetLastError () returned 0x0 [0176.680] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.680] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x28e018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.680] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.680] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x491c60, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.681] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x491888, lpBuffer=0xedc580, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.681] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.682] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.682] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x28e020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.682] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x491270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.683] malloc (_Size=0x6a) returned 0xd767f0 [0176.683] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4918ea, lpBuffer=0xd767f0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0176.684] free (_Block=0xd767f0) [0176.684] CloseHandle (hObject=0x130) returned 1 [0176.685] _ui64tow_s (in: _Value=0xe80, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3712") returned 0x0 [0176.689] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3712") returned 4 [0176.690] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.690] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.704] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe80) returned 0x130 [0176.704] GetLastError () returned 0x0 [0176.705] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.705] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3f4018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.705] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.705] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5d1c80, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.705] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5d1888, lpBuffer=0xedc580, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.706] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.707] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.707] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3f4020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.707] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5d1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.708] malloc (_Size=0x72) returned 0xd767f0 [0176.708] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5d18f2, lpBuffer=0xd767f0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0176.708] free (_Block=0xd767f0) [0176.709] CloseHandle (hObject=0x130) returned 1 [0176.709] _ui64tow_s (in: _Value=0xe88, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3720") returned 0x0 [0176.713] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3720") returned 4 [0176.714] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.714] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.732] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe88) returned 0x130 [0176.732] GetLastError () returned 0x0 [0176.732] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.732] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3fe018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.732] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.732] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x481c90, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.732] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x481888, lpBuffer=0xedc580, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.733] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.734] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.734] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3fe020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.734] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x481270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.734] malloc (_Size=0x7a) returned 0xd767f0 [0176.734] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4818fa, lpBuffer=0xd767f0, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0176.735] free (_Block=0xd767f0) [0176.736] CloseHandle (hObject=0x130) returned 1 [0176.736] _ui64tow_s (in: _Value=0xe90, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3728") returned 0x0 [0176.740] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3728") returned 4 [0176.741] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.741] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.754] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe90) returned 0x130 [0176.754] GetLastError () returned 0x0 [0176.754] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.754] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x246018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.754] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.755] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4d1c60, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.755] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4d1888, lpBuffer=0xedc580, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.756] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.757] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.757] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x246020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.757] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4d1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.757] malloc (_Size=0x66) returned 0xd70500 [0176.757] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4d18e6, lpBuffer=0xd70500, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd70500*, lpNumberOfBytesRead=0x0) returned 1 [0176.758] free (_Block=0xd70500) [0176.758] CloseHandle (hObject=0x130) returned 1 [0176.759] _ui64tow_s (in: _Value=0xe98, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3736") returned 0x0 [0176.762] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3736") returned 4 [0176.763] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.763] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.787] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe98) returned 0x130 [0176.787] GetLastError () returned 0x0 [0176.787] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.787] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x38e018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.787] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.788] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1f1ce0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.788] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1f1888, lpBuffer=0xedc580, nSize=0x8c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.789] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.790] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.790] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x38e020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.790] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1f1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.790] malloc (_Size=0x94) returned 0xd767f0 [0176.790] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1f1914, lpBuffer=0xd767f0, nSize=0x92, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0176.791] free (_Block=0xd767f0) [0176.792] CloseHandle (hObject=0x130) returned 1 [0176.792] _ui64tow_s (in: _Value=0xea0, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3744") returned 0x0 [0176.795] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3744") returned 4 [0176.796] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.796] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.806] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xea0) returned 0x130 [0176.807] GetLastError () returned 0x0 [0176.807] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.807] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3c7018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.807] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.807] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5a1c80, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.807] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5a1888, lpBuffer=0xedc580, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.808] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.809] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.809] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3c7020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.809] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5a1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.809] malloc (_Size=0x72) returned 0xd767f0 [0176.809] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5a18f2, lpBuffer=0xd767f0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0176.810] free (_Block=0xd767f0) [0176.810] CloseHandle (hObject=0x130) returned 1 [0176.811] _ui64tow_s (in: _Value=0xf84, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3972") returned 0x0 [0176.818] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3972") returned 4 [0176.818] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.818] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.829] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf84) returned 0x130 [0176.829] GetLastError () returned 0x0 [0176.830] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.830] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2c0018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.830] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.830] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x471c60, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.831] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x471888, lpBuffer=0xedc580, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.831] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.832] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.832] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2c0020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.832] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x471270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.833] malloc (_Size=0x68) returned 0xd70500 [0176.833] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4718e8, lpBuffer=0xd70500, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd70500*, lpNumberOfBytesRead=0x0) returned 1 [0176.833] free (_Block=0xd70500) [0176.834] CloseHandle (hObject=0x130) returned 1 [0176.834] _ui64tow_s (in: _Value=0xf90, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3984") returned 0x0 [0176.837] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3984") returned 4 [0176.838] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.838] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.849] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf90) returned 0x130 [0176.849] GetLastError () returned 0x0 [0176.849] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.849] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x319018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.850] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.850] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x491cb0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.850] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x491888, lpBuffer=0xedc580, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.850] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.851] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.851] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x319020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.851] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x491270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.852] malloc (_Size=0x82) returned 0xd767f0 [0176.852] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x491902, lpBuffer=0xd767f0, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0176.852] free (_Block=0xd767f0) [0176.853] CloseHandle (hObject=0x130) returned 1 [0176.853] _ui64tow_s (in: _Value=0xfa0, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="4000") returned 0x0 [0176.856] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="4000") returned 4 [0176.857] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.857] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.873] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfa0) returned 0x130 [0176.873] GetLastError () returned 0x0 [0176.873] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.873] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x296018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.873] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.873] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5c1c60, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.873] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5c1888, lpBuffer=0xedc580, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.874] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.875] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.875] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x296020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.875] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5c1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.875] malloc (_Size=0x66) returned 0xd702d0 [0176.875] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5c18e6, lpBuffer=0xd702d0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd702d0*, lpNumberOfBytesRead=0x0) returned 1 [0176.876] free (_Block=0xd702d0) [0176.877] CloseHandle (hObject=0x130) returned 1 [0176.878] _ui64tow_s (in: _Value=0xfa8, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="4008") returned 0x0 [0176.881] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="4008") returned 4 [0176.881] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.881] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.892] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfa8) returned 0x130 [0176.892] GetLastError () returned 0x0 [0176.893] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.893] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x236018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.893] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.893] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x461c90, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.893] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x461888, lpBuffer=0xedc580, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.894] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.895] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.895] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x236020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.895] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x461270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.895] malloc (_Size=0x7a) returned 0xd767f0 [0176.895] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4618fa, lpBuffer=0xd767f0, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0176.896] free (_Block=0xd767f0) [0176.896] CloseHandle (hObject=0x130) returned 1 [0176.896] _ui64tow_s (in: _Value=0xfbc, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="4028") returned 0x0 [0176.899] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="4028") returned 4 [0176.900] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.900] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.915] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfbc) returned 0x130 [0176.915] GetLastError () returned 0x0 [0176.916] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.916] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x242018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.916] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.916] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x571cc0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.916] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x571888, lpBuffer=0xedc580, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.917] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.918] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.918] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x242020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.918] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x571270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.918] malloc (_Size=0x86) returned 0xd767f0 [0176.918] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x571906, lpBuffer=0xd767f0, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0176.919] free (_Block=0xd767f0) [0176.919] CloseHandle (hObject=0x130) returned 1 [0176.919] _ui64tow_s (in: _Value=0xfc4, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="4036") returned 0x0 [0176.922] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="4036") returned 4 [0176.923] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.923] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.934] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfc4) returned 0x130 [0176.935] GetLastError () returned 0x0 [0176.935] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.935] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x22e018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.935] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.935] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5f1c50, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.935] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5f1888, lpBuffer=0xedc580, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.936] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.937] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.937] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x22e020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.937] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5f1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.937] malloc (_Size=0x64) returned 0xd6fe70 [0176.937] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5f18e4, lpBuffer=0xd6fe70, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd6fe70*, lpNumberOfBytesRead=0x0) returned 1 [0176.938] free (_Block=0xd6fe70) [0176.939] CloseHandle (hObject=0x130) returned 1 [0176.939] _ui64tow_s (in: _Value=0xfcc, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="4044") returned 0x0 [0176.942] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="4044") returned 4 [0176.943] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.943] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.958] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfcc) returned 0x130 [0176.958] GetLastError () returned 0x0 [0176.958] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.959] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x47b018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.959] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.959] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x261c60, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.959] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x261888, lpBuffer=0xedc580, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.960] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.960] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.960] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x47b020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.961] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x261270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.961] malloc (_Size=0x66) returned 0xd70340 [0176.961] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2618e6, lpBuffer=0xd70340, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd70340*, lpNumberOfBytesRead=0x0) returned 1 [0176.961] free (_Block=0xd70340) [0176.962] CloseHandle (hObject=0x130) returned 1 [0176.962] _ui64tow_s (in: _Value=0xfd4, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="4052") returned 0x0 [0176.965] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="4052") returned 4 [0176.966] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.966] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.977] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfd4) returned 0x130 [0176.977] GetLastError () returned 0x0 [0176.977] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.977] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5b0018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.978] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.978] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1e1c80, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.978] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1e1888, lpBuffer=0xedc580, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.979] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.979] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.979] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5b0020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.980] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1e1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.980] malloc (_Size=0x72) returned 0xd767f0 [0176.980] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1e18f2, lpBuffer=0xd767f0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0176.980] free (_Block=0xd767f0) [0176.981] CloseHandle (hObject=0x130) returned 1 [0176.981] _ui64tow_s (in: _Value=0xfdc, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="4060") returned 0x0 [0176.984] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="4060") returned 4 [0176.985] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.985] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0176.996] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfdc) returned 0x130 [0176.996] GetLastError () returned 0x0 [0176.997] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0176.997] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x277018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0176.997] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0176.997] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1f1c70, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0176.997] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1f1888, lpBuffer=0xedc580, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0176.998] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0176.999] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0176.999] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x277020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0176.999] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1f1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0176.999] malloc (_Size=0x70) returned 0xd767f0 [0176.999] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1f18f0, lpBuffer=0xd767f0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0176.999] free (_Block=0xd767f0) [0177.000] CloseHandle (hObject=0x130) returned 1 [0177.000] _ui64tow_s (in: _Value=0xfec, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="4076") returned 0x0 [0177.008] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="4076") returned 4 [0177.009] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0177.009] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0177.020] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfec) returned 0x130 [0177.020] GetLastError () returned 0x0 [0177.020] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0177.020] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2d0018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0177.020] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0177.020] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5b1c90, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0177.020] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5b1888, lpBuffer=0xedc580, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0177.021] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0177.022] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0177.022] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2d0020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0177.022] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5b1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0177.022] malloc (_Size=0x76) returned 0xd767f0 [0177.022] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5b18f6, lpBuffer=0xd767f0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0177.023] free (_Block=0xd767f0) [0177.023] CloseHandle (hObject=0x130) returned 1 [0177.024] _ui64tow_s (in: _Value=0x724, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1828") returned 0x0 [0177.027] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1828") returned 4 [0177.027] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0177.027] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0177.039] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x724) returned 0x130 [0177.039] GetLastError () returned 0x0 [0177.039] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0177.039] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x44b018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0177.040] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0177.040] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3e1c50, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0177.040] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3e1888, lpBuffer=0xedc580, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0177.041] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0177.041] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0177.041] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x44b020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0177.042] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3e1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0177.042] malloc (_Size=0x64) returned 0xd70340 [0177.042] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3e18e4, lpBuffer=0xd70340, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd70340*, lpNumberOfBytesRead=0x0) returned 1 [0177.042] free (_Block=0xd70340) [0177.043] CloseHandle (hObject=0x130) returned 1 [0177.043] _ui64tow_s (in: _Value=0x61c, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1564") returned 0x0 [0177.046] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1564") returned 4 [0177.047] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0177.047] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0177.062] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x61c) returned 0x130 [0177.062] GetLastError () returned 0x0 [0177.063] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0177.063] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x376018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0177.063] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0177.063] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1f1c70, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0177.063] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1f1888, lpBuffer=0xedc580, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0177.064] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0177.065] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0177.065] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x376020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0177.066] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1f1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0177.066] malloc (_Size=0x6e) returned 0xd767f0 [0177.066] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1f18ee, lpBuffer=0xd767f0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0177.066] free (_Block=0xd767f0) [0177.067] CloseHandle (hObject=0x130) returned 1 [0177.068] _ui64tow_s (in: _Value=0x684, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1668") returned 0x0 [0177.073] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1668") returned 4 [0177.075] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0177.075] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0177.088] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x684) returned 0x130 [0177.088] GetLastError () returned 0x0 [0177.089] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0177.089] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2a0018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0177.089] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0177.089] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4c1cb0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0177.089] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4c1888, lpBuffer=0xedc580, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0177.090] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0177.091] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0177.091] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2a0020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0177.091] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4c1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0177.091] malloc (_Size=0x82) returned 0xd767f0 [0177.091] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4c1902, lpBuffer=0xd767f0, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0177.091] free (_Block=0xd767f0) [0177.092] CloseHandle (hObject=0x130) returned 1 [0177.115] _ui64tow_s (in: _Value=0x3a8, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="936") returned 0x0 [0177.119] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="936") returned 3 [0177.120] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0177.120] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0177.155] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3a8) returned 0x130 [0177.155] GetLastError () returned 0x0 [0177.156] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0177.156] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2b5018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0177.156] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0177.156] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x541c80, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0177.156] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x541888, lpBuffer=0xedc580, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0177.157] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0177.158] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0177.158] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2b5020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0177.158] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x541270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0177.159] malloc (_Size=0x72) returned 0xd767f0 [0177.159] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5418f2, lpBuffer=0xd767f0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0177.159] free (_Block=0xd767f0) [0177.160] CloseHandle (hObject=0x130) returned 1 [0177.160] _ui64tow_s (in: _Value=0xcdc, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3292") returned 0x0 [0177.164] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3292") returned 4 [0177.165] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0177.165] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0177.186] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xcdc) returned 0x130 [0177.186] GetLastError () returned 0x0 [0177.186] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0177.186] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x444018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0177.186] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0177.186] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x341ca0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0177.186] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x341888, lpBuffer=0xedc580, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0177.187] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0177.189] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0177.189] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x444020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0177.189] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x341270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0177.189] malloc (_Size=0x7e) returned 0xd767f0 [0177.189] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3418fe, lpBuffer=0xd767f0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0177.190] free (_Block=0xd767f0) [0177.191] CloseHandle (hObject=0x130) returned 1 [0177.191] _ui64tow_s (in: _Value=0xbe8, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3048") returned 0x0 [0177.195] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3048") returned 4 [0177.196] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0177.196] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0177.209] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbe8) returned 0x130 [0177.209] GetLastError () returned 0x0 [0177.209] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0177.209] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2ce018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0177.210] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0177.210] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x561b60, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0177.210] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5617a8, lpBuffer=0xedc580, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0177.210] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0177.211] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0177.211] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2ce020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0177.211] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x561190, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0177.211] malloc (_Size=0x76) returned 0xd731c0 [0177.211] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5617f4, lpBuffer=0xd731c0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd731c0*, lpNumberOfBytesRead=0x0) returned 1 [0177.212] free (_Block=0xd731c0) [0177.212] CloseHandle (hObject=0x130) returned 1 [0177.213] _ui64tow_s (in: _Value=0x1024, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="4132") returned 0x0 [0177.216] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="4132") returned 4 [0177.217] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0177.217] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0177.233] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1024) returned 0x130 [0177.233] GetLastError () returned 0x0 [0177.233] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0177.233] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x276018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0177.233] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0177.233] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403670, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0177.233] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4032b2, lpBuffer=0xedc580, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0177.234] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0177.235] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0177.235] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x276020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0177.235] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x402c00, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0177.236] malloc (_Size=0xce) returned 0xd767f0 [0177.236] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403308, lpBuffer=0xd767f0, nSize=0xcc, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0177.236] free (_Block=0xd767f0) [0177.237] CloseHandle (hObject=0x130) returned 1 [0177.237] _ui64tow_s (in: _Value=0x1070, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="4208") returned 0x0 [0177.240] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="4208") returned 4 [0177.241] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0177.241] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0177.253] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1070) returned 0x130 [0177.254] GetLastError () returned 0x0 [0177.254] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0177.254] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x282018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0177.254] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x20, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810, lpNumberOfBytesRead=0x0) returned 0 [0177.254] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0177.255] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0177.255] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x282020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0177.256] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x10000, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0177.256] malloc (_Size=0xda) returned 0xd74e80 [0177.256] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x106ea, lpBuffer=0xd74e80, nSize=0xd8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0177.256] free (_Block=0xd74e80) [0177.257] CloseHandle (hObject=0x130) returned 1 [0177.257] _ui64tow_s (in: _Value=0x1114, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="4372") returned 0x0 [0177.260] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="4372") returned 4 [0177.261] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0177.261] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0177.280] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1114) returned 0x0 [0177.280] CloseHandle (hObject=0x0) returned 0 [0177.280] _ui64tow_s (in: _Value=0x11b4, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="4532") returned 0x0 [0177.284] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="4532") returned 4 [0177.285] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0177.285] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0177.297] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11b4) returned 0x130 [0177.297] GetLastError () returned 0x0 [0177.297] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0177.298] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x38a018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0177.298] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0177.298] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1d1d60, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0177.298] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1d1858, lpBuffer=0xedc580, nSize=0xc6, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0177.299] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0177.300] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0177.300] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x38a020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0177.300] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1d1240, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0177.300] malloc (_Size=0xce) returned 0xd74e80 [0177.300] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1d191e, lpBuffer=0xd74e80, nSize=0xcc, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0177.301] free (_Block=0xd74e80) [0177.301] CloseHandle (hObject=0x130) returned 1 [0177.303] free (_Block=0xd791d0) [0177.303] malloc (_Size=0x48) returned 0xd6d320 [0177.303] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xedd6d0 | out: lpSystemTimeAsFileTime=0xedd6d0*(dwLowDateTime=0x20d95dd6, dwHighDateTime=0x1d8a8f7)) [0177.303] SetEvent (hEvent=0x260) returned 1 [0177.311] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4) returned 0x589fc0 [0177.311] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x589fc0, pulNumLanguages=0xede1c0 | out: pulNumLanguages=0xede1c0) returned 1 [0177.311] RtlFreeHeap (HeapHandle=0x560000, Flags=0x0, BaseAddress=0x589fc0) returned 1 [0177.311] RtlFreeHeap (HeapHandle=0x560000, Flags=0x0, BaseAddress=0x58a0d0) returned 1 [0178.414] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0178.513] RtlRestoreLastWin32Error () returned 0x2d5000 [0178.513] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xede0f8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xeddff0 | out: pulNumLanguages=0xede0f8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xeddff0) returned 1 [0178.514] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x589fc0 [0178.514] RtlRestoreLastWin32Error () returned 0x2d5000 [0178.514] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xede0f8, pwszLanguagesBuffer=0x589fc0, pcchLanguagesBuffer=0xeddff0 | out: pulNumLanguages=0xede0f8, pwszLanguagesBuffer=0x589fc0, pcchLanguagesBuffer=0xeddff0) returned 1 [0178.514] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a0d0 [0178.514] RtlFreeHeap (HeapHandle=0x560000, Flags=0x0, BaseAddress=0x589fc0) returned 1 [0178.514] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x14) returned 0x5bd7a0 [0178.514] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x5bd7a0, pulNumLanguages=0xede0f8 | out: pulNumLanguages=0xede0f8) returned 1 [0178.514] RtlFreeHeap (HeapHandle=0x560000, Flags=0x0, BaseAddress=0x5bd7a0) returned 1 [0178.515] SetEvent (hEvent=0x260) returned 1 [0178.516] free (_Block=0xd6d320) [0178.516] GetCurrentThread () returned 0xfffffffffffffffe [0178.516] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0xedd660 | out: TokenHandle=0xedd660*=0x130) returned 1 [0178.516] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0xedd69c | out: lpLuid=0xedd69c*(LowPart=0x14, HighPart=0)) returned 1 [0178.517] RtlRestoreLastWin32Error () returned 0x2d5000 [0178.517] AdjustTokenPrivileges (in: TokenHandle=0x130, DisableAllPrivileges=0, NewState=0xedd698*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0178.517] GetLastError () returned 0x0 [0178.517] CloseHandle (hObject=0x130) returned 1 [0178.517] malloc (_Size=0x8000) returned 0xd789c0 [0178.518] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xd789c0, Length=0x8000, ResultLength=0x0 | out: SystemInformation=0xd789c0, ResultLength=0x0) returned 0xc0000004 [0178.519] free (_Block=0xd789c0) [0178.520] malloc (_Size=0x10000) returned 0xd789c0 [0178.521] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xd789c0, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0xd789c0, ResultLength=0x0) returned 0xc0000004 [0178.523] free (_Block=0xd789c0) [0178.523] malloc (_Size=0x18000) returned 0xd789c0 [0178.524] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xd789c0, Length=0x18000, ResultLength=0x0 | out: SystemInformation=0xd789c0, ResultLength=0x0) returned 0xc0000004 [0178.527] free (_Block=0xd789c0) [0178.527] malloc (_Size=0x20000) returned 0xd789c0 [0178.527] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0xd789c0, Length=0x20000, ResultLength=0x0 | out: SystemInformation=0xd789c0, ResultLength=0x0) returned 0x0 [0178.528] _ui64tow_s (in: _Value=0x0, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="0") returned 0x0 [0178.531] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="0") returned 1 [0178.532] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x16792958, dwBuildNumber=0x7ffa, dwPlatformId=0x6, szCSDVersion="\n") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0178.532] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0178.546] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0178.546] CloseHandle (hObject=0x0) returned 0 [0178.546] _ui64tow_s (in: _Value=0x4, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="4") returned 0x0 [0178.551] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="4") returned 1 [0178.552] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0178.552] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0178.567] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0178.567] CloseHandle (hObject=0x0) returned 0 [0178.567] _ui64tow_s (in: _Value=0x138, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="312") returned 0x0 [0178.572] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="312") returned 3 [0178.574] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0178.574] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0178.592] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x138) returned 0x0 [0178.592] CloseHandle (hObject=0x0) returned 0 [0178.593] _ui64tow_s (in: _Value=0x184, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="388") returned 0x0 [0178.598] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="388") returned 3 [0178.599] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0178.599] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0178.614] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0178.615] CloseHandle (hObject=0x0) returned 0 [0178.615] _ui64tow_s (in: _Value=0x1c0, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="448") returned 0x0 [0178.619] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="448") returned 3 [0178.620] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0178.620] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0178.636] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1c0) returned 0x0 [0178.636] CloseHandle (hObject=0x0) returned 0 [0178.637] _ui64tow_s (in: _Value=0x1c8, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="456") returned 0x0 [0178.641] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="456") returned 3 [0178.642] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0178.642] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0178.656] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1c8) returned 0x0 [0178.656] CloseHandle (hObject=0x0) returned 0 [0178.657] _ui64tow_s (in: _Value=0x1fc, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="508") returned 0x0 [0178.661] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="508") returned 3 [0178.662] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0178.662] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0178.680] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1fc) returned 0x130 [0178.680] GetLastError () returned 0x0 [0178.680] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0178.680] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x389018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0178.680] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0178.680] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x591630, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0178.680] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x591340, lpBuffer=0xedc580, nSize=0x42, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0178.681] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0178.683] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0178.683] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x389020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0178.683] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x590d20, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0178.683] malloc (_Size=0x1c) returned 0xd770a0 [0178.683] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x591382, lpBuffer=0xd770a0, nSize=0x1a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd770a0*, lpNumberOfBytesRead=0x0) returned 1 [0178.683] free (_Block=0xd770a0) [0178.684] CloseHandle (hObject=0x130) returned 1 [0178.684] _ui64tow_s (in: _Value=0x214, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="532") returned 0x0 [0178.688] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="532") returned 3 [0178.689] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0178.689] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0178.703] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x214) returned 0x0 [0178.703] CloseHandle (hObject=0x0) returned 0 [0178.704] _ui64tow_s (in: _Value=0x21c, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="540") returned 0x0 [0178.708] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="540") returned 3 [0178.709] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0178.709] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0178.723] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x21c) returned 0x130 [0178.723] GetLastError () returned 0x0 [0178.724] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0178.724] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x345018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0178.724] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0178.724] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603240, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0178.724] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x602e98, lpBuffer=0xedc580, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0178.725] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0178.726] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0178.726] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x345020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0178.727] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x602880, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0178.727] malloc (_Size=0x3e) returned 0xd6d320 [0178.727] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x602ed4, lpBuffer=0xd6d320, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd6d320*, lpNumberOfBytesRead=0x0) returned 1 [0178.727] free (_Block=0xd6d320) [0178.728] CloseHandle (hObject=0x130) returned 1 [0178.729] _ui64tow_s (in: _Value=0x274, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="628") returned 0x0 [0178.733] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="628") returned 3 [0178.734] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0178.734] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0178.748] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x274) returned 0x130 [0178.748] GetLastError () returned 0x0 [0178.749] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0178.749] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3e3018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0178.749] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0178.749] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603370, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0178.749] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x602fd8, lpBuffer=0xedc580, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0178.750] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0178.751] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0178.751] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3e3020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0178.752] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x6029c0, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0178.752] malloc (_Size=0x5e) returned 0xd701f0 [0178.752] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603018, lpBuffer=0xd701f0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd701f0*, lpNumberOfBytesRead=0x0) returned 1 [0178.752] free (_Block=0xd701f0) [0178.753] CloseHandle (hObject=0x130) returned 1 [0178.754] _ui64tow_s (in: _Value=0x294, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="660") returned 0x0 [0178.758] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="660") returned 3 [0178.759] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0178.759] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0178.775] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x294) returned 0x130 [0178.775] GetLastError () returned 0x0 [0178.775] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0178.776] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2e8018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0178.776] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0178.776] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4033e0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0178.776] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403058, lpBuffer=0xedc580, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0178.777] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0178.778] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0178.778] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2e8020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0178.778] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x402a40, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0178.779] malloc (_Size=0x54) returned 0xd77a00 [0178.779] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403098, lpBuffer=0xd77a00, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd77a00*, lpNumberOfBytesRead=0x0) returned 1 [0178.779] free (_Block=0xd77a00) [0178.780] CloseHandle (hObject=0x130) returned 1 [0178.780] _ui64tow_s (in: _Value=0x30c, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="780") returned 0x0 [0178.784] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="780") returned 3 [0178.786] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0178.786] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0178.799] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x30c) returned 0x130 [0178.799] GetLastError () returned 0x0 [0178.799] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0178.799] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x21e018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0178.800] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0178.800] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x421980, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0178.800] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x421678, lpBuffer=0xedc580, nSize=0x38, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0178.801] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0178.802] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0178.802] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x21e020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0178.802] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x421060, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0178.802] malloc (_Size=0x16) returned 0xd766b0 [0178.802] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4216b0, lpBuffer=0xd766b0, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd766b0*, lpNumberOfBytesRead=0x0) returned 1 [0178.802] free (_Block=0xd766b0) [0178.803] CloseHandle (hObject=0x130) returned 1 [0178.803] _ui64tow_s (in: _Value=0x360, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="864") returned 0x0 [0178.806] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="864") returned 3 [0178.807] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0178.807] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0178.824] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x360) returned 0x130 [0178.825] GetLastError () returned 0x0 [0178.825] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0178.825] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x21f018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0178.825] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0178.825] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603370, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0178.825] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x602fd8, lpBuffer=0xedc580, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0178.826] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0178.827] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0178.827] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x21f020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0178.827] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x6029c0, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0178.827] malloc (_Size=0x58) returned 0xd78000 [0178.828] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603018, lpBuffer=0xd78000, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd78000*, lpNumberOfBytesRead=0x0) returned 1 [0178.828] free (_Block=0xd78000) [0178.829] CloseHandle (hObject=0x130) returned 1 [0178.829] _ui64tow_s (in: _Value=0x378, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="888") returned 0x0 [0178.832] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="888") returned 3 [0178.833] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0178.833] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0178.846] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x378) returned 0x130 [0178.846] GetLastError () returned 0x0 [0178.846] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0178.846] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x334018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0178.846] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0178.846] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403400, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0178.846] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403058, lpBuffer=0xedc580, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0178.848] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0178.849] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0178.849] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x334020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0178.849] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x402a40, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0178.849] malloc (_Size=0x74) returned 0xd767f0 [0178.849] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403098, lpBuffer=0xd767f0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0178.849] free (_Block=0xd767f0) [0178.850] CloseHandle (hObject=0x130) returned 1 [0178.850] _ui64tow_s (in: _Value=0x390, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="912") returned 0x0 [0178.853] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="912") returned 3 [0178.854] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0178.854] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0178.867] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x390) returned 0x130 [0178.867] GetLastError () returned 0x0 [0178.868] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0178.868] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x315018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0178.868] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0178.868] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603410, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0178.868] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603058, lpBuffer=0xedc580, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0178.869] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0178.870] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0178.870] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x315020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0178.870] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x602a40, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0178.870] malloc (_Size=0x84) returned 0xd767f0 [0178.870] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603098, lpBuffer=0xd767f0, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0178.870] free (_Block=0xd767f0) [0178.871] CloseHandle (hObject=0x130) returned 1 [0178.871] _ui64tow_s (in: _Value=0x3a0, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="928") returned 0x0 [0178.874] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="928") returned 3 [0178.875] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0178.875] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0178.886] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3a0) returned 0x130 [0178.887] GetLastError () returned 0x0 [0178.887] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0178.887] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x37b018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0178.887] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0178.887] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403410, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0178.887] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403058, lpBuffer=0xedc580, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0178.888] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0178.889] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0178.889] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x37b020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0178.889] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x402a40, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0178.889] malloc (_Size=0x86) returned 0xd767f0 [0178.889] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403098, lpBuffer=0xd767f0, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0178.890] free (_Block=0xd767f0) [0178.891] CloseHandle (hObject=0x130) returned 1 [0178.891] _ui64tow_s (in: _Value=0x3f4, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1012") returned 0x0 [0178.897] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1012") returned 4 [0178.898] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0178.898] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0178.915] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3f4) returned 0x130 [0178.915] GetLastError () returned 0x0 [0178.915] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0178.915] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x291018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0178.915] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0178.915] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x6033f0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0178.915] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603058, lpBuffer=0xedc580, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0178.916] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0178.917] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0178.917] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x291020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0178.917] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x602a40, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0178.917] malloc (_Size=0x62) returned 0xd701f0 [0178.917] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603098, lpBuffer=0xd701f0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd701f0*, lpNumberOfBytesRead=0x0) returned 1 [0178.918] free (_Block=0xd701f0) [0178.918] CloseHandle (hObject=0x130) returned 1 [0178.919] _ui64tow_s (in: _Value=0x210, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="528") returned 0x0 [0178.922] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="528") returned 3 [0178.923] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0178.923] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0178.934] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x210) returned 0x130 [0178.934] GetLastError () returned 0x0 [0178.935] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0178.935] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2e4018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0178.935] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0178.935] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403390, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0178.935] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x402fd8, lpBuffer=0xedc580, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0178.936] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0178.937] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0178.937] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2e4020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0178.937] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4029c0, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0178.937] malloc (_Size=0x82) returned 0xd767f0 [0178.937] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403018, lpBuffer=0xd767f0, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0178.938] free (_Block=0xd767f0) [0178.938] CloseHandle (hObject=0x130) returned 1 [0178.938] _ui64tow_s (in: _Value=0x460, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1120") returned 0x0 [0178.942] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1120") returned 4 [0178.943] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0178.943] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0178.955] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x460) returned 0x130 [0178.955] GetLastError () returned 0x0 [0178.955] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0178.955] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3c1018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0178.955] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0178.955] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x6033f0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0178.955] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603058, lpBuffer=0xedc580, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0178.956] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0178.959] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0178.959] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3c1020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0178.959] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x602a40, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0178.959] malloc (_Size=0x66) returned 0xd701f0 [0178.959] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603098, lpBuffer=0xd701f0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd701f0*, lpNumberOfBytesRead=0x0) returned 1 [0178.959] free (_Block=0xd701f0) [0178.960] CloseHandle (hObject=0x130) returned 1 [0178.961] _ui64tow_s (in: _Value=0x4e0, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1248") returned 0x0 [0178.964] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1248") returned 4 [0178.965] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0178.965] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0178.979] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4e0) returned 0x130 [0178.979] GetLastError () returned 0x0 [0178.980] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0178.980] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3a1018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0178.980] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0178.980] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x501b00, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0178.980] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5017a8, lpBuffer=0xedc580, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0178.981] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0178.982] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0178.982] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3a1020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0178.982] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x501190, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0178.983] malloc (_Size=0x42) returned 0xd6c9c0 [0178.983] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5017e8, lpBuffer=0xd6c9c0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd6c9c0*, lpNumberOfBytesRead=0x0) returned 1 [0178.983] free (_Block=0xd6c9c0) [0178.984] CloseHandle (hObject=0x130) returned 1 [0178.984] _ui64tow_s (in: _Value=0x54c, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1356") returned 0x0 [0178.987] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1356") returned 4 [0178.988] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0178.988] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0178.999] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x54c) returned 0x130 [0178.999] GetLastError () returned 0x0 [0178.999] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0178.999] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x207018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.000] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.000] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x571b70, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.000] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x571848, lpBuffer=0xedc580, nSize=0x3e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.001] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.002] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.002] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x207020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.002] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x571230, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.002] malloc (_Size=0x18) returned 0xd764b0 [0179.002] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x571886, lpBuffer=0xd764b0, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd764b0*, lpNumberOfBytesRead=0x0) returned 1 [0179.002] free (_Block=0xd764b0) [0179.003] CloseHandle (hObject=0x130) returned 1 [0179.003] _ui64tow_s (in: _Value=0x604, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1540") returned 0x0 [0179.007] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1540") returned 4 [0179.007] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.007] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.022] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x604) returned 0x130 [0179.022] GetLastError () returned 0x0 [0179.022] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.022] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3c2018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.022] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.022] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603430, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.022] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603078, lpBuffer=0xedc580, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.023] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.024] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.024] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3c2020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.024] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x602a60, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.024] malloc (_Size=0x64) returned 0xd701f0 [0179.024] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x6030c4, lpBuffer=0xd701f0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd701f0*, lpNumberOfBytesRead=0x0) returned 1 [0179.025] free (_Block=0xd701f0) [0179.025] CloseHandle (hObject=0x130) returned 1 [0179.026] _ui64tow_s (in: _Value=0x64c, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1612") returned 0x0 [0179.029] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1612") returned 4 [0179.030] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.030] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.043] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x64c) returned 0x130 [0179.043] GetLastError () returned 0x0 [0179.043] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.043] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x20d018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.043] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.043] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403370, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.043] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x402fd8, lpBuffer=0xedc580, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.044] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.045] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.045] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x20d020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.045] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4029c0, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.046] malloc (_Size=0x5a) returned 0xd701f0 [0179.046] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403018, lpBuffer=0xd701f0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd701f0*, lpNumberOfBytesRead=0x0) returned 1 [0179.046] free (_Block=0xd701f0) [0179.047] CloseHandle (hObject=0x130) returned 1 [0179.047] _ui64tow_s (in: _Value=0x7b4, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1972") returned 0x0 [0179.052] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1972") returned 4 [0179.053] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.053] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.064] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7b4) returned 0x130 [0179.064] GetLastError () returned 0x0 [0179.065] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.065] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2f6018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.065] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.065] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x431be0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.065] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x431878, lpBuffer=0xedc580, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.066] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.067] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.067] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2f6020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.067] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x431260, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.067] malloc (_Size=0x32) returned 0xd70d00 [0179.068] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4318a8, lpBuffer=0xd70d00, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd70d00*, lpNumberOfBytesRead=0x0) returned 1 [0179.068] free (_Block=0xd70d00) [0179.068] CloseHandle (hObject=0x130) returned 1 [0179.069] _ui64tow_s (in: _Value=0x7ec, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="2028") returned 0x0 [0179.072] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="2028") returned 4 [0179.073] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.073] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.085] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7ec) returned 0x130 [0179.085] GetLastError () returned 0x0 [0179.085] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.085] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2bb018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.085] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.085] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4c1bf0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.085] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4c1848, lpBuffer=0xedc580, nSize=0x44, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.086] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.087] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.087] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2bb020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.087] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4c1230, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.087] malloc (_Size=0x6c) returned 0xd767f0 [0179.087] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4c188c, lpBuffer=0xd767f0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0179.088] free (_Block=0xd767f0) [0179.089] CloseHandle (hObject=0x130) returned 1 [0179.089] _ui64tow_s (in: _Value=0x894, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="2196") returned 0x0 [0179.092] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="2196") returned 4 [0179.093] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.093] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.109] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x894) returned 0x130 [0179.110] GetLastError () returned 0x0 [0179.110] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.110] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2a8018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.111] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.111] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603710, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.111] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603278, lpBuffer=0xedc580, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.113] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.116] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.116] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2a8020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.116] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x602bf0, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.117] malloc (_Size=0x118) returned 0xd74e80 [0179.117] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603318, lpBuffer=0xd74e80, nSize=0x116, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0179.118] free (_Block=0xd74e80) [0179.118] CloseHandle (hObject=0x130) returned 1 [0179.119] _ui64tow_s (in: _Value=0x908, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="2312") returned 0x0 [0179.122] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="2312") returned 4 [0179.123] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.123] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.134] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x908) returned 0x130 [0179.134] GetLastError () returned 0x0 [0179.135] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.135] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3fd018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.135] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.135] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x6036b0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.135] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x603234, lpBuffer=0xedc580, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.136] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.137] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.137] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3fd020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.137] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x602ba0, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.137] malloc (_Size=0x11a) returned 0xd74e80 [0179.137] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x6032ca, lpBuffer=0xd74e80, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0179.137] free (_Block=0xd74e80) [0179.138] CloseHandle (hObject=0x130) returned 1 [0179.139] _ui64tow_s (in: _Value=0x8d8, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="2264") returned 0x0 [0179.142] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="2264") returned 4 [0179.143] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.143] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.165] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8d8) returned 0x130 [0179.165] GetLastError () returned 0x0 [0179.165] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.165] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3b2018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.166] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.166] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403420, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.166] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403078, lpBuffer=0xedc580, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.167] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.168] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.168] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3b2020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.168] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x402a60, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.168] malloc (_Size=0x6a) returned 0xd767f0 [0179.168] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4030b8, lpBuffer=0xd767f0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0179.169] free (_Block=0xd767f0) [0179.169] CloseHandle (hObject=0x130) returned 1 [0179.170] _ui64tow_s (in: _Value=0xb8c, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="2956") returned 0x0 [0179.173] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="2956") returned 4 [0179.174] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.175] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.188] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb8c) returned 0x0 [0179.188] CloseHandle (hObject=0x0) returned 0 [0179.189] _ui64tow_s (in: _Value=0x404, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1028") returned 0x0 [0179.194] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1028") returned 4 [0179.195] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.195] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.208] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x404) returned 0x130 [0179.208] GetLastError () returned 0x0 [0179.209] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.209] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3f8018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.209] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.209] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x571b10, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.209] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5717a8, lpBuffer=0xedc580, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.210] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.212] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.212] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3f8020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.212] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x571190, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.212] malloc (_Size=0x2c) returned 0xd70f00 [0179.212] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5717fa, lpBuffer=0xd70f00, nSize=0x2a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd70f00*, lpNumberOfBytesRead=0x0) returned 1 [0179.213] free (_Block=0xd70f00) [0179.213] CloseHandle (hObject=0x130) returned 1 [0179.240] _ui64tow_s (in: _Value=0x3b8, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="952") returned 0x0 [0179.244] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="952") returned 3 [0179.245] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x143cec4f, dwBuildNumber=0x7ffa, dwPlatformId=0xedcb30, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.246] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.269] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3b8) returned 0x130 [0179.269] GetLastError () returned 0x0 [0179.269] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.270] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x26a018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.270] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.270] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x551b60, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.270] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5517a8, lpBuffer=0xedc580, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.271] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.272] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.272] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x26a020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.272] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x551190, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.272] malloc (_Size=0x64) returned 0xd701f0 [0179.272] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5517f4, lpBuffer=0xd701f0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd701f0*, lpNumberOfBytesRead=0x0) returned 1 [0179.273] free (_Block=0xd701f0) [0179.273] CloseHandle (hObject=0x130) returned 1 [0179.274] _ui64tow_s (in: _Value=0x644, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1604") returned 0x0 [0179.277] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1604") returned 4 [0179.278] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.278] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.318] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x644) returned 0x130 [0179.318] GetLastError () returned 0x0 [0179.318] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.318] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x283018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.318] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.319] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5f1cc0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.319] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5f18d8, lpBuffer=0xedc580, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.320] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.321] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.321] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x283020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.321] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5f12c0, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.321] malloc (_Size=0x7e) returned 0xd74e80 [0179.321] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5f1938, lpBuffer=0xd74e80, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0179.322] free (_Block=0xd74e80) [0179.322] CloseHandle (hObject=0x130) returned 1 [0179.323] _ui64tow_s (in: _Value=0x3b0, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="944") returned 0x0 [0179.326] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="944") returned 3 [0179.327] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.327] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.351] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3b0) returned 0x130 [0179.351] GetLastError () returned 0x0 [0179.351] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.352] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x455a018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.352] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.352] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4361dd0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.352] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4361988, lpBuffer=0xedc580, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.353] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.354] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.354] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x455a020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.354] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4361370, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.355] malloc (_Size=0xbc) returned 0xd74e80 [0179.355] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x43619f4, lpBuffer=0xd74e80, nSize=0xba, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0179.355] free (_Block=0xd74e80) [0179.356] CloseHandle (hObject=0x130) returned 1 [0179.356] _ui64tow_s (in: _Value=0x66c, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1644") returned 0x0 [0179.360] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1644") returned 4 [0179.361] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.361] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.383] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x66c) returned 0x130 [0179.383] GetLastError () returned 0x0 [0179.383] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.383] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3da018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.383] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.384] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x591ca0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.384] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x591888, lpBuffer=0xedc580, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.385] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.385] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.386] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3da020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.386] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x591270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.386] malloc (_Size=0x7e) returned 0xd74e80 [0179.386] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5918fe, lpBuffer=0xd74e80, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0179.386] free (_Block=0xd74e80) [0179.387] CloseHandle (hObject=0x130) returned 1 [0179.387] _ui64tow_s (in: _Value=0x9d4, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="2516") returned 0x0 [0179.390] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="2516") returned 4 [0179.391] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.391] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.403] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9d4) returned 0x130 [0179.403] GetLastError () returned 0x0 [0179.404] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.404] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2cb018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.404] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.404] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4e1c70, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.404] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4e1888, lpBuffer=0xedc580, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.405] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.406] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.406] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2cb020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.406] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4e1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.406] malloc (_Size=0x70) returned 0xd74e80 [0179.406] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4e18f0, lpBuffer=0xd74e80, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0179.407] free (_Block=0xd74e80) [0179.407] CloseHandle (hObject=0x130) returned 1 [0179.408] _ui64tow_s (in: _Value=0x14c, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="332") returned 0x0 [0179.411] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="332") returned 3 [0179.412] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.412] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.439] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14c) returned 0x130 [0179.440] GetLastError () returned 0x0 [0179.440] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.440] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x316018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.440] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.440] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5c1c90, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.440] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5c1888, lpBuffer=0xedc580, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.442] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.443] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.443] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x316020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.443] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5c1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.443] malloc (_Size=0x78) returned 0xd74e80 [0179.443] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5c18f8, lpBuffer=0xd74e80, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0179.443] free (_Block=0xd74e80) [0179.444] CloseHandle (hObject=0x130) returned 1 [0179.444] _ui64tow_s (in: _Value=0x5e4, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1508") returned 0x0 [0179.448] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1508") returned 4 [0179.448] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.449] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.462] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5e4) returned 0x130 [0179.462] GetLastError () returned 0x0 [0179.462] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.462] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x39a018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.462] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.462] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a1c40, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.462] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a1888, lpBuffer=0xedc580, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.463] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.464] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.464] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x39a020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.464] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.465] malloc (_Size=0x60) returned 0xd70500 [0179.465] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a18e0, lpBuffer=0xd70500, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd70500*, lpNumberOfBytesRead=0x0) returned 1 [0179.466] free (_Block=0xd70500) [0179.466] CloseHandle (hObject=0x130) returned 1 [0179.467] _ui64tow_s (in: _Value=0x79c, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1948") returned 0x0 [0179.471] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1948") returned 4 [0179.472] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.472] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.493] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x79c) returned 0x130 [0179.493] GetLastError () returned 0x0 [0179.494] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.494] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x333018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.494] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.494] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x431c30, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.494] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x431888, lpBuffer=0xedc580, nSize=0x50, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.495] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.496] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.496] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x333020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.496] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x431270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.496] malloc (_Size=0x58) returned 0xd77e80 [0179.496] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4318d8, lpBuffer=0xd77e80, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd77e80*, lpNumberOfBytesRead=0x0) returned 1 [0179.497] free (_Block=0xd77e80) [0179.498] CloseHandle (hObject=0x130) returned 1 [0179.498] _ui64tow_s (in: _Value=0x440, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1088") returned 0x0 [0179.502] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1088") returned 4 [0179.504] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.504] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.517] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x440) returned 0x130 [0179.518] GetLastError () returned 0x0 [0179.518] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.518] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3e7018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.518] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.518] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5b1ca0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.518] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5b1888, lpBuffer=0xedc580, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.526] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.527] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.527] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3e7020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.527] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5b1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.527] malloc (_Size=0x7e) returned 0xd74e80 [0179.527] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5b18fe, lpBuffer=0xd74e80, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0179.528] free (_Block=0xd74e80) [0179.528] CloseHandle (hObject=0x130) returned 1 [0179.529] _ui64tow_s (in: _Value=0xc08, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3080") returned 0x0 [0179.532] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3080") returned 4 [0179.533] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.533] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.548] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc08) returned 0x130 [0179.548] GetLastError () returned 0x0 [0179.548] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.548] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x27e018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.548] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.548] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x561c90, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.549] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x561888, lpBuffer=0xedc580, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.549] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.551] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.551] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x27e020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.551] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x561270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.551] malloc (_Size=0x78) returned 0xd74e80 [0179.551] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5618f8, lpBuffer=0xd74e80, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0179.552] free (_Block=0xd74e80) [0179.552] CloseHandle (hObject=0x130) returned 1 [0179.553] _ui64tow_s (in: _Value=0xc10, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3088") returned 0x0 [0179.556] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3088") returned 4 [0179.557] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.558] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.575] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc10) returned 0x130 [0179.575] GetLastError () returned 0x0 [0179.576] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.576] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2e7018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.576] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.576] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5e1c60, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.576] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5e1888, lpBuffer=0xedc580, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.577] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.578] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.578] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2e7020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.578] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5e1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.578] malloc (_Size=0x68) returned 0xd70340 [0179.579] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5e18e8, lpBuffer=0xd70340, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd70340*, lpNumberOfBytesRead=0x0) returned 1 [0179.579] free (_Block=0xd70340) [0179.580] CloseHandle (hObject=0x130) returned 1 [0179.580] _ui64tow_s (in: _Value=0xc18, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3096") returned 0x0 [0179.585] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3096") returned 4 [0179.586] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.586] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.601] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc18) returned 0x130 [0179.601] GetLastError () returned 0x0 [0179.601] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.601] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5cb018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.601] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.602] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x251c70, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.602] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x251888, lpBuffer=0xedc580, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.603] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.604] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.604] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5cb020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.604] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x251270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.604] malloc (_Size=0x6c) returned 0xd74e80 [0179.604] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2518ec, lpBuffer=0xd74e80, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0179.605] free (_Block=0xd74e80) [0179.605] CloseHandle (hObject=0x130) returned 1 [0179.606] _ui64tow_s (in: _Value=0xc20, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3104") returned 0x0 [0179.609] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3104") returned 4 [0179.610] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.610] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.630] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc20) returned 0x130 [0179.630] GetLastError () returned 0x0 [0179.631] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.631] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3bf018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.631] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.631] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x451c90, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.631] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x451888, lpBuffer=0xedc580, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.632] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.633] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.633] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3bf020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.633] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x451270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.633] malloc (_Size=0x76) returned 0xd74e80 [0179.633] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4518f6, lpBuffer=0xd74e80, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0179.634] free (_Block=0xd74e80) [0179.634] CloseHandle (hObject=0x130) returned 1 [0179.635] _ui64tow_s (in: _Value=0xc28, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3112") returned 0x0 [0179.639] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3112") returned 4 [0179.640] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.640] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.653] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc28) returned 0x130 [0179.653] GetLastError () returned 0x0 [0179.654] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.654] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x289018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.654] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.654] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x531c30, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.654] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x531888, lpBuffer=0xedc580, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.655] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.656] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.657] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x289020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.657] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x531270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.657] malloc (_Size=0x5a) returned 0xd702d0 [0179.657] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5318da, lpBuffer=0xd702d0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd702d0*, lpNumberOfBytesRead=0x0) returned 1 [0179.657] free (_Block=0xd702d0) [0179.658] CloseHandle (hObject=0x130) returned 1 [0179.659] _ui64tow_s (in: _Value=0xc30, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3120") returned 0x0 [0179.668] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3120") returned 4 [0179.669] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.669] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.682] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc30) returned 0x130 [0179.682] GetLastError () returned 0x0 [0179.683] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.683] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3fb018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.683] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.683] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5a1ca0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.683] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5a1888, lpBuffer=0xedc580, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.684] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.685] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.685] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3fb020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.685] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5a1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.686] malloc (_Size=0x7e) returned 0xd74e80 [0179.686] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5a18fe, lpBuffer=0xd74e80, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0179.686] free (_Block=0xd74e80) [0179.687] CloseHandle (hObject=0x130) returned 1 [0179.687] _ui64tow_s (in: _Value=0xc38, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3128") returned 0x0 [0179.693] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3128") returned 4 [0179.694] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.694] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.715] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc38) returned 0x130 [0179.715] GetLastError () returned 0x0 [0179.715] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.715] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x317018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.715] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.715] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a1c50, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.715] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a1888, lpBuffer=0xedc580, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.716] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.717] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.717] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x317020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.718] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.718] malloc (_Size=0x62) returned 0xd702d0 [0179.718] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a18e2, lpBuffer=0xd702d0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd702d0*, lpNumberOfBytesRead=0x0) returned 1 [0179.718] free (_Block=0xd702d0) [0179.719] CloseHandle (hObject=0x130) returned 1 [0179.719] _ui64tow_s (in: _Value=0xc40, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3136") returned 0x0 [0179.723] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3136") returned 4 [0179.724] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.724] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.735] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc40) returned 0x130 [0179.736] GetLastError () returned 0x0 [0179.736] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.736] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x27c018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.736] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.736] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x501cd0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.736] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x501888, lpBuffer=0xedc580, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.737] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.738] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.738] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x27c020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.739] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x501270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.739] malloc (_Size=0x8c) returned 0xd74e80 [0179.739] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x50190c, lpBuffer=0xd74e80, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0179.739] free (_Block=0xd74e80) [0179.740] CloseHandle (hObject=0x130) returned 1 [0179.741] _ui64tow_s (in: _Value=0xc4c, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3148") returned 0x0 [0179.745] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3148") returned 4 [0179.746] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.747] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.762] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc4c) returned 0x130 [0179.762] GetLastError () returned 0x0 [0179.762] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.763] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x244018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.763] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.763] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x561cf0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.763] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x561888, lpBuffer=0xedc580, nSize=0x90, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.764] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.765] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.765] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x244020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.765] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x561270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.765] malloc (_Size=0x98) returned 0xd74e80 [0179.765] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x561918, lpBuffer=0xd74e80, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0179.765] free (_Block=0xd74e80) [0179.766] CloseHandle (hObject=0x130) returned 1 [0179.766] _ui64tow_s (in: _Value=0xdc0, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3520") returned 0x0 [0179.770] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3520") returned 4 [0179.771] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.771] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.782] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdc0) returned 0x130 [0179.783] GetLastError () returned 0x0 [0179.783] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.783] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x564018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.783] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.783] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x371c90, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.783] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x371888, lpBuffer=0xedc580, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.784] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.785] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.785] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x564020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.785] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x371270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.785] malloc (_Size=0x7a) returned 0xd74e80 [0179.785] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3718fa, lpBuffer=0xd74e80, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0179.786] free (_Block=0xd74e80) [0179.787] CloseHandle (hObject=0x130) returned 1 [0179.787] _ui64tow_s (in: _Value=0xdc8, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3528") returned 0x0 [0179.791] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3528") returned 4 [0179.792] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.792] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.811] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdc8) returned 0x130 [0179.811] GetLastError () returned 0x0 [0179.812] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.812] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x395018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.812] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.812] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x581c20, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.812] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x581888, lpBuffer=0xedc580, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.813] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.814] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.814] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x395020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.814] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x581270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.814] malloc (_Size=0x54) returned 0xd78000 [0179.814] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5818d4, lpBuffer=0xd78000, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd78000*, lpNumberOfBytesRead=0x0) returned 1 [0179.815] free (_Block=0xd78000) [0179.815] CloseHandle (hObject=0x130) returned 1 [0179.816] _ui64tow_s (in: _Value=0xdd0, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3536") returned 0x0 [0179.819] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3536") returned 4 [0179.820] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.820] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.832] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdd0) returned 0x130 [0179.833] GetLastError () returned 0x0 [0179.833] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.833] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2a8018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.833] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.833] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x521c80, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.833] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x521888, lpBuffer=0xedc580, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.834] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.835] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.835] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2a8020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.836] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x521270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.836] malloc (_Size=0x72) returned 0xd74e80 [0179.836] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5218f2, lpBuffer=0xd74e80, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0179.836] free (_Block=0xd74e80) [0179.837] CloseHandle (hObject=0x130) returned 1 [0179.837] _ui64tow_s (in: _Value=0xdd8, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3544") returned 0x0 [0179.843] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3544") returned 4 [0179.845] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.845] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.866] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdd8) returned 0x130 [0179.866] GetLastError () returned 0x0 [0179.866] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.866] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5ef018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.866] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.867] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1e1c90, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.867] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1e1888, lpBuffer=0xedc580, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.868] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.869] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.869] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5ef020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.869] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1e1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.869] malloc (_Size=0x78) returned 0xd74e80 [0179.869] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1e18f8, lpBuffer=0xd74e80, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0179.870] free (_Block=0xd74e80) [0179.870] CloseHandle (hObject=0x130) returned 1 [0179.871] _ui64tow_s (in: _Value=0xde0, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3552") returned 0x0 [0179.875] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3552") returned 4 [0179.876] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.876] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.891] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xde0) returned 0x130 [0179.891] GetLastError () returned 0x0 [0179.891] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.891] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x32a018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.891] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.891] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a1ca0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.892] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a1888, lpBuffer=0xedc580, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.892] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.894] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.894] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x32a020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.894] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.901] malloc (_Size=0x7e) returned 0xd74e80 [0179.902] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a18fe, lpBuffer=0xd74e80, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0179.902] free (_Block=0xd74e80) [0179.903] CloseHandle (hObject=0x130) returned 1 [0179.903] _ui64tow_s (in: _Value=0xde8, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3560") returned 0x0 [0179.907] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3560") returned 4 [0179.908] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.908] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.923] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xde8) returned 0x130 [0179.923] GetLastError () returned 0x0 [0179.924] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.924] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2d2018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.924] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.924] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4b1c40, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.924] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4b1888, lpBuffer=0xedc580, nSize=0x54, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.925] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.926] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.926] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2d2020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.926] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4b1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.927] malloc (_Size=0x5c) returned 0xd70570 [0179.927] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4b18dc, lpBuffer=0xd70570, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd70570*, lpNumberOfBytesRead=0x0) returned 1 [0179.927] free (_Block=0xd70570) [0179.928] CloseHandle (hObject=0x130) returned 1 [0179.928] _ui64tow_s (in: _Value=0xdf0, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3568") returned 0x0 [0179.932] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3568") returned 4 [0179.934] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.934] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.952] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdf0) returned 0x130 [0179.952] GetLastError () returned 0x0 [0179.953] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.953] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3d5018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.953] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.953] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x471c50, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.953] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x471888, lpBuffer=0xedc580, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.954] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.955] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.955] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3d5020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.955] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x471270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.955] malloc (_Size=0x64) returned 0xd70570 [0179.956] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4718e4, lpBuffer=0xd70570, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd70570*, lpNumberOfBytesRead=0x0) returned 1 [0179.956] free (_Block=0xd70570) [0179.957] CloseHandle (hObject=0x130) returned 1 [0179.957] _ui64tow_s (in: _Value=0xdf8, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3576") returned 0x0 [0179.961] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3576") returned 4 [0179.962] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.962] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0179.977] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdf8) returned 0x130 [0179.977] GetLastError () returned 0x0 [0179.977] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0179.977] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x365018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0179.977] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0179.977] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x511c60, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0179.978] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x511888, lpBuffer=0xedc580, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0179.979] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0179.980] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0179.980] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x365020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0179.980] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x511270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0179.980] malloc (_Size=0x68) returned 0xd6fe70 [0179.980] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5118e8, lpBuffer=0xd6fe70, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd6fe70*, lpNumberOfBytesRead=0x0) returned 1 [0179.981] free (_Block=0xd6fe70) [0179.981] CloseHandle (hObject=0x130) returned 1 [0179.982] _ui64tow_s (in: _Value=0xe00, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3584") returned 0x0 [0179.985] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3584") returned 4 [0179.986] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0179.986] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0180.008] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe00) returned 0x130 [0180.008] GetLastError () returned 0x0 [0180.008] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0180.008] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x313018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0180.008] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0180.008] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4f1c80, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0180.008] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4f1888, lpBuffer=0xedc580, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0180.009] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0180.010] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0180.011] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x313020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0180.011] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4f1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0180.011] malloc (_Size=0x74) returned 0xd74e80 [0180.011] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4f18f4, lpBuffer=0xd74e80, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0180.012] free (_Block=0xd74e80) [0180.012] CloseHandle (hObject=0x130) returned 1 [0180.013] _ui64tow_s (in: _Value=0xe08, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3592") returned 0x0 [0180.017] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3592") returned 4 [0180.018] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0180.018] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0180.034] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe08) returned 0x130 [0180.034] GetLastError () returned 0x0 [0180.034] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0180.034] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x200018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0180.034] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0180.044] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x471c90, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0180.044] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x471888, lpBuffer=0xedc580, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0180.045] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0180.046] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0180.046] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x200020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0180.046] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x471270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0180.047] malloc (_Size=0x78) returned 0xd74e80 [0180.047] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4718f8, lpBuffer=0xd74e80, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0180.047] free (_Block=0xd74e80) [0180.048] CloseHandle (hObject=0x130) returned 1 [0180.048] _ui64tow_s (in: _Value=0xe10, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3600") returned 0x0 [0180.052] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3600") returned 4 [0180.053] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0180.054] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0180.068] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe10) returned 0x130 [0180.068] GetLastError () returned 0x0 [0180.068] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0180.069] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x288018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0180.069] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0180.069] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0xd1c40, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0180.069] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0xd1888, lpBuffer=0xedc580, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0180.070] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0180.071] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0180.071] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x288020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0180.071] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0xd1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0180.071] malloc (_Size=0x5e) returned 0xd701f0 [0180.071] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0xd18de, lpBuffer=0xd701f0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd701f0*, lpNumberOfBytesRead=0x0) returned 1 [0180.072] free (_Block=0xd701f0) [0180.072] CloseHandle (hObject=0x130) returned 1 [0180.073] _ui64tow_s (in: _Value=0xe18, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3608") returned 0x0 [0180.077] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3608") returned 4 [0180.078] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0180.078] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0180.162] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe18) returned 0x130 [0180.162] GetLastError () returned 0x0 [0180.162] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0180.162] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x393018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0180.163] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0180.163] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x6e1c90, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0180.163] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x6e1888, lpBuffer=0xedc580, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0180.164] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0180.164] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0180.165] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x393020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0180.165] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x6e1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0180.165] malloc (_Size=0x76) returned 0xd74e80 [0180.165] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x6e18f6, lpBuffer=0xd74e80, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0180.165] free (_Block=0xd74e80) [0180.166] CloseHandle (hObject=0x130) returned 1 [0180.185] _ui64tow_s (in: _Value=0xe20, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3616") returned 0x0 [0180.188] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3616") returned 4 [0180.189] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0180.189] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0180.201] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe20) returned 0x130 [0180.201] GetLastError () returned 0x0 [0180.202] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0180.202] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2c9018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0180.202] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0180.202] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x471c60, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0180.202] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x471888, lpBuffer=0xedc580, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0180.203] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0180.204] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0180.204] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2c9020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0180.204] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x471270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0180.204] malloc (_Size=0x68) returned 0xd702d0 [0180.204] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4718e8, lpBuffer=0xd702d0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd702d0*, lpNumberOfBytesRead=0x0) returned 1 [0180.204] free (_Block=0xd702d0) [0180.205] CloseHandle (hObject=0x130) returned 1 [0180.205] _ui64tow_s (in: _Value=0xe28, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3624") returned 0x0 [0180.213] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3624") returned 4 [0180.214] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0180.214] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0180.226] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe28) returned 0x130 [0180.226] GetLastError () returned 0x0 [0180.226] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0180.226] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x25c018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0180.226] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0180.226] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x561c90, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0180.227] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x561888, lpBuffer=0xedc580, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0180.227] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0180.228] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0180.228] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x25c020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0180.228] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x561270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0180.229] malloc (_Size=0x7a) returned 0xd74e80 [0180.229] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5618fa, lpBuffer=0xd74e80, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0180.229] free (_Block=0xd74e80) [0180.230] CloseHandle (hObject=0x130) returned 1 [0180.230] _ui64tow_s (in: _Value=0xe30, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3632") returned 0x0 [0180.234] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3632") returned 4 [0180.235] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0180.235] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0180.248] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe30) returned 0x130 [0180.248] GetLastError () returned 0x0 [0180.248] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0180.248] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x21e018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0180.248] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0180.248] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a1c80, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0180.249] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a1888, lpBuffer=0xedc580, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0180.249] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0180.250] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0180.250] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x21e020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0180.251] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0180.251] malloc (_Size=0x74) returned 0xd74e80 [0180.251] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a18f4, lpBuffer=0xd74e80, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0180.251] free (_Block=0xd74e80) [0180.252] CloseHandle (hObject=0x130) returned 1 [0180.252] _ui64tow_s (in: _Value=0xe38, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3640") returned 0x0 [0180.263] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3640") returned 4 [0180.264] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0180.264] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0180.277] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe38) returned 0x130 [0180.277] GetLastError () returned 0x0 [0180.278] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0180.278] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x34a018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0180.278] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0180.278] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x461c90, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0180.278] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x461888, lpBuffer=0xedc580, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0180.279] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0180.281] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0180.281] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x34a020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0180.281] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x461270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0180.281] malloc (_Size=0x78) returned 0xd74e80 [0180.281] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4618f8, lpBuffer=0xd74e80, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0180.282] free (_Block=0xd74e80) [0180.283] CloseHandle (hObject=0x130) returned 1 [0180.284] _ui64tow_s (in: _Value=0xe40, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3648") returned 0x0 [0180.315] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3648") returned 4 [0180.315] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0180.315] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0180.328] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe40) returned 0x130 [0180.328] GetLastError () returned 0x0 [0180.329] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0180.329] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x38c018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0180.329] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0180.329] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1d1c60, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0180.329] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1d1888, lpBuffer=0xedc580, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0180.330] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0180.339] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0180.339] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x38c020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0180.339] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1d1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0180.339] malloc (_Size=0x66) returned 0xd70500 [0180.339] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1d18e6, lpBuffer=0xd70500, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd70500*, lpNumberOfBytesRead=0x0) returned 1 [0180.340] free (_Block=0xd70500) [0180.340] CloseHandle (hObject=0x130) returned 1 [0180.340] _ui64tow_s (in: _Value=0xe48, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3656") returned 0x0 [0180.343] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3656") returned 4 [0180.344] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0180.344] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0180.356] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe48) returned 0x130 [0180.356] GetLastError () returned 0x0 [0180.356] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0180.357] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3a3018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0180.357] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0180.357] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x461cb0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0180.357] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4618e8, lpBuffer=0xedc580, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0180.358] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0180.358] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0180.358] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3a3020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0180.359] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4612d0, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0180.359] malloc (_Size=0x62) returned 0xd70570 [0180.359] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x461942, lpBuffer=0xd70570, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd70570*, lpNumberOfBytesRead=0x0) returned 1 [0180.359] free (_Block=0xd70570) [0180.360] CloseHandle (hObject=0x130) returned 1 [0180.360] _ui64tow_s (in: _Value=0xe50, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3664") returned 0x0 [0180.364] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3664") returned 4 [0180.364] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0180.364] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0180.378] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe50) returned 0x130 [0180.378] GetLastError () returned 0x0 [0180.378] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0180.383] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x353018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0180.383] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0180.383] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4d1c70, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0180.383] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4d1888, lpBuffer=0xedc580, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0180.384] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0180.385] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0180.385] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x353020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0180.385] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4d1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0180.385] malloc (_Size=0x6c) returned 0xd74e80 [0180.386] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4d18ec, lpBuffer=0xd74e80, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0180.386] free (_Block=0xd74e80) [0180.387] CloseHandle (hObject=0x130) returned 1 [0180.387] _ui64tow_s (in: _Value=0xe58, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3672") returned 0x0 [0180.391] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3672") returned 4 [0180.392] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0180.392] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0180.406] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe58) returned 0x130 [0180.406] GetLastError () returned 0x0 [0180.406] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0180.406] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x37b018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0180.406] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0180.407] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5e1c60, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0180.407] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5e1888, lpBuffer=0xedc580, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0180.407] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0180.409] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0180.409] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x37b020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0180.409] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5e1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0180.409] malloc (_Size=0x6a) returned 0xd74e80 [0180.409] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5e18ea, lpBuffer=0xd74e80, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0180.410] free (_Block=0xd74e80) [0180.410] CloseHandle (hObject=0x130) returned 1 [0180.411] _ui64tow_s (in: _Value=0xe60, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3680") returned 0x0 [0180.415] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3680") returned 4 [0180.415] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0180.416] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0180.459] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe60) returned 0x130 [0180.459] GetLastError () returned 0x0 [0180.459] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0180.459] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x20e018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0180.460] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0180.460] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a1c50, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0180.460] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a1888, lpBuffer=0xedc580, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0180.461] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0180.462] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0180.462] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x20e020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0180.462] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0180.462] malloc (_Size=0x62) returned 0xd70570 [0180.462] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4a18e2, lpBuffer=0xd70570, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd70570*, lpNumberOfBytesRead=0x0) returned 1 [0180.463] free (_Block=0xd70570) [0180.464] CloseHandle (hObject=0x130) returned 1 [0180.464] _ui64tow_s (in: _Value=0xe68, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3688") returned 0x0 [0180.468] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3688") returned 4 [0180.469] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0180.469] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0180.492] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe68) returned 0x130 [0180.492] GetLastError () returned 0x0 [0180.493] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0180.493] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x305018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0180.493] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0180.493] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x501c80, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0180.493] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x501888, lpBuffer=0xedc580, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0180.494] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0180.495] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0180.495] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x305020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0180.495] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x501270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0180.495] malloc (_Size=0x72) returned 0xd74e80 [0180.495] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5018f2, lpBuffer=0xd74e80, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0180.496] free (_Block=0xd74e80) [0180.497] CloseHandle (hObject=0x130) returned 1 [0180.497] _ui64tow_s (in: _Value=0xe70, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3696") returned 0x0 [0180.501] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3696") returned 4 [0180.502] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0180.502] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0180.526] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe70) returned 0x130 [0180.526] GetLastError () returned 0x0 [0180.526] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0180.526] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4bb018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0180.526] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0180.526] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x271c70, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0180.526] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x271888, lpBuffer=0xedc580, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0180.527] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0180.529] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0180.529] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4bb020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0180.529] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x271270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0180.529] malloc (_Size=0x70) returned 0xd74e80 [0180.529] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2718f0, lpBuffer=0xd74e80, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0180.530] free (_Block=0xd74e80) [0180.530] CloseHandle (hObject=0x130) returned 1 [0180.531] _ui64tow_s (in: _Value=0xe78, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3704") returned 0x0 [0180.550] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3704") returned 4 [0180.551] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0180.551] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0180.575] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe78) returned 0x130 [0180.575] GetLastError () returned 0x0 [0180.576] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0180.576] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x28e018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0180.576] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0180.576] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x491c60, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0180.576] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x491888, lpBuffer=0xedc580, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0180.577] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0180.578] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0180.578] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x28e020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0180.579] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x491270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0180.579] malloc (_Size=0x6a) returned 0xd74e80 [0180.579] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4918ea, lpBuffer=0xd74e80, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0180.579] free (_Block=0xd74e80) [0180.580] CloseHandle (hObject=0x130) returned 1 [0180.580] _ui64tow_s (in: _Value=0xe80, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3712") returned 0x0 [0180.585] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3712") returned 4 [0180.586] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0180.586] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0180.601] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe80) returned 0x130 [0180.601] GetLastError () returned 0x0 [0180.602] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0180.602] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3f4018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0180.602] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0180.602] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5d1c80, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0180.602] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5d1888, lpBuffer=0xedc580, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0180.603] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0180.604] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0180.604] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3f4020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0180.604] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5d1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0180.605] malloc (_Size=0x72) returned 0xd74e80 [0180.605] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5d18f2, lpBuffer=0xd74e80, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0180.605] free (_Block=0xd74e80) [0180.606] CloseHandle (hObject=0x130) returned 1 [0180.607] _ui64tow_s (in: _Value=0xe88, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3720") returned 0x0 [0180.612] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3720") returned 4 [0180.619] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0180.619] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0180.636] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe88) returned 0x130 [0180.636] GetLastError () returned 0x0 [0180.636] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0180.637] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3fe018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0180.637] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0180.637] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x481c90, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0180.637] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x481888, lpBuffer=0xedc580, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0180.638] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0180.640] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0180.640] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3fe020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0180.640] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x481270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0180.641] malloc (_Size=0x7a) returned 0xd74e80 [0180.641] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4818fa, lpBuffer=0xd74e80, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0180.641] free (_Block=0xd74e80) [0180.642] CloseHandle (hObject=0x130) returned 1 [0180.642] _ui64tow_s (in: _Value=0xe90, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3728") returned 0x0 [0180.648] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3728") returned 4 [0180.650] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0180.650] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0180.675] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe90) returned 0x130 [0180.675] GetLastError () returned 0x0 [0180.675] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0180.677] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x246018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0180.677] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0180.677] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4d1c60, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0180.677] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4d1888, lpBuffer=0xedc580, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0180.678] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0180.679] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0180.679] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x246020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0180.680] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4d1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0180.680] malloc (_Size=0x66) returned 0xd6fe70 [0180.680] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4d18e6, lpBuffer=0xd6fe70, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd6fe70*, lpNumberOfBytesRead=0x0) returned 1 [0180.680] free (_Block=0xd6fe70) [0180.681] CloseHandle (hObject=0x130) returned 1 [0180.681] _ui64tow_s (in: _Value=0xe98, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3736") returned 0x0 [0180.685] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3736") returned 4 [0180.687] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0180.687] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0180.702] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe98) returned 0x130 [0180.702] GetLastError () returned 0x0 [0180.702] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0180.702] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x38e018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0180.702] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0180.702] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1f1ce0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0180.703] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1f1888, lpBuffer=0xedc580, nSize=0x8c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0180.704] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0180.705] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0180.705] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x38e020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0180.705] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1f1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0180.705] malloc (_Size=0x94) returned 0xd74e80 [0180.705] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1f1914, lpBuffer=0xd74e80, nSize=0x92, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0180.706] free (_Block=0xd74e80) [0180.712] CloseHandle (hObject=0x130) returned 1 [0180.712] _ui64tow_s (in: _Value=0xea0, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3744") returned 0x0 [0180.716] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3744") returned 4 [0180.717] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0180.717] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0180.730] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xea0) returned 0x130 [0180.730] GetLastError () returned 0x0 [0180.730] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0180.730] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3c7018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0180.731] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0180.731] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5a1c80, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0180.731] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5a1888, lpBuffer=0xedc580, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0180.732] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0180.733] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0180.733] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3c7020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0180.733] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5a1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0180.733] malloc (_Size=0x72) returned 0xd74e80 [0180.733] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5a18f2, lpBuffer=0xd74e80, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0180.734] free (_Block=0xd74e80) [0180.734] CloseHandle (hObject=0x130) returned 1 [0180.735] _ui64tow_s (in: _Value=0xf84, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3972") returned 0x0 [0180.739] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3972") returned 4 [0180.741] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0180.741] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0180.763] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf84) returned 0x130 [0180.763] GetLastError () returned 0x0 [0180.764] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0180.764] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2c0018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0180.764] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0180.764] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x471c60, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0180.764] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x471888, lpBuffer=0xedc580, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0180.765] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0180.766] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0180.766] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2c0020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0180.766] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x471270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0180.767] malloc (_Size=0x68) returned 0xd6fe70 [0180.767] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4718e8, lpBuffer=0xd6fe70, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd6fe70*, lpNumberOfBytesRead=0x0) returned 1 [0180.767] free (_Block=0xd6fe70) [0180.768] CloseHandle (hObject=0x130) returned 1 [0180.768] _ui64tow_s (in: _Value=0xf90, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3984") returned 0x0 [0180.772] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3984") returned 4 [0180.773] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0180.773] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0180.786] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf90) returned 0x130 [0180.786] GetLastError () returned 0x0 [0180.786] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0180.786] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x319018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0180.786] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0180.786] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x491cb0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0180.786] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x491888, lpBuffer=0xedc580, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0180.787] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0180.788] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0180.788] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x319020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0180.788] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x491270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0180.788] malloc (_Size=0x82) returned 0xd74e80 [0180.788] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x491902, lpBuffer=0xd74e80, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0180.789] free (_Block=0xd74e80) [0180.789] CloseHandle (hObject=0x130) returned 1 [0180.790] _ui64tow_s (in: _Value=0xfa0, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="4000") returned 0x0 [0180.793] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="4000") returned 4 [0180.794] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0180.794] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0180.809] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfa0) returned 0x130 [0180.809] GetLastError () returned 0x0 [0180.810] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0180.810] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x296018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0180.810] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0180.810] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5c1c60, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0180.810] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5c1888, lpBuffer=0xedc580, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0180.811] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0180.812] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0180.812] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x296020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0180.812] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5c1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0180.812] malloc (_Size=0x66) returned 0xd701f0 [0180.812] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5c18e6, lpBuffer=0xd701f0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd701f0*, lpNumberOfBytesRead=0x0) returned 1 [0180.812] free (_Block=0xd701f0) [0180.813] CloseHandle (hObject=0x130) returned 1 [0180.813] _ui64tow_s (in: _Value=0xfa8, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="4008") returned 0x0 [0180.818] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="4008") returned 4 [0180.819] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0180.819] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0180.846] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfa8) returned 0x130 [0180.846] GetLastError () returned 0x0 [0180.847] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0180.847] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x236018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0180.863] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0180.864] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x461c90, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0180.864] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x461888, lpBuffer=0xedc580, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0180.865] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0180.866] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0180.866] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x236020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0180.866] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x461270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0180.867] malloc (_Size=0x7a) returned 0xd74e80 [0180.867] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4618fa, lpBuffer=0xd74e80, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0180.867] free (_Block=0xd74e80) [0180.868] CloseHandle (hObject=0x130) returned 1 [0180.869] _ui64tow_s (in: _Value=0xfbc, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="4028") returned 0x0 [0180.873] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="4028") returned 4 [0180.874] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0180.874] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0180.900] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfbc) returned 0x130 [0180.900] GetLastError () returned 0x0 [0180.900] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0180.900] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x242018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0180.900] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0180.900] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x571cc0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0180.901] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x571888, lpBuffer=0xedc580, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0180.902] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0180.903] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0180.903] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x242020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0180.903] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x571270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0180.903] malloc (_Size=0x86) returned 0xd74e80 [0180.903] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x571906, lpBuffer=0xd74e80, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0180.904] free (_Block=0xd74e80) [0180.904] CloseHandle (hObject=0x130) returned 1 [0180.905] _ui64tow_s (in: _Value=0xfc4, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="4036") returned 0x0 [0180.909] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="4036") returned 4 [0180.924] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0180.924] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0180.939] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfc4) returned 0x130 [0180.939] GetLastError () returned 0x0 [0180.940] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0180.940] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x22e018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0180.940] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0180.940] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5f1c50, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0180.940] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5f1888, lpBuffer=0xedc580, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0180.942] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0180.943] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0180.943] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x22e020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0180.943] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5f1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0180.943] malloc (_Size=0x64) returned 0xd702d0 [0180.943] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5f18e4, lpBuffer=0xd702d0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd702d0*, lpNumberOfBytesRead=0x0) returned 1 [0180.944] free (_Block=0xd702d0) [0180.944] CloseHandle (hObject=0x130) returned 1 [0180.945] _ui64tow_s (in: _Value=0xfcc, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="4044") returned 0x0 [0180.948] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="4044") returned 4 [0180.949] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0180.949] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0180.977] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfcc) returned 0x130 [0180.978] GetLastError () returned 0x0 [0180.978] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0180.978] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x47b018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0180.978] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0180.978] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x261c60, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0180.978] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x261888, lpBuffer=0xedc580, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0180.979] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0180.981] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0180.981] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x47b020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0180.981] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x261270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0180.981] malloc (_Size=0x66) returned 0xd70340 [0180.981] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2618e6, lpBuffer=0xd70340, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd70340*, lpNumberOfBytesRead=0x0) returned 1 [0180.982] free (_Block=0xd70340) [0180.982] CloseHandle (hObject=0x130) returned 1 [0180.983] _ui64tow_s (in: _Value=0xfd4, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="4052") returned 0x0 [0180.986] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="4052") returned 4 [0180.987] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0180.987] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0181.000] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfd4) returned 0x130 [0181.000] GetLastError () returned 0x0 [0181.000] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0181.000] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5b0018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0181.001] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0181.001] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1e1c80, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0181.001] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1e1888, lpBuffer=0xedc580, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0181.001] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0181.002] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0181.002] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5b0020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0181.003] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1e1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0181.003] malloc (_Size=0x72) returned 0xd74e80 [0181.003] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1e18f2, lpBuffer=0xd74e80, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0181.003] free (_Block=0xd74e80) [0181.023] CloseHandle (hObject=0x130) returned 1 [0181.023] _ui64tow_s (in: _Value=0xfdc, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="4060") returned 0x0 [0181.026] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="4060") returned 4 [0181.027] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0181.027] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0181.039] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfdc) returned 0x130 [0181.040] GetLastError () returned 0x0 [0181.040] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0181.040] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x277018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0181.040] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0181.040] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1f1c70, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0181.040] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1f1888, lpBuffer=0xedc580, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0181.041] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0181.042] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0181.042] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x277020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0181.042] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1f1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0181.042] malloc (_Size=0x70) returned 0xd74e80 [0181.042] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1f18f0, lpBuffer=0xd74e80, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0181.043] free (_Block=0xd74e80) [0181.043] CloseHandle (hObject=0x130) returned 1 [0181.044] _ui64tow_s (in: _Value=0xfec, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="4076") returned 0x0 [0181.047] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="4076") returned 4 [0181.048] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0181.048] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0181.060] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfec) returned 0x130 [0181.060] GetLastError () returned 0x0 [0181.061] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0181.061] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2d0018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0181.061] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0181.061] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5b1c90, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0181.061] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5b1888, lpBuffer=0xedc580, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0181.062] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0181.063] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0181.063] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2d0020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0181.063] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5b1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0181.063] malloc (_Size=0x76) returned 0xd74e80 [0181.063] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5b18f6, lpBuffer=0xd74e80, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0181.064] free (_Block=0xd74e80) [0181.064] CloseHandle (hObject=0x130) returned 1 [0181.065] _ui64tow_s (in: _Value=0x724, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1828") returned 0x0 [0181.077] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1828") returned 4 [0181.077] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0181.077] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0181.090] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x724) returned 0x130 [0181.090] GetLastError () returned 0x0 [0181.090] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0181.090] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x44b018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0181.091] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0181.091] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3e1c50, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0181.091] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3e1888, lpBuffer=0xedc580, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0181.092] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0181.093] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0181.093] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x44b020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0181.093] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3e1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0181.093] malloc (_Size=0x64) returned 0xd70570 [0181.093] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3e18e4, lpBuffer=0xd70570, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd70570*, lpNumberOfBytesRead=0x0) returned 1 [0181.094] free (_Block=0xd70570) [0181.094] CloseHandle (hObject=0x130) returned 1 [0181.094] _ui64tow_s (in: _Value=0x61c, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1564") returned 0x0 [0181.098] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1564") returned 4 [0181.099] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0181.099] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0181.111] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x61c) returned 0x130 [0181.111] GetLastError () returned 0x0 [0181.111] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0181.111] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x376018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0181.111] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0181.112] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1f1c70, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0181.112] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1f1888, lpBuffer=0xedc580, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0181.112] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0181.127] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0181.127] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x376020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0181.127] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1f1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0181.127] malloc (_Size=0x6e) returned 0xd74e80 [0181.127] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1f18ee, lpBuffer=0xd74e80, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0181.128] free (_Block=0xd74e80) [0181.128] CloseHandle (hObject=0x130) returned 1 [0181.129] _ui64tow_s (in: _Value=0x684, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="1668") returned 0x0 [0181.132] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="1668") returned 4 [0181.133] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0181.133] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0181.146] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x684) returned 0x130 [0181.146] GetLastError () returned 0x0 [0181.146] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0181.146] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2a0018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0181.146] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0181.147] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4c1cb0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0181.147] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4c1888, lpBuffer=0xedc580, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0181.147] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0181.148] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0181.149] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2a0020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0181.149] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4c1270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0181.149] malloc (_Size=0x82) returned 0xd74e80 [0181.149] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4c1902, lpBuffer=0xd74e80, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0181.150] free (_Block=0xd74e80) [0181.150] CloseHandle (hObject=0x130) returned 1 [0181.170] _ui64tow_s (in: _Value=0x3a8, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="936") returned 0x0 [0181.173] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="936") returned 3 [0181.174] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0181.174] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0181.197] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3a8) returned 0x130 [0181.197] GetLastError () returned 0x0 [0181.197] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0181.198] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2b5018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0181.198] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0181.198] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x541c80, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0181.198] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x541888, lpBuffer=0xedc580, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0181.199] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0181.200] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0181.200] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2b5020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0181.200] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x541270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0181.200] malloc (_Size=0x72) returned 0xd74e80 [0181.200] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5418f2, lpBuffer=0xd74e80, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0181.201] free (_Block=0xd74e80) [0181.201] CloseHandle (hObject=0x130) returned 1 [0181.202] _ui64tow_s (in: _Value=0xcdc, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3292") returned 0x0 [0181.205] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3292") returned 4 [0181.206] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0181.206] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0181.218] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xcdc) returned 0x130 [0181.218] GetLastError () returned 0x0 [0181.218] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0181.218] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x444018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0181.219] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0181.219] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x341ca0, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0181.219] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x341888, lpBuffer=0xedc580, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0181.219] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0181.220] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0181.220] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x444020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0181.221] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x341270, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0181.221] malloc (_Size=0x7e) returned 0xd74e80 [0181.221] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x3418fe, lpBuffer=0xd74e80, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0181.221] free (_Block=0xd74e80) [0181.222] CloseHandle (hObject=0x130) returned 1 [0181.228] _ui64tow_s (in: _Value=0xbe8, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="3048") returned 0x0 [0181.232] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="3048") returned 4 [0181.233] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0181.233] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0181.245] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xbe8) returned 0x130 [0181.245] GetLastError () returned 0x0 [0181.245] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0181.245] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2ce018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0181.246] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0181.246] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x561b60, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0181.246] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5617a8, lpBuffer=0xedc580, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0181.246] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0181.247] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0181.247] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x2ce020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0181.247] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x561190, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0181.248] malloc (_Size=0x76) returned 0xd767f0 [0181.248] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x5617f4, lpBuffer=0xd767f0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0181.248] free (_Block=0xd767f0) [0181.249] CloseHandle (hObject=0x130) returned 1 [0181.249] _ui64tow_s (in: _Value=0x1024, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="4132") returned 0x0 [0181.252] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="4132") returned 4 [0181.254] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0181.254] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0181.266] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1024) returned 0x130 [0181.267] GetLastError () returned 0x0 [0181.267] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0181.267] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x276018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0181.267] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0181.267] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403670, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0181.267] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x4032b2, lpBuffer=0xedc580, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0181.268] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0181.278] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0181.278] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x276020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0181.278] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x402c00, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0181.278] malloc (_Size=0xce) returned 0xd767f0 [0181.278] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x403308, lpBuffer=0xd767f0, nSize=0xcc, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd767f0*, lpNumberOfBytesRead=0x0) returned 1 [0181.279] free (_Block=0xd767f0) [0181.280] CloseHandle (hObject=0x130) returned 1 [0181.280] _ui64tow_s (in: _Value=0x1070, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="4208") returned 0x0 [0181.283] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="4208") returned 4 [0181.284] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0181.284] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0181.321] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1070) returned 0x0 [0181.321] CloseHandle (hObject=0x0) returned 0 [0181.322] _ui64tow_s (in: _Value=0x1114, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="4372") returned 0x0 [0181.326] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="4372") returned 4 [0181.327] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0181.328] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0181.342] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1114) returned 0x0 [0181.342] CloseHandle (hObject=0x0) returned 0 [0181.343] _ui64tow_s (in: _Value=0x11b4, _Buffer=0xedd750, _BufferCount=0x104, _Radix=10 | out: _Buffer="4532") returned 0x0 [0181.347] _vsnwprintf (in: _Buffer=0xedd470, _BufferCount=0x103, _Format="%lu", _ArgList=0xedc7f8 | out: _Buffer="4532") returned 4 [0181.364] GetVersionExW (in: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0xedc8b0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0181.364] _vsnwprintf (in: _Buffer=0xedd260, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0xedc7f8 | out: _Buffer="10.0.10586") returned 10 [0181.379] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x11b4) returned 0x130 [0181.379] GetLastError () returned 0x0 [0181.379] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc850, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc850, ReturnLength=0x0) returned 0x0 [0181.379] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x38a018, lpBuffer=0xedc820, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc820*, lpNumberOfBytesRead=0x0) returned 1 [0181.379] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x7ffa168b5220, lpBuffer=0xedc810, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc810*, lpNumberOfBytesRead=0x0) returned 1 [0181.379] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1d1d60, lpBuffer=0xedcc30, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedcc30*, lpNumberOfBytesRead=0x0) returned 1 [0181.380] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1d1858, lpBuffer=0xedc580, nSize=0xc6, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc580*, lpNumberOfBytesRead=0x0) returned 1 [0181.380] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x1, ProcessInformation=0xedc880, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc880, ReturnLength=0x0) returned 0x0 [0181.382] NtQueryInformationProcess (in: ProcessHandle=0x130, ProcessInformationClass=0x0, ProcessInformation=0xedc358, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xedc358, ReturnLength=0x0) returned 0x0 [0181.382] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x38a020, lpBuffer=0xedc340, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc340*, lpNumberOfBytesRead=0x0) returned 1 [0181.382] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1d1240, lpBuffer=0xedc390, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xedc390*, lpNumberOfBytesRead=0x0) returned 1 [0181.382] malloc (_Size=0xce) returned 0xd74e80 [0181.382] ReadProcessMemory (in: hProcess=0x130, lpBaseAddress=0x1d191e, lpBuffer=0xd74e80, nSize=0xcc, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xd74e80*, lpNumberOfBytesRead=0x0) returned 1 [0181.383] free (_Block=0xd74e80) [0181.383] CloseHandle (hObject=0x130) returned 1 [0181.385] free (_Block=0xd789c0) [0181.385] malloc (_Size=0x48) returned 0xd6d320 [0181.385] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xedd6d0 | out: lpSystemTimeAsFileTime=0xedd6d0*(dwLowDateTime=0x2347faab, dwHighDateTime=0x1d8a8f7)) [0181.385] SetEvent (hEvent=0x260) returned 1 [0181.403] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4) returned 0x589fc0 [0181.403] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x589fc0, pulNumLanguages=0xede1c0 | out: pulNumLanguages=0xede1c0) returned 1 [0181.403] RtlFreeHeap (HeapHandle=0x560000, Flags=0x0, BaseAddress=0x589fc0) returned 1 [0181.403] RtlFreeHeap (HeapHandle=0x560000, Flags=0x0, BaseAddress=0x58a0d0) returned 1 [0182.146] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0182.214] RtlRestoreLastWin32Error () returned 0x2d5000 [0182.214] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xede118, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xede010 | out: pulNumLanguages=0xede118, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xede010) returned 1 [0182.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x58a0d0 [0182.214] RtlRestoreLastWin32Error () returned 0x2d5000 [0182.214] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xede118, pwszLanguagesBuffer=0x58a0d0, pcchLanguagesBuffer=0xede010 | out: pulNumLanguages=0xede118, pwszLanguagesBuffer=0x58a0d0, pcchLanguagesBuffer=0xede010) returned 1 [0182.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x589fc0 [0182.214] RtlFreeHeap (HeapHandle=0x560000, Flags=0x0, BaseAddress=0x58a0d0) returned 1 [0182.214] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x14) returned 0x5bdbc0 [0182.214] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x5bdbc0, pulNumLanguages=0xede118 | out: pulNumLanguages=0xede118) returned 1 [0182.214] RtlFreeHeap (HeapHandle=0x560000, Flags=0x0, BaseAddress=0x5bdbc0) returned 1 [0182.217] malloc (_Size=0x600) returned 0xd771a0 [0182.217] GetLogicalProcessorInformationEx (in: RelationshipType=0xffff, Buffer=0x0, ReturnedLength=0xedd7f8 | out: Buffer=0x0, ReturnedLength=0xedd7f8) returned 0 [0182.217] GetLastError () returned 0x7a [0182.217] malloc (_Size=0x250) returned 0xd75780 [0182.217] GetLogicalProcessorInformationEx (in: RelationshipType=0xffff, Buffer=0xd75780, ReturnedLength=0xedd7f8 | out: Buffer=0xd75780, ReturnedLength=0xedd7f8) returned 1 [0182.217] GetActiveProcessorCount (GroupNumber=0xffff) returned 0x4 [0182.217] GetMaximumProcessorGroupCount () returned 0x1 [0182.217] malloc (_Size=0x40) returned 0xd6c8d0 [0182.217] malloc (_Size=0x40) returned 0xd6c920 [0182.217] malloc (_Size=0x8) returned 0xd75b40 [0182.217] memcpy (in: _Dst=0xd6c8d0, _Src=0xd757a0, _Size=0x10 | out: _Dst=0xd6c8d0) returned 0xd6c8d0 [0182.223] GetActiveProcessorCount (GroupNumber=0x0) returned 0x4 [0182.223] NtPowerInformation (in: InformationLevel=0x2e, InputBuffer=0xedd7f0, InputBufferLength=0x2, OutputBuffer=0xd771a0, OutputBufferLength=0x60 | out: OutputBuffer=0xd771a0) returned 0x0 [0182.224] _vsnwprintf (in: _Buffer=0xedd690, _BufferCount=0x63, _Format="CPU%d", _ArgList=0xedcf88 | out: _Buffer="CPU0") returned 4 [0182.224] GetCurrentThread () returned 0xfffffffffffffffe [0182.224] SetThreadGroupAffinity (in: hThread=0xfffffffffffffffe, GroupAffinity=0xedcee0, PreviousGroupAffinity=0xedcef0 | out: PreviousGroupAffinity=0xedcef0) returned 1 [0182.224] GetSystemInfo (in: lpSystemInfo=0xedd020 | out: lpSystemInfo=0xedd020*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0182.225] mbstowcs (in: _Dest=0xedd2a8, _Source="GenuineIntel", _MaxCount=0x28 | out: _Dest="GenuineIntel") returned 0xc [0182.225] _wcsicmp (_String1="GenuineIntel", _String2="GenuineIntel") returned 0 [0182.227] mbstowcs (in: _Dest=0xedd118, _Source="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", _MaxCount=0x28 | out: _Dest="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x27 [0182.227] GetCurrentThread () returned 0xfffffffffffffffe [0182.227] SetThreadGroupAffinity (in: hThread=0xfffffffffffffffe, GroupAffinity=0xedcef0, PreviousGroupAffinity=0x0 | out: PreviousGroupAffinity=0x0) returned 1 [0182.231] LoadStringW (in: hInstance=0x7ff9fc0d0000, uID=0x2c, lpBuffer=0xedccf0, cchBufferMax=256 | out: lpBuffer="CPU %d") returned 0x6 [0186.900] malloc (_Size=0x35140) returned 0xd792e0 [0186.911] _wtoi (_String="238") returned 238 [0186.911] _wtoi (_String="6") returned 6 [0186.911] _itow (in: _Dest=0x0, _Radix=15586752 | out: _Dest=0x0) returned="0" [0186.911] _itow (in: _Dest=0xee, _Radix=15585040 | out: _Dest=0xee) returned="238" [0186.911] malloc (_Size=0x4000) returned 0xdae430 [0186.911] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x0, lpData=0xdae430, lpcbData=0xedcee4*=0x4000 | out: lpType=0x0, lpData=0xdae430*=0x50, lpcbData=0xedcee4*=0x600) returned 0x0 [0187.053] free (_Block=0xdae430) [0187.053] Sleep (dwMilliseconds=0x3e8) [0188.056] _itow (in: _Dest=0xee, _Radix=15585040 | out: _Dest=0xee) returned="238" [0188.056] malloc (_Size=0x4000) returned 0xdae430 [0188.056] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x0, lpData=0xdae430, lpcbData=0xedcee4*=0x4000 | out: lpType=0x0, lpData=0xdae430*=0x50, lpcbData=0xedcee4*=0x600) returned 0x0 [0188.114] free (_Block=0xdae430) [0188.118] free (_Block=0xd792e0) [0188.128] _vsnwprintf (in: _Buffer=0xedd5c0, _BufferCount=0x40, _Format="%04X%04X%04X%04X", _ArgList=0xedcf88 | out: _Buffer="0F8BFBFF00050654") returned 16 [0188.134] lstrlenW (lpString=" 0") returned 2 [0188.135] lstrlenW (lpString="Intel(R) Xeon(R) Gold 6126 CPU @ 2.60GHz") returned 40 [0188.135] lstrlenW (lpString="") returned 0 [0188.136] lstrlenW (lpString="") returned 0 [0188.136] lstrlenW (lpString="") returned 0 [0188.138] IsProcessorFeaturePresent (ProcessorFeature=0x14) returned 1 [0188.139] IsProcessorFeaturePresent (ProcessorFeature=0x15) returned 1 [0188.141] RtlNumberOfSetBitsUlongPtr (Target=0x1) returned 0x1 [0188.141] RtlNumberOfSetBitsUlongPtr (Target=0x2) returned 0x1 [0188.141] RtlNumberOfSetBitsUlongPtr (Target=0x4) returned 0x1 [0188.141] RtlNumberOfSetBitsUlongPtr (Target=0x8) returned 0x1 [0188.141] _vsnwprintf (in: _Buffer=0xedd880, _BufferCount=0x63, _Format="CPU%d", _ArgList=0xedd7c8 | out: _Buffer="CPU0") returned 4 [0188.143] free (_Block=0xd75b40) [0188.143] free (_Block=0xd6c920) [0188.144] free (_Block=0xd6c8d0) [0188.144] free (_Block=0xd75780) [0188.144] free (_Block=0xd771a0) [0188.174] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4) returned 0x5d3810 [0188.175] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x5d3810, pulNumLanguages=0xede1c0 | out: pulNumLanguages=0xede1c0) returned 1 [0188.175] RtlFreeHeap (HeapHandle=0x560000, Flags=0x0, BaseAddress=0x5d3810) returned 1 [0188.175] RtlFreeHeap (HeapHandle=0x560000, Flags=0x0, BaseAddress=0x589fc0) returned 1 [0188.448] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0188.641] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 Thread: id = 98 os_tid = 0xd5c Thread: id = 99 os_tid = 0x95c Process: id = "4" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0xd773000" os_pid = "0x3b8" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x274" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xe], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xe], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000abff" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 2459 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2460 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2461 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2462 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2463 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 2464 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 2465 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 2466 start_va = 0x100000 end_va = 0x1bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2467 start_va = 0x1c0000 end_va = 0x1c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 2468 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 2469 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 2470 start_va = 0x1f0000 end_va = 0x1f4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 2471 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 2472 start_va = 0x480000 end_va = 0x480fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000480000" filename = "" Region: id = 2473 start_va = 0x490000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 2474 start_va = 0x510000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 2475 start_va = 0x520000 end_va = 0x520fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 2476 start_va = 0x530000 end_va = 0x530fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 2477 start_va = 0x550000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 2478 start_va = 0x650000 end_va = 0x986fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2479 start_va = 0x990000 end_va = 0xb17fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000990000" filename = "" Region: id = 2480 start_va = 0xb20000 end_va = 0xca0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b20000" filename = "" Region: id = 2481 start_va = 0xcb0000 end_va = 0xd6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cb0000" filename = "" Region: id = 2482 start_va = 0xd70000 end_va = 0xe6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d70000" filename = "" Region: id = 2483 start_va = 0xe70000 end_va = 0xeeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e70000" filename = "" Region: id = 2484 start_va = 0xef0000 end_va = 0xf6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ef0000" filename = "" Region: id = 2485 start_va = 0xf70000 end_va = 0xfeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f70000" filename = "" Region: id = 2486 start_va = 0xff0000 end_va = 0x106ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ff0000" filename = "" Region: id = 2487 start_va = 0x1070000 end_va = 0x10effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001070000" filename = "" Region: id = 2488 start_va = 0x10f0000 end_va = 0x116ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010f0000" filename = "" Region: id = 2489 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2490 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 2491 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 2492 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 2493 start_va = 0x7ff7aedf0000 end_va = 0x7ff7aee6ffff monitored = 0 entry_point = 0x7ff7aee05f50 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 2494 start_va = 0x7ff9fdb60000 end_va = 0x7ff9fdbacfff monitored = 0 entry_point = 0x7ff9fdb6b470 region_type = mapped_file name = "pdh.dll" filename = "\\Windows\\System32\\pdh.dll" (normalized: "c:\\windows\\system32\\pdh.dll") Region: id = 2495 start_va = 0x7ff9fdbb0000 end_va = 0x7ff9fdbd4fff monitored = 1 entry_point = 0x7ff9fdbc5dc0 region_type = mapped_file name = "wmiperfclass.dll" filename = "\\Windows\\System32\\wbem\\WmiPerfClass.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiperfclass.dll") Region: id = 2496 start_va = 0x7ff9ffa40000 end_va = 0x7ff9ffa7cfff monitored = 1 entry_point = 0x7ff9ffa4b760 region_type = mapped_file name = "wmiprov.dll" filename = "\\Windows\\System32\\wbem\\wmiprov.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprov.dll") Region: id = 2497 start_va = 0x7ffa07ad0000 end_va = 0x7ffa07ae5fff monitored = 0 entry_point = 0x7ffa07ad55e0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 2498 start_va = 0x7ffa07c90000 end_va = 0x7ffa07cb4fff monitored = 0 entry_point = 0x7ffa07c99900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 2499 start_va = 0x7ffa07cc0000 end_va = 0x7ffa07cd3fff monitored = 0 entry_point = 0x7ffa07cc1800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 2500 start_va = 0x7ffa07ce0000 end_va = 0x7ffa07dd5fff monitored = 0 entry_point = 0x7ffa07d19590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 2501 start_va = 0x7ffa08390000 end_va = 0x7ffa083a0fff monitored = 0 entry_point = 0x7ffa08392fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2502 start_va = 0x7ffa09490000 end_va = 0x7ffa0950efff monitored = 1 entry_point = 0x7ffa094a7110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 2503 start_va = 0x7ffa0e8a0000 end_va = 0x7ffa0e903fff monitored = 0 entry_point = 0x7ffa0e8b5ae0 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 2504 start_va = 0x7ffa0f3e0000 end_va = 0x7ffa0f3f0fff monitored = 0 entry_point = 0x7ffa0f3e3320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 2505 start_va = 0x7ffa12280000 end_va = 0x7ffa122b0fff monitored = 0 entry_point = 0x7ffa12287d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2506 start_va = 0x7ffa12c20000 end_va = 0x7ffa12c48fff monitored = 0 entry_point = 0x7ffa12c34530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2507 start_va = 0x7ffa12e10000 end_va = 0x7ffa12e1efff monitored = 0 entry_point = 0x7ffa12e13210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2508 start_va = 0x7ffa13130000 end_va = 0x7ffa13317fff monitored = 0 entry_point = 0x7ffa1315ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2509 start_va = 0x7ffa13320000 end_va = 0x7ffa13389fff monitored = 0 entry_point = 0x7ffa13356d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2510 start_va = 0x7ffa13cc0000 end_va = 0x7ffa13d5cfff monitored = 0 entry_point = 0x7ffa13cc78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2511 start_va = 0x7ffa13d80000 end_va = 0x7ffa13ed5fff monitored = 0 entry_point = 0x7ffa13d8a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2512 start_va = 0x7ffa13ee0000 end_va = 0x7ffa14065fff monitored = 0 entry_point = 0x7ffa13f2ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2513 start_va = 0x7ffa14070000 end_va = 0x7ffa140cafff monitored = 0 entry_point = 0x7ffa140838b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2514 start_va = 0x7ffa14220000 end_va = 0x7ffa142c6fff monitored = 0 entry_point = 0x7ffa1422b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2515 start_va = 0x7ffa14340000 end_va = 0x7ffa145bcfff monitored = 0 entry_point = 0x7ffa14414970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2516 start_va = 0x7ffa145c0000 end_va = 0x7ffa146dbfff monitored = 0 entry_point = 0x7ffa146002b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2517 start_va = 0x7ffa146e0000 end_va = 0x7ffa1474afff monitored = 0 entry_point = 0x7ffa146f90c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2518 start_va = 0x7ffa147c0000 end_va = 0x7ffa14880fff monitored = 0 entry_point = 0x7ffa147e0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2519 start_va = 0x7ffa15090000 end_va = 0x7ffa15136fff monitored = 0 entry_point = 0x7ffa150a58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2520 start_va = 0x7ffa15160000 end_va = 0x7ffa1520cfff monitored = 0 entry_point = 0x7ffa151781a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2521 start_va = 0x7ffa16770000 end_va = 0x7ffa16930fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Thread: id = 100 os_tid = 0x320 Thread: id = 101 os_tid = 0x17c Thread: id = 102 os_tid = 0x4b4 [0256.486] DllCanUnloadNow () returned 0x1 [0256.487] DllCanUnloadNow () returned 0x1 Thread: id = 103 os_tid = 0x3ac Thread: id = 104 os_tid = 0x2c0 Thread: id = 105 os_tid = 0x39c Thread: id = 106 os_tid = 0x308 Thread: id = 107 os_tid = 0xaf4