# Flog Txt Version 1 # Analyzer Version: 4.5.0 # Analyzer Build Date: Apr 22 2022 21:04:16 # Log Creation Date: 05.05.2022 06:29:03.887 Process: id = "1" image_name = "b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe" filename = "c:\\users\\rdhj0cnfevzx\\desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe" page_root = "0x6da4c000" os_pid = "0xc4c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x78c" cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe\" " cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fe14" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 121 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 122 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 123 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 124 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 125 start_va = 0xa0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 126 start_va = 0x1a0000 end_va = 0x1a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 127 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 128 start_va = 0x1c0000 end_va = 0x1c1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 129 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 130 start_va = 0x400000 end_va = 0x49bfff monitored = 1 entry_point = 0x496fa2 region_type = mapped_file name = "b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe") Region: id = 131 start_va = 0x77830000 end_va = 0x779aafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 132 start_va = 0x7ffb0000 end_va = 0x7ffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 133 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 134 start_va = 0x7fff0000 end_va = 0x7ffdab58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 135 start_va = 0x7ffdab590000 end_va = 0x7ffdab750fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 136 start_va = 0x7ffdab751000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffdab751000" filename = "" Region: id = 275 start_va = 0x4f0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 276 start_va = 0x639e0000 end_va = 0x63a2ffff monitored = 0 entry_point = 0x639f8180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 277 start_va = 0x63a40000 end_va = 0x63ab9fff monitored = 0 entry_point = 0x63a53290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 278 start_va = 0x74580000 end_va = 0x7465ffff monitored = 0 entry_point = 0x74593980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 279 start_va = 0x63a30000 end_va = 0x63a37fff monitored = 0 entry_point = 0x63a317c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 280 start_va = 0x500000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 281 start_va = 0x6cb50000 end_va = 0x6cba8fff monitored = 1 entry_point = 0x6cb60780 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 282 start_va = 0x74580000 end_va = 0x7465ffff monitored = 0 entry_point = 0x74593980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 283 start_va = 0x77420000 end_va = 0x7759dfff monitored = 0 entry_point = 0x774d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 284 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 285 start_va = 0x7feb0000 end_va = 0x7ffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 286 start_va = 0x500000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 287 start_va = 0x570000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 288 start_va = 0x670000 end_va = 0x72dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 289 start_va = 0x744b0000 end_va = 0x74541fff monitored = 0 entry_point = 0x744f0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 290 start_va = 0x7fb00000 end_va = 0x7fea0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 291 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 292 start_va = 0x74810000 end_va = 0x7488afff monitored = 0 entry_point = 0x7482e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 293 start_va = 0x74db0000 end_va = 0x74e6dfff monitored = 0 entry_point = 0x74de5630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 294 start_va = 0x4a0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 295 start_va = 0x730000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 296 start_va = 0x757e0000 end_va = 0x75823fff monitored = 0 entry_point = 0x757f9d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 297 start_va = 0x759b0000 end_va = 0x75a5cfff monitored = 0 entry_point = 0x759c4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 298 start_va = 0x74560000 end_va = 0x7457dfff monitored = 0 entry_point = 0x7456b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 299 start_va = 0x74550000 end_va = 0x74559fff monitored = 0 entry_point = 0x74552a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 300 start_va = 0x777d0000 end_va = 0x77827fff monitored = 0 entry_point = 0x778125c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 301 start_va = 0x830000 end_va = 0x9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 302 start_va = 0x6cac0000 end_va = 0x6cb38fff monitored = 1 entry_point = 0x6cacf82a region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 303 start_va = 0x77680000 end_va = 0x776c4fff monitored = 0 entry_point = 0x7769de90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 304 start_va = 0x75bf0000 end_va = 0x75dacfff monitored = 0 entry_point = 0x75cd2a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 305 start_va = 0x771b0000 end_va = 0x772fefff monitored = 0 entry_point = 0x77266820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 306 start_va = 0x75640000 end_va = 0x75786fff monitored = 0 entry_point = 0x75651cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 307 start_va = 0x1d0000 end_va = 0x1f9fff monitored = 0 entry_point = 0x1d5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 308 start_va = 0x9c0000 end_va = 0xb47fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009c0000" filename = "" Region: id = 309 start_va = 0x77740000 end_va = 0x7776afff monitored = 0 entry_point = 0x77745680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 310 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 311 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 312 start_va = 0x830000 end_va = 0x8c6fff monitored = 1 entry_point = 0x8c6fa2 region_type = mapped_file name = "b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe") Region: id = 313 start_va = 0x9b0000 end_va = 0x9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 314 start_va = 0xb50000 end_va = 0xcd0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b50000" filename = "" Region: id = 315 start_va = 0xce0000 end_va = 0x20dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ce0000" filename = "" Region: id = 316 start_va = 0x77730000 end_va = 0x7773bfff monitored = 0 entry_point = 0x77733930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 317 start_va = 0x6cb40000 end_va = 0x6cb47fff monitored = 0 entry_point = 0x6cb417b0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 318 start_va = 0x6c150000 end_va = 0x6c800fff monitored = 1 entry_point = 0x6c165d20 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 319 start_va = 0x6c9c0000 end_va = 0x6cab4fff monitored = 0 entry_point = 0x6ca14160 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll") Region: id = 320 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 321 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 322 start_va = 0x4e0000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 323 start_va = 0x500000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 324 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 325 start_va = 0x510000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 326 start_va = 0x520000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 327 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 328 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 329 start_va = 0x550000 end_va = 0x550fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 330 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 331 start_va = 0x840000 end_va = 0x99ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 332 start_va = 0x840000 end_va = 0x87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 333 start_va = 0x880000 end_va = 0x97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000880000" filename = "" Region: id = 334 start_va = 0x990000 end_va = 0x99ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 335 start_va = 0x980000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 336 start_va = 0x20e0000 end_va = 0x40dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 337 start_va = 0x40e0000 end_va = 0x417ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000040e0000" filename = "" Region: id = 338 start_va = 0x4180000 end_va = 0x41bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004180000" filename = "" Region: id = 339 start_va = 0x41c0000 end_va = 0x42bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000041c0000" filename = "" Region: id = 340 start_va = 0x42c0000 end_va = 0x45f6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 341 start_va = 0x6af20000 end_va = 0x6c147fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\8062d427acd64e37f4fded7b00f4a869\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\8062d427acd64e37f4fded7b00f4a869\\mscorlib.ni.dll") Region: id = 342 start_va = 0x753d0000 end_va = 0x754bafff monitored = 0 entry_point = 0x7540d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 343 start_va = 0x4600000 end_va = 0x4690fff monitored = 0 entry_point = 0x4638cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 344 start_va = 0x70610000 end_va = 0x70684fff monitored = 0 entry_point = 0x70649a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 345 start_va = 0x4600000 end_va = 0x475ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004600000" filename = "" Region: id = 346 start_va = 0x980000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 347 start_va = 0x6c910000 end_va = 0x6c98dfff monitored = 1 entry_point = 0x6c911140 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 348 start_va = 0x74660000 end_va = 0x746f1fff monitored = 0 entry_point = 0x74698cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 349 start_va = 0x9a0000 end_va = 0x9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 350 start_va = 0x6a570000 end_va = 0x6af1bfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\cc4e5d110dd318e8b7d61a9ed184ab74\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\cc4e5d110dd318e8b7d61a9ed184ab74\\system.ni.dll") Region: id = 351 start_va = 0x6a3e0000 end_va = 0x6a56cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\9b645a48c9bcfc95aaadf6a069bb4ebe\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\9b645a48c9bcfc95aaadf6a069bb4ebe\\system.drawing.ni.dll") Region: id = 352 start_va = 0x69780000 end_va = 0x6a3d8fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\8cd2187094ba6cade0ca0fab4f932654\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\8cd2187094ba6cade0ca0fab4f932654\\system.windows.forms.ni.dll") Region: id = 353 start_va = 0x4600000 end_va = 0x4600fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004600000" filename = "" Region: id = 354 start_va = 0x4750000 end_va = 0x475ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004750000" filename = "" Region: id = 355 start_va = 0x4600000 end_va = 0x4601fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004600000" filename = "" Region: id = 356 start_va = 0x4610000 end_va = 0x461ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004610000" filename = "" Region: id = 357 start_va = 0x4620000 end_va = 0x46aefff monitored = 0 entry_point = 0x462dd60 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll") Region: id = 358 start_va = 0x6c870000 end_va = 0x6c901fff monitored = 0 entry_point = 0x6c87dd60 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll") Region: id = 359 start_va = 0x4620000 end_va = 0x474ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004620000" filename = "" Region: id = 360 start_va = 0x4620000 end_va = 0x4620fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004620000" filename = "" Region: id = 361 start_va = 0x4740000 end_va = 0x474ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004740000" filename = "" Region: id = 362 start_va = 0x4620000 end_va = 0x46dbfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004620000" filename = "" Region: id = 363 start_va = 0x46e0000 end_va = 0x46e3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000046e0000" filename = "" Region: id = 364 start_va = 0x46f0000 end_va = 0x46f3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000046f0000" filename = "" Region: id = 365 start_va = 0x4760000 end_va = 0x496afff monitored = 0 entry_point = 0x480b0a0 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll") Region: id = 366 start_va = 0x6f0a0000 end_va = 0x6f2aefff monitored = 0 entry_point = 0x6f14b0a0 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll") Region: id = 367 start_va = 0x4700000 end_va = 0x4700fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 368 start_va = 0x4710000 end_va = 0x4711fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004710000" filename = "" Region: id = 369 start_va = 0x4720000 end_va = 0x473ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004720000" filename = "" Region: id = 370 start_va = 0x6fe50000 end_va = 0x6fe6cfff monitored = 0 entry_point = 0x6fe53b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 371 start_va = 0x4700000 end_va = 0x470ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004700000" filename = "" Region: id = 372 start_va = 0x4720000 end_va = 0x472ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004720000" filename = "" Region: id = 373 start_va = 0x4730000 end_va = 0x473ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004730000" filename = "" Region: id = 374 start_va = 0x4760000 end_va = 0x476ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004760000" filename = "" Region: id = 375 start_va = 0x4770000 end_va = 0x477ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004770000" filename = "" Region: id = 376 start_va = 0x4780000 end_va = 0x478ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004780000" filename = "" Region: id = 377 start_va = 0x4790000 end_va = 0x479ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004790000" filename = "" Region: id = 378 start_va = 0x47a0000 end_va = 0x47affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000047a0000" filename = "" Region: id = 379 start_va = 0x47b0000 end_va = 0x47bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000047b0000" filename = "" Region: id = 380 start_va = 0x47c0000 end_va = 0x47cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000047c0000" filename = "" Region: id = 381 start_va = 0x69490000 end_va = 0x695fafff monitored = 0 entry_point = 0x694fe360 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\gdiplus.dll") Region: id = 382 start_va = 0x4760000 end_va = 0x48fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004760000" filename = "" Region: id = 383 start_va = 0x4760000 end_va = 0x479ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004760000" filename = "" Region: id = 384 start_va = 0x47a0000 end_va = 0x489ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000047a0000" filename = "" Region: id = 385 start_va = 0x48f0000 end_va = 0x48fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048f0000" filename = "" Region: id = 386 start_va = 0x6d490000 end_va = 0x6d680fff monitored = 0 entry_point = 0x6d573cd0 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\SysWOW64\\DWrite.dll" (normalized: "c:\\windows\\syswow64\\dwrite.dll") Region: id = 387 start_va = 0x75a70000 end_va = 0x75b8efff monitored = 0 entry_point = 0x75ab5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 388 start_va = 0x48a0000 end_va = 0x48e8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "~fontcache-system.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-system.dat") Region: id = 389 start_va = 0x4700000 end_va = 0x4703fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004700000" filename = "" Region: id = 390 start_va = 0x4900000 end_va = 0x58fffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "~fontcache-fontface.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-fontface.dat") Region: id = 391 start_va = 0x4720000 end_va = 0x4723fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004720000" filename = "" Region: id = 392 start_va = 0x5900000 end_va = 0x59fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005900000" filename = "" Region: id = 393 start_va = 0x5a00000 end_va = 0x5afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a00000" filename = "" Region: id = 394 start_va = 0x5b00000 end_va = 0x5b2efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mistral.ttf" filename = "\\Windows\\Fonts\\MISTRAL.TTF" (normalized: "c:\\windows\\fonts\\mistral.ttf") Region: id = 395 start_va = 0x5b30000 end_va = 0x5f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b30000" filename = "" Region: id = 396 start_va = 0x5f30000 end_va = 0x6421fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005f30000" filename = "" Region: id = 397 start_va = 0x6430000 end_va = 0x64ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "micross.ttf" filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf") Region: id = 398 start_va = 0x64f0000 end_va = 0x752ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 399 start_va = 0x7530000 end_va = 0x7530fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007530000" filename = "" Region: id = 400 start_va = 0x7540000 end_va = 0x75a1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll") Region: id = 401 start_va = 0x75b0000 end_va = 0x75c1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000075b0000" filename = "" Region: id = 402 start_va = 0x5e430000 end_va = 0x5e4cbfff monitored = 1 entry_point = 0x5e4be9b2 region_type = mapped_file name = "microsoft.visualbasic.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\microsoft.visualbasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\microsoft.visualbasic.dll") Region: id = 403 start_va = 0x75d0000 end_va = 0x766bfff monitored = 1 entry_point = 0x765e9b2 region_type = mapped_file name = "microsoft.visualbasic.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\microsoft.visualbasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\microsoft.visualbasic.dll") Region: id = 404 start_va = 0x7670000 end_va = 0x767ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007670000" filename = "" Region: id = 405 start_va = 0x7680000 end_va = 0x768ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007680000" filename = "" Region: id = 406 start_va = 0x7690000 end_va = 0x769ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007690000" filename = "" Region: id = 407 start_va = 0x76a0000 end_va = 0x76affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000076a0000" filename = "" Region: id = 408 start_va = 0x76b0000 end_va = 0x76bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000076b0000" filename = "" Region: id = 409 start_va = 0x7690000 end_va = 0x76cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007690000" filename = "" Region: id = 410 start_va = 0x76d0000 end_va = 0x77cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000076d0000" filename = "" Region: id = 411 start_va = 0x77d0000 end_va = 0x780ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000077d0000" filename = "" Region: id = 412 start_va = 0x7810000 end_va = 0x790ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007810000" filename = "" Region: id = 413 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 414 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 415 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 416 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 417 start_va = 0x730000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 418 start_va = 0x740000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000740000" filename = "" Region: id = 419 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 420 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 421 start_va = 0x770000 end_va = 0x77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 422 start_va = 0x780000 end_va = 0x78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 423 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 424 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 425 start_va = 0x7b0000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 426 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 427 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 428 start_va = 0x7e0000 end_va = 0x7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007e0000" filename = "" Region: id = 429 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 430 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 431 start_va = 0x68d70000 end_va = 0x69481fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\abad45b9cc652ba7e38c4c837234c0ab\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\abad45b9cc652ba7e38c4c837234c0ab\\system.core.ni.dll") Region: id = 432 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 433 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 434 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 435 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 436 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 437 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 438 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 439 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 440 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 441 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 442 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 443 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 444 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 445 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 446 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 447 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 448 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 449 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 450 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 451 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 452 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 453 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 454 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 455 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 456 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 457 start_va = 0x70410000 end_va = 0x70422fff monitored = 0 entry_point = 0x70419950 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 458 start_va = 0x730000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 459 start_va = 0x7910000 end_va = 0x7a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007910000" filename = "" Region: id = 460 start_va = 0x703e0000 end_va = 0x7040efff monitored = 0 entry_point = 0x703f95e0 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 461 start_va = 0x74200000 end_va = 0x7421afff monitored = 0 entry_point = 0x74209050 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 462 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 463 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 464 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 465 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 466 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 467 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 468 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 469 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 470 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 471 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 472 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 473 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 474 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 475 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 476 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 477 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 478 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 479 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 480 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 481 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 482 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 483 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 484 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 485 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 486 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 487 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 488 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 489 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 490 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 491 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 492 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 493 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 494 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 495 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 496 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 497 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 498 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 499 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 500 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 501 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 502 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 503 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 504 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 505 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 506 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 507 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 508 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 509 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 510 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 511 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 512 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 513 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 514 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 515 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 516 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 517 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 518 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 519 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 520 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 521 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 522 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 523 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 524 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 525 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 526 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 527 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 528 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 529 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 530 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 531 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 532 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 533 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 534 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 535 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 536 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 537 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 538 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 539 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 540 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 541 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 542 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 543 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 544 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 545 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 546 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 547 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 548 start_va = 0x770000 end_va = 0x7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 549 start_va = 0x69600000 end_va = 0x69772fff monitored = 0 entry_point = 0x696ad220 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\SysWOW64\\WindowsCodecs.dll" (normalized: "c:\\windows\\syswow64\\windowscodecs.dll") Region: id = 550 start_va = 0x7a10000 end_va = 0x7a88fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007a10000" filename = "" Region: id = 551 start_va = 0x7f0000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 552 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007f0000" filename = "" Region: id = 553 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 554 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000810000" filename = "" Region: id = 555 start_va = 0x7a90000 end_va = 0x7b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007a90000" filename = "" Region: id = 556 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 557 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 558 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 559 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 560 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 561 start_va = 0x7b90000 end_va = 0x7c07fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007b90000" filename = "" Region: id = 562 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 563 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 564 start_va = 0x7c10000 end_va = 0x7c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c10000" filename = "" Region: id = 565 start_va = 0x7c20000 end_va = 0x7c2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c20000" filename = "" Region: id = 566 start_va = 0x7c10000 end_va = 0x7c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c10000" filename = "" Region: id = 567 start_va = 0x7c20000 end_va = 0x7c2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c20000" filename = "" Region: id = 568 start_va = 0x7c10000 end_va = 0x7c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c10000" filename = "" Region: id = 569 start_va = 0x7c20000 end_va = 0x7c2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c20000" filename = "" Region: id = 570 start_va = 0x7c30000 end_va = 0x7c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c30000" filename = "" Region: id = 571 start_va = 0x7c40000 end_va = 0x7c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c40000" filename = "" Region: id = 572 start_va = 0x7c50000 end_va = 0x7c5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c50000" filename = "" Region: id = 573 start_va = 0x7c60000 end_va = 0x7c6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c60000" filename = "" Region: id = 574 start_va = 0x7c70000 end_va = 0x7c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c70000" filename = "" Region: id = 575 start_va = 0x7c80000 end_va = 0x7c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c80000" filename = "" Region: id = 576 start_va = 0x7c90000 end_va = 0x7c9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c90000" filename = "" Region: id = 577 start_va = 0x7ca0000 end_va = 0x7caffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007ca0000" filename = "" Region: id = 578 start_va = 0x7cb0000 end_va = 0x7cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007cb0000" filename = "" Region: id = 579 start_va = 0x7cc0000 end_va = 0x7ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007cc0000" filename = "" Region: id = 580 start_va = 0x7cd0000 end_va = 0x7cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007cd0000" filename = "" Region: id = 581 start_va = 0x7ce0000 end_va = 0x7ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007ce0000" filename = "" Region: id = 582 start_va = 0x7cf0000 end_va = 0x7cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007cf0000" filename = "" Region: id = 583 start_va = 0x7d00000 end_va = 0x7d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007d00000" filename = "" Region: id = 584 start_va = 0x7d10000 end_va = 0x7d1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007d10000" filename = "" Region: id = 585 start_va = 0x7d20000 end_va = 0x7d2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007d20000" filename = "" Region: id = 586 start_va = 0x7d30000 end_va = 0x7d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007d30000" filename = "" Region: id = 587 start_va = 0x7d40000 end_va = 0x7d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007d40000" filename = "" Region: id = 588 start_va = 0x7c10000 end_va = 0x7c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c10000" filename = "" Region: id = 589 start_va = 0x7c10000 end_va = 0x7c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c10000" filename = "" Region: id = 590 start_va = 0x7c10000 end_va = 0x7c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c10000" filename = "" Region: id = 591 start_va = 0x7c10000 end_va = 0x7c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c10000" filename = "" Region: id = 592 start_va = 0x7c10000 end_va = 0x7c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c10000" filename = "" Region: id = 593 start_va = 0x7c10000 end_va = 0x7c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c10000" filename = "" Region: id = 594 start_va = 0x7c10000 end_va = 0x7c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c10000" filename = "" Region: id = 595 start_va = 0x7c20000 end_va = 0x7c2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c20000" filename = "" Region: id = 596 start_va = 0x68c50000 end_va = 0x68d6bfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\d2f554a0c84513cd793fdcd77a86dab1\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.management\\d2f554a0c84513cd793fdcd77a86dab1\\system.management.ni.dll") Region: id = 597 start_va = 0x7c10000 end_va = 0x7c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c10000" filename = "" Region: id = 598 start_va = 0x7c20000 end_va = 0x7c2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c20000" filename = "" Region: id = 599 start_va = 0x7c30000 end_va = 0x7c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c30000" filename = "" Region: id = 600 start_va = 0x7c40000 end_va = 0x7c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c40000" filename = "" Region: id = 601 start_va = 0x7c50000 end_va = 0x7c5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c50000" filename = "" Region: id = 602 start_va = 0x7c60000 end_va = 0x7c6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c60000" filename = "" Region: id = 603 start_va = 0x7c70000 end_va = 0x7c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c70000" filename = "" Region: id = 604 start_va = 0x7c80000 end_va = 0x7c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c80000" filename = "" Region: id = 605 start_va = 0x7c90000 end_va = 0x7c9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c90000" filename = "" Region: id = 606 start_va = 0x7ca0000 end_va = 0x7caffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007ca0000" filename = "" Region: id = 607 start_va = 0x7cb0000 end_va = 0x7cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007cb0000" filename = "" Region: id = 608 start_va = 0x7cc0000 end_va = 0x7ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007cc0000" filename = "" Region: id = 609 start_va = 0x7cd0000 end_va = 0x7cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007cd0000" filename = "" Region: id = 610 start_va = 0x7ce0000 end_va = 0x7ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007ce0000" filename = "" Region: id = 611 start_va = 0x7cf0000 end_va = 0x7cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007cf0000" filename = "" Region: id = 612 start_va = 0x7d00000 end_va = 0x7d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007d00000" filename = "" Region: id = 613 start_va = 0x7d10000 end_va = 0x7d1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007d10000" filename = "" Region: id = 614 start_va = 0x7d20000 end_va = 0x7d2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007d20000" filename = "" Region: id = 615 start_va = 0x7d30000 end_va = 0x7d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007d30000" filename = "" Region: id = 616 start_va = 0x7c10000 end_va = 0x7c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c10000" filename = "" Region: id = 617 start_va = 0x7c20000 end_va = 0x7c56fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007c20000" filename = "" Region: id = 618 start_va = 0x7c60000 end_va = 0x7c6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c60000" filename = "" Region: id = 619 start_va = 0x7c70000 end_va = 0x7c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c70000" filename = "" Region: id = 620 start_va = 0x7c80000 end_va = 0x7c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c80000" filename = "" Region: id = 621 start_va = 0x7c90000 end_va = 0x7c9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c90000" filename = "" Region: id = 648 start_va = 0x7c70000 end_va = 0x7caffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c70000" filename = "" Region: id = 649 start_va = 0x7d50000 end_va = 0x7e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007d50000" filename = "" Region: id = 684 start_va = 0x7a10000 end_va = 0x7a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007a10000" filename = "" Region: id = 685 start_va = 0x7e50000 end_va = 0x7f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007e50000" filename = "" Thread: id = 1 os_tid = 0x3f8 [0120.418] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0121.561] RoInitialize () returned 0x1 [0121.561] RoUninitialize () returned 0x0 [0124.885] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x19ef18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0124.914] IsAppThemed () returned 0x1 [0124.920] CoTaskMemAlloc (cb=0xf0) returned 0x5c5f20 [0124.920] CreateActCtxA (pActCtx=0x19f414) returned 0x5c6114 [0125.071] CoTaskMemFree (pv=0x5c5f20) [0125.103] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc20e [0125.103] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc20d [0125.314] GetSystemMetrics (nIndex=75) returned 1 [0125.321] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0126.282] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x6c870000 [0126.891] AdjustWindowRectEx (in: lpRect=0x19f418, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x19f418) returned 1 [0126.933] GetCurrentProcess () returned 0xffffffff [0126.933] GetCurrentThread () returned 0xfffffffe [0126.933] GetCurrentProcess () returned 0xffffffff [0126.933] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x19f330, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x19f330*=0x264) returned 1 [0126.939] GetCurrentThreadId () returned 0x3f8 [0126.958] GetCurrentActCtx (in: lphActCtx=0x19f290 | out: lphActCtx=0x19f290*=0x0) returned 1 [0126.959] ActivateActCtx (in: hActCtx=0x5c6114, lpCookie=0x19f2a0 | out: hActCtx=0x5c6114, lpCookie=0x19f2a0) returned 1 [0126.959] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0128.251] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x6f0a0000 [0128.273] GetModuleHandleW (lpModuleName="user32.dll") returned 0x75640000 [0128.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x19f158, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcW\x97i´v(\x7f «\x15lhö\x19", lpUsedDefaultChar=0x0) returned 14 [0128.274] GetProcAddress (hModule=0x75640000, lpProcName="DefWindowProcW") returned 0x744e07e0 [0128.276] GetStockObject (i=5) returned 0x1900015 [0128.344] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0128.397] CoTaskMemAlloc (cb=0x5c) returned 0x5d0dc8 [0128.397] RegisterClassW (lpWndClass=0x19f148) returned 0xc150 [0128.398] CoTaskMemFree (pv=0x5d0dc8) [0128.398] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0128.399] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x70364 [0128.402] SetWindowLongW (hWnd=0x70364, nIndex=-4, dwNewLong=1951270880) returned 74646974 [0128.403] GetWindowLongW (hWnd=0x70364, nIndex=-4) returned 1951270880 [0128.410] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e9a4 | out: phkResult=0x19e9a4*=0x288) returned 0x0 [0128.410] RegQueryValueExW (in: hKey=0x288, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x19e9c4, lpData=0x0, lpcbData=0x19e9c0*=0x0 | out: lpType=0x19e9c4*=0x0, lpData=0x0, lpcbData=0x19e9c0*=0x0) returned 0x2 [0128.410] RegQueryValueExW (in: hKey=0x288, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x19e9c4, lpData=0x0, lpcbData=0x19e9c0*=0x0 | out: lpType=0x19e9c4*=0x0, lpData=0x0, lpcbData=0x19e9c0*=0x0) returned 0x2 [0128.411] RegCloseKey (hKey=0x288) returned 0x0 [0128.450] SetWindowLongW (hWnd=0x70364, nIndex=-4, dwNewLong=74647014) returned 1951270880 [0128.450] GetWindowLongW (hWnd=0x70364, nIndex=-4) returned 74647014 [0128.450] GetWindowLongW (hWnd=0x70364, nIndex=-16) returned 113311744 [0128.452] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc1f3 [0128.508] CallWindowProcW (lpPrevWndFunc=0x744e07e0, hWnd=0x70364, Msg=0x24, wParam=0x0, lParam=0x19ecbc) returned 0x0 [0128.508] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc1f5 [0128.509] CallWindowProcW (lpPrevWndFunc=0x744e07e0, hWnd=0x70364, Msg=0x81, wParam=0x0, lParam=0x19ecb0) returned 0x1 [0128.510] CallWindowProcW (lpPrevWndFunc=0x744e07e0, hWnd=0x70364, Msg=0x83, wParam=0x0, lParam=0x19ec9c) returned 0x0 [0128.808] CallWindowProcW (lpPrevWndFunc=0x744e07e0, hWnd=0x70364, Msg=0x1, wParam=0x0, lParam=0x19ecb0) returned 0x0 [0128.809] GetClientRect (in: hWnd=0x70364, lpRect=0x19e9dc | out: lpRect=0x19e9dc) returned 1 [0128.809] GetWindowRect (in: hWnd=0x70364, lpRect=0x19e9dc | out: lpRect=0x19e9dc) returned 1 [0128.811] GetParent (hWnd=0x70364) returned 0x0 [0128.812] DeactivateActCtx (dwFlags=0x0, ulCookie=0x14cf0001) returned 1 [0129.288] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0129.293] AdjustWindowRectEx (in: lpRect=0x19ede0, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ede0) returned 1 [0129.293] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0129.294] AdjustWindowRectEx (in: lpRect=0x19ede0, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ede0) returned 1 [0129.328] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0129.329] AdjustWindowRectEx (in: lpRect=0x19ede0, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ede0) returned 1 [0129.329] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0129.329] AdjustWindowRectEx (in: lpRect=0x19ede0, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ede0) returned 1 [0129.329] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0129.329] AdjustWindowRectEx (in: lpRect=0x19ede0, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ede0) returned 1 [0129.332] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0129.332] AdjustWindowRectEx (in: lpRect=0x19edcc, dwStyle=0x56010000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19edcc) returned 1 [0129.333] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0129.333] AdjustWindowRectEx (in: lpRect=0x19ede0, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ede0) returned 1 [0129.333] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0129.333] AdjustWindowRectEx (in: lpRect=0x19ede0, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ede0) returned 1 [0129.334] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0129.334] AdjustWindowRectEx (in: lpRect=0x19ede0, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ede0) returned 1 [0129.334] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0129.334] AdjustWindowRectEx (in: lpRect=0x19ede0, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ede0) returned 1 [0129.334] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0129.335] AdjustWindowRectEx (in: lpRect=0x19ede0, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ede0) returned 1 [0129.335] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0129.335] AdjustWindowRectEx (in: lpRect=0x19ede0, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ede0) returned 1 [0129.335] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0129.336] AdjustWindowRectEx (in: lpRect=0x19ede0, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ede0) returned 1 [0129.336] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0129.336] AdjustWindowRectEx (in: lpRect=0x19ede0, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ede0) returned 1 [0129.336] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0129.336] AdjustWindowRectEx (in: lpRect=0x19ede0, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ede0) returned 1 [0129.337] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0129.337] AdjustWindowRectEx (in: lpRect=0x19ede0, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ede0) returned 1 [0129.341] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0129.341] AdjustWindowRectEx (in: lpRect=0x19ede4, dwStyle=0x56010000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ede4) returned 1 [0129.341] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0129.341] AdjustWindowRectEx (in: lpRect=0x19ede4, dwStyle=0x56010000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ede4) returned 1 [0129.342] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0129.342] AdjustWindowRectEx (in: lpRect=0x19ede4, dwStyle=0x56010000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ede4) returned 1 [0129.342] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0129.343] AdjustWindowRectEx (in: lpRect=0x19ede4, dwStyle=0x56010000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ede4) returned 1 [0129.343] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0129.343] AdjustWindowRectEx (in: lpRect=0x19ede4, dwStyle=0x56010000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ede4) returned 1 [0129.975] GdiplusStartup (in: token=0x515f00, input=0x19e2c8, output=0x19e318 | out: token=0x515f00, output=0x19e318) returned 0x0 [0129.987] GdipCreateFontFamilyFromName (name="Mistral", fontCollection=0x0, fontFamily=0x19edbc) returned 0x0 [0131.329] GdipCreateFont (fontFamily=0x48f8140, emSize=0x41b00000, style=1, unit=0x3, font=0x20ea884) returned 0x0 [0131.346] GdipGetFontSize (font=0x48f04c0, size=0x20ea888) returned 0x0 [0131.349] GetSystemDefaultLCID () returned 0x409 [0131.349] GetStockObject (i=17) returned 0x10a0047 [0131.351] GetObjectW (in: h=0x10a0047, c=92, pv=0x19ec64 | out: pv=0x19ec64) returned 92 [0131.353] GetDC (hWnd=0x0) returned 0xa0100d0 [0131.358] CoTaskMemAlloc (cb=0x5c) returned 0x5d0f68 [0131.358] GdipCreateFontFromLogfontW (hdc=0xa0100d0, logfont=0x5d0f68, font=0x19ed2c) returned 0x0 [0131.393] CoTaskMemFree (pv=0x5d0f68) [0131.394] CoTaskMemAlloc (cb=0x5c) returned 0x5d0c28 [0131.394] CoTaskMemFree (pv=0x5d0c28) [0131.394] CoTaskMemAlloc (cb=0x5c) returned 0x5d0dc8 [0131.394] CoTaskMemFree (pv=0x5d0dc8) [0131.395] GdipGetFontUnit (font=0x5a0a920, unit=0x19ecf8) returned 0x0 [0131.395] GdipGetFontSize (font=0x5a0a920, size=0x19ecfc) returned 0x0 [0131.395] GdipGetFontStyle (font=0x5a0a920, style=0x19ecf4) returned 0x0 [0131.395] GdipGetFamily (font=0x5a0a920, family=0x19ecf0) returned 0x0 [0131.395] GdipGetFontSize (font=0x5a0a920, size=0x20eaee8) returned 0x0 [0131.396] ReleaseDC (hWnd=0x0, hDC=0xa0100d0) returned 1 [0131.396] GetDC (hWnd=0x0) returned 0xa0100d0 [0131.396] GdipCreateFromHDC (hdc=0xa0100d0, graphics=0x19ed18) returned 0x0 [0131.402] GdipGetDpiY (graphics=0x5a0f5e8, dpi=0x20eaff0) returned 0x0 [0131.402] GdipGetFontHeight (font=0x5a0a920, graphics=0x5a0f5e8, height=0x19ed10) returned 0x0 [0131.402] GdipGetEmHeight (family=0x5a05e10, style=0, EmHeight=0x19ed18) returned 0x0 [0131.403] GdipGetLineSpacing (family=0x5a05e10, style=0, LineSpacing=0x19ed18) returned 0x0 [0131.403] GdipDeleteGraphics (graphics=0x5a0f5e8) returned 0x0 [0131.404] ReleaseDC (hWnd=0x0, hDC=0xa0100d0) returned 1 [0131.404] GdipCreateFont (fontFamily=0x5a05e10, emSize=0x41040000, style=0, unit=0x3, font=0x20eafb0) returned 0x0 [0131.404] GdipGetFontSize (font=0x5a0ab38, size=0x20eafb4) returned 0x0 [0131.405] GdipDeleteFont (font=0x5a0a920) returned 0x0 [0131.427] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.429] AdjustWindowRectEx (in: lpRect=0x19ed40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed40) returned 1 [0131.487] GetProcessWindowStation () returned 0xf0 [0131.489] GetUserObjectInformationA (in: hObj=0xf0, nIndex=1, pvInfo=0x20eb74c, nLength=0xc, lpnLengthNeeded=0x19ec1c | out: pvInfo=0x20eb74c, lpnLengthNeeded=0x19ec1c) returned 1 [0131.492] SetConsoleCtrlHandler (HandlerRoutine=0x473060e, Add=1) returned 1 [0131.493] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0131.494] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0131.496] GetClassInfoW (in: hInstance=0x400000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWndClass=0x20eb7b0 | out: lpWndClass=0x20eb7b0) returned 0 [0131.499] CoTaskMemAlloc (cb=0x58) returned 0x5cbaa8 [0131.499] RegisterClassW (lpWndClass=0x19eb6c) returned 0xc20f [0131.500] CoTaskMemFree (pv=0x5cbaa8) [0131.501] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x80274 [0131.503] NtdllDefWindowProc_W (hWnd=0x80274, Msg=0x81, wParam=0x0, lParam=0x19e6a8) returned 0x1 [0131.508] NtdllDefWindowProc_W (hWnd=0x80274, Msg=0x83, wParam=0x0, lParam=0x19e694) returned 0x0 [0131.509] NtdllDefWindowProc_W (hWnd=0x80274, Msg=0x1, wParam=0x0, lParam=0x19e6a8) returned 0x0 [0131.509] NtdllDefWindowProc_W (hWnd=0x80274, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0131.510] NtdllDefWindowProc_W (hWnd=0x80274, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0131.513] GetSysColor (nIndex=10) returned 0xb4b4b4 [0131.513] GetSysColor (nIndex=2) returned 0xd1b499 [0131.513] GetSysColor (nIndex=9) returned 0x0 [0131.513] GetSysColor (nIndex=12) returned 0xababab [0131.513] GetSysColor (nIndex=15) returned 0xf0f0f0 [0131.513] GetSysColor (nIndex=20) returned 0xffffff [0131.513] GetSysColor (nIndex=16) returned 0xa0a0a0 [0131.513] GetSysColor (nIndex=15) returned 0xf0f0f0 [0131.513] GetSysColor (nIndex=16) returned 0xa0a0a0 [0131.514] GetSysColor (nIndex=21) returned 0x696969 [0131.514] GetSysColor (nIndex=22) returned 0xe3e3e3 [0131.514] GetSysColor (nIndex=20) returned 0xffffff [0131.514] GetSysColor (nIndex=18) returned 0x0 [0131.514] GetSysColor (nIndex=1) returned 0x0 [0131.514] GetSysColor (nIndex=27) returned 0xead1b9 [0131.514] GetSysColor (nIndex=28) returned 0xf2e4d7 [0131.514] GetSysColor (nIndex=17) returned 0x6d6d6d [0131.514] GetSysColor (nIndex=13) returned 0xff9933 [0131.514] GetSysColor (nIndex=14) returned 0xffffff [0131.514] GetSysColor (nIndex=26) returned 0xcc6600 [0131.514] GetSysColor (nIndex=11) returned 0xfcf7f4 [0131.514] GetSysColor (nIndex=3) returned 0xdbcdbf [0131.514] GetSysColor (nIndex=19) returned 0x0 [0131.514] GetSysColor (nIndex=24) returned 0xe1ffff [0131.515] GetSysColor (nIndex=23) returned 0x0 [0131.515] GetSysColor (nIndex=4) returned 0xf0f0f0 [0131.515] GetSysColor (nIndex=30) returned 0xf0f0f0 [0131.515] GetSysColor (nIndex=29) returned 0xff9933 [0131.515] GetSysColor (nIndex=7) returned 0x0 [0131.515] GetSysColor (nIndex=0) returned 0xc8c8c8 [0131.515] GetSysColor (nIndex=5) returned 0xffffff [0131.515] GetSysColor (nIndex=6) returned 0x646464 [0131.515] GetSysColor (nIndex=8) returned 0x0 [0131.520] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.520] AdjustWindowRectEx (in: lpRect=0x19ed40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed40) returned 1 [0131.522] GdipCreateFontFamilyFromName (name="Mistral", fontCollection=0x0, fontFamily=0x19edbc) returned 0x0 [0131.524] GdipCreateFont (fontFamily=0x48f8140, emSize=0x41b00000, style=3, unit=0x3, font=0x20ebc90) returned 0x0 [0131.524] GdipGetFontSize (font=0x5a0a920, size=0x20ebc94) returned 0x0 [0131.524] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.524] AdjustWindowRectEx (in: lpRect=0x19ed40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed40) returned 1 [0131.525] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.525] AdjustWindowRectEx (in: lpRect=0x19ed40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed40) returned 1 [0131.525] GdipCreateFontFamilyFromName (name="Mistral", fontCollection=0x0, fontFamily=0x19edbc) returned 0x0 [0131.525] GdipCreateFont (fontFamily=0x48f8140, emSize=0x41c00000, style=3, unit=0x3, font=0x20ebe40) returned 0x0 [0131.525] GdipGetFontSize (font=0x5a0b000, size=0x20ebe44) returned 0x0 [0131.533] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.533] AdjustWindowRectEx (in: lpRect=0x19ed40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed40) returned 1 [0131.534] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.534] AdjustWindowRectEx (in: lpRect=0x19ed40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed40) returned 1 [0131.534] GdipCreateFontFamilyFromName (name="Mistral", fontCollection=0x0, fontFamily=0x19edbc) returned 0x0 [0131.534] GdipCreateFont (fontFamily=0x48f8140, emSize=0x41b00000, style=3, unit=0x3, font=0x20ec020) returned 0x0 [0131.534] GdipGetFontSize (font=0x5a0b028, size=0x20ec024) returned 0x0 [0131.534] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.535] AdjustWindowRectEx (in: lpRect=0x19ed40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed40) returned 1 [0131.535] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.535] AdjustWindowRectEx (in: lpRect=0x19ed40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed40) returned 1 [0131.535] GdipCreateFontFamilyFromName (name="Mistral", fontCollection=0x0, fontFamily=0x19edbc) returned 0x0 [0131.535] GdipCreateFont (fontFamily=0x48f8140, emSize=0x41b00000, style=3, unit=0x3, font=0x20ec1d0) returned 0x0 [0131.535] GdipGetFontSize (font=0x5a0b050, size=0x20ec1d4) returned 0x0 [0131.535] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.536] AdjustWindowRectEx (in: lpRect=0x19ed40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed40) returned 1 [0131.536] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.536] AdjustWindowRectEx (in: lpRect=0x19ed40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed40) returned 1 [0131.536] GetCurrentThreadId () returned 0x3f8 [0131.536] GetCurrentThreadId () returned 0x3f8 [0131.551] GetCurrentThreadId () returned 0x3f8 [0131.551] GetCurrentThreadId () returned 0x3f8 [0131.551] GetCurrentThreadId () returned 0x3f8 [0131.551] GetCurrentThreadId () returned 0x3f8 [0131.551] GetCurrentThreadId () returned 0x3f8 [0131.551] GetCurrentThreadId () returned 0x3f8 [0131.551] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.552] AdjustWindowRectEx (in: lpRect=0x19ed6c, dwStyle=0x56000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19ed6c) returned 1 [0131.558] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.559] AdjustWindowRectEx (in: lpRect=0x19ec20, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec20) returned 1 [0131.562] GdipGetFamilyName (in: family=0x5a05e10, name=0x19ebec, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0131.563] CreateCompatibleDC (hdc=0x0) returned 0x2c010a0f [0131.564] GetCurrentObject (hdc=0x2c010a0f, type=0x1) returned 0x1b00017 [0131.564] GetCurrentObject (hdc=0x2c010a0f, type=0x2) returned 0x1900010 [0131.564] GetCurrentObject (hdc=0x2c010a0f, type=0x7) returned 0x185000f [0131.564] GetCurrentObject (hdc=0x2c010a0f, type=0x6) returned 0x18a0048 [0131.567] SaveDC (hdc=0x2c010a0f) returned 1 [0131.567] GetDeviceCaps (hdc=0x2c010a0f, index=90) returned 96 [0131.570] CoTaskMemAlloc (cb=0x5c) returned 0x5d0c28 [0131.570] CreateFontIndirectW (lplf=0x5d0c28) returned 0x70a09ec [0131.570] CoTaskMemFree (pv=0x5d0c28) [0131.571] GetObjectW (in: h=0x70a09ec, c=92, pv=0x19ebc4 | out: pv=0x19ebc4) returned 92 [0131.574] GetCurrentObject (hdc=0x2c010a0f, type=0x6) returned 0x18a0048 [0131.574] GetObjectW (in: h=0x18a0048, c=92, pv=0x19ebac | out: pv=0x19ebac) returned 92 [0131.575] SelectObject (hdc=0x2c010a0f, h=0x70a09ec) returned 0x18a0048 [0131.575] GetTextExtentPoint32W (in: hdc=0x2c010a0f, lpString="0", c=1, psizl=0x20eca18 | out: psizl=0x20eca18) returned 1 [0131.582] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.582] AdjustWindowRectEx (in: lpRect=0x19ecf4, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ecf4) returned 1 [0131.583] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.583] AdjustWindowRectEx (in: lpRect=0x19ec18, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec18) returned 1 [0131.583] GdipGetFamilyName (in: family=0x5a05e10, name=0x19ebe4, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0131.583] GetDeviceCaps (hdc=0x2c010a0f, index=90) returned 96 [0131.583] CoTaskMemAlloc (cb=0x5c) returned 0x5d0f68 [0131.583] CreateFontIndirectW (lplf=0x5d0f68) returned 0xd0a09f1 [0131.583] CoTaskMemFree (pv=0x5d0f68) [0131.583] GetObjectW (in: h=0xd0a09f1, c=92, pv=0x19ebbc | out: pv=0x19ebbc) returned 92 [0131.585] GetTextExtentPoint32W (in: hdc=0x2c010a0f, lpString="0", c=1, psizl=0x20ecca8 | out: psizl=0x20ecca8) returned 1 [0131.592] DeleteObject (ho=0xd0a09f1) returned 1 [0131.592] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.593] AdjustWindowRectEx (in: lpRect=0x19ecec, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ecec) returned 1 [0131.593] GdipCreateFontFamilyFromName (name="Microsoft Sans Serif", fontCollection=0x0, fontFamily=0x19edbc) returned 0x0 [0131.593] GdipCreateFont (fontFamily=0x5a05e10, emSize=0x41300000, style=1, unit=0x3, font=0x20ecd20) returned 0x0 [0131.593] GdipGetFontSize (font=0x5a0b078, size=0x20ecd24) returned 0x0 [0131.593] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.593] AdjustWindowRectEx (in: lpRect=0x19ebd8, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ebd8) returned 1 [0131.594] GdipGetFamilyName (in: family=0x5a05e10, name=0x19eba4, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0131.594] GetDeviceCaps (hdc=0x2c010a0f, index=90) returned 96 [0131.594] CoTaskMemAlloc (cb=0x5c) returned 0x5d11d8 [0131.594] CreateFontIndirectW (lplf=0x5d11d8) returned 0xe0a09f1 [0131.594] CoTaskMemFree (pv=0x5d11d8) [0131.594] GetObjectW (in: h=0xe0a09f1, c=92, pv=0x19eb7c | out: pv=0x19eb7c) returned 92 [0131.594] SelectObject (hdc=0x2c010a0f, h=0xe0a09f1) returned 0x70a09ec [0131.594] DeleteObject (ho=0x70a09ec) returned 1 [0131.594] GetTextExtentPoint32W (in: hdc=0x2c010a0f, lpString="0", c=1, psizl=0x20ed034 | out: psizl=0x20ed034) returned 1 [0131.596] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.596] AdjustWindowRectEx (in: lpRect=0x19ecac, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ecac) returned 1 [0131.597] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.597] AdjustWindowRectEx (in: lpRect=0x19ec0c, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec0c) returned 1 [0131.597] GdipGetFamilyName (in: family=0x5a05e10, name=0x19ebd8, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0131.597] GetDeviceCaps (hdc=0x2c010a0f, index=90) returned 96 [0131.597] CoTaskMemAlloc (cb=0x5c) returned 0x5d0c28 [0131.597] CreateFontIndirectW (lplf=0x5d0c28) returned 0x80a09ec [0131.597] CoTaskMemFree (pv=0x5d0c28) [0131.597] GetObjectW (in: h=0x80a09ec, c=92, pv=0x19ebb0 | out: pv=0x19ebb0) returned 92 [0131.597] GetTextExtentPoint32W (in: hdc=0x2c010a0f, lpString="0", c=1, psizl=0x20ed244 | out: psizl=0x20ed244) returned 1 [0131.597] DeleteObject (ho=0x80a09ec) returned 1 [0131.598] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.598] AdjustWindowRectEx (in: lpRect=0x19ed40, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed40) returned 1 [0131.598] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.598] AdjustWindowRectEx (in: lpRect=0x19ec0c, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec0c) returned 1 [0131.598] GdipGetFamilyName (in: family=0x5a05e10, name=0x19ebd8, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0131.598] GetDeviceCaps (hdc=0x2c010a0f, index=90) returned 96 [0131.598] CoTaskMemAlloc (cb=0x5c) returned 0x5d11d8 [0131.599] CreateFontIndirectW (lplf=0x5d11d8) returned 0x90a09ec [0131.599] CoTaskMemFree (pv=0x5d11d8) [0131.599] GetObjectW (in: h=0x90a09ec, c=92, pv=0x19ebb0 | out: pv=0x19ebb0) returned 92 [0131.599] GetTextExtentPoint32W (in: hdc=0x2c010a0f, lpString="0", c=1, psizl=0x20ed490 | out: psizl=0x20ed490) returned 1 [0131.599] DeleteObject (ho=0x90a09ec) returned 1 [0131.599] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.599] AdjustWindowRectEx (in: lpRect=0x19ebe8, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ebe8) returned 1 [0131.672] GdipGetFamilyName (in: family=0x5a05e10, name=0x19ead8, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0131.672] GetDeviceCaps (hdc=0x2c010a0f, index=90) returned 96 [0131.672] CoTaskMemAlloc (cb=0x5c) returned 0x5d1240 [0131.673] CreateFontIndirectW (lplf=0x5d1240) returned 0xa0a09ec [0131.673] CoTaskMemFree (pv=0x5d1240) [0131.673] GetObjectW (in: h=0xa0a09ec, c=92, pv=0x19eab0 | out: pv=0x19eab0) returned 92 [0131.673] GetMapMode (hdc=0x2c010a0f) returned 1 [0131.674] GetTextMetricsW (in: hdc=0x2c010a0f, lptm=0x19eabc | out: lptm=0x19eabc) returned 1 [0131.675] DrawTextExW (in: hdc=0x2c010a0f, lpchText="PAUSE", cchText=5, lprc=0x19ebd0, format=0x2400, lpdtp=0x20ed794 | out: lpchText="PAUSE", lprc=0x19ebd0) returned 18 [0131.770] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.771] AdjustWindowRectEx (in: lpRect=0x19ecbc, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ecbc) returned 1 [0131.771] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.772] AdjustWindowRectEx (in: lpRect=0x19ec20, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec20) returned 1 [0131.772] GdipGetFamilyName (in: family=0x5a05e10, name=0x19ebec, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0131.772] GetDeviceCaps (hdc=0x2c010a0f, index=90) returned 96 [0131.772] CoTaskMemAlloc (cb=0x5c) returned 0x5d0dc8 [0131.772] CreateFontIndirectW (lplf=0x5d0dc8) returned 0x410a0687 [0131.772] CoTaskMemFree (pv=0x5d0dc8) [0131.772] GetObjectW (in: h=0x410a0687, c=92, pv=0x19ebc4 | out: pv=0x19ebc4) returned 92 [0131.773] SelectObject (hdc=0x2c010a0f, h=0x410a0687) returned 0xe0a09f1 [0131.773] DeleteObject (ho=0xe0a09f1) returned 1 [0131.773] GetTextExtentPoint32W (in: hdc=0x2c010a0f, lpString="0", c=1, psizl=0x20eda6c | out: psizl=0x20eda6c) returned 1 [0131.774] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.774] AdjustWindowRectEx (in: lpRect=0x19ecf4, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ecf4) returned 1 [0131.774] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.774] AdjustWindowRectEx (in: lpRect=0x19ec18, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec18) returned 1 [0131.774] GdipGetFamilyName (in: family=0x5a05e10, name=0x19ebe4, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0131.775] GetDeviceCaps (hdc=0x2c010a0f, index=90) returned 96 [0131.775] CoTaskMemAlloc (cb=0x5c) returned 0x5d11d8 [0131.775] CreateFontIndirectW (lplf=0x5d11d8) returned 0xf0a09f1 [0131.775] CoTaskMemFree (pv=0x5d11d8) [0131.775] GetObjectW (in: h=0xf0a09f1, c=92, pv=0x19ebbc | out: pv=0x19ebbc) returned 92 [0131.775] GetTextExtentPoint32W (in: hdc=0x2c010a0f, lpString="0", c=1, psizl=0x20edc98 | out: psizl=0x20edc98) returned 1 [0131.775] DeleteObject (ho=0xf0a09f1) returned 1 [0131.776] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.776] AdjustWindowRectEx (in: lpRect=0x19ecec, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ecec) returned 1 [0131.776] GdipCreateFontFamilyFromName (name="Microsoft Sans Serif", fontCollection=0x0, fontFamily=0x19edbc) returned 0x0 [0131.776] GdipCreateFont (fontFamily=0x5a05e10, emSize=0x41300000, style=1, unit=0x3, font=0x20edd10) returned 0x0 [0131.776] GdipGetFontSize (font=0x5a0b0a0, size=0x20edd14) returned 0x0 [0131.776] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.776] AdjustWindowRectEx (in: lpRect=0x19ebd8, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ebd8) returned 1 [0131.777] GdipGetFamilyName (in: family=0x5a05e10, name=0x19eba4, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0131.777] GetDeviceCaps (hdc=0x2c010a0f, index=90) returned 96 [0131.777] CoTaskMemAlloc (cb=0x5c) returned 0x5d11d8 [0131.777] CreateFontIndirectW (lplf=0x5d11d8) returned 0x100a09f1 [0131.777] CoTaskMemFree (pv=0x5d11d8) [0131.777] GetObjectW (in: h=0x100a09f1, c=92, pv=0x19eb7c | out: pv=0x19eb7c) returned 92 [0131.777] SelectObject (hdc=0x2c010a0f, h=0x100a09f1) returned 0x410a0687 [0131.778] DeleteObject (ho=0x410a0687) returned 1 [0131.778] GetTextExtentPoint32W (in: hdc=0x2c010a0f, lpString="0", c=1, psizl=0x20ee024 | out: psizl=0x20ee024) returned 1 [0131.778] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.778] AdjustWindowRectEx (in: lpRect=0x19ecac, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ecac) returned 1 [0131.778] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.779] AdjustWindowRectEx (in: lpRect=0x19ec0c, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec0c) returned 1 [0131.779] GdipGetFamilyName (in: family=0x5a05e10, name=0x19ebd8, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0131.779] GetDeviceCaps (hdc=0x2c010a0f, index=90) returned 96 [0131.779] CoTaskMemAlloc (cb=0x5c) returned 0x5d0e30 [0131.779] CreateFontIndirectW (lplf=0x5d0e30) returned 0x420a0687 [0131.779] CoTaskMemFree (pv=0x5d0e30) [0131.779] GetObjectW (in: h=0x420a0687, c=92, pv=0x19ebb0 | out: pv=0x19ebb0) returned 92 [0131.780] GetTextExtentPoint32W (in: hdc=0x2c010a0f, lpString="0", c=1, psizl=0x20ee234 | out: psizl=0x20ee234) returned 1 [0131.780] DeleteObject (ho=0x420a0687) returned 1 [0131.780] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.780] AdjustWindowRectEx (in: lpRect=0x19ed40, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed40) returned 1 [0131.781] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.781] AdjustWindowRectEx (in: lpRect=0x19ec0c, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec0c) returned 1 [0131.781] GdipGetFamilyName (in: family=0x5a05e10, name=0x19ebd8, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0131.783] GetDeviceCaps (hdc=0x2c010a0f, index=90) returned 96 [0131.783] CoTaskMemAlloc (cb=0x5c) returned 0x5d0d60 [0131.783] CreateFontIndirectW (lplf=0x5d0d60) returned 0x430a0687 [0131.783] CoTaskMemFree (pv=0x5d0d60) [0131.783] GetObjectW (in: h=0x430a0687, c=92, pv=0x19ebb0 | out: pv=0x19ebb0) returned 92 [0131.783] GetTextExtentPoint32W (in: hdc=0x2c010a0f, lpString="0", c=1, psizl=0x20ee480 | out: psizl=0x20ee480) returned 1 [0131.783] DeleteObject (ho=0x430a0687) returned 1 [0131.784] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.784] AdjustWindowRectEx (in: lpRect=0x19ebe8, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ebe8) returned 1 [0131.784] DrawTextExW (in: hdc=0x2c010a0f, lpchText="NEW GAME", cchText=8, lprc=0x19ebd0, format=0x2400, lpdtp=0x20ee4f4 | out: lpchText="NEW GAME", lprc=0x19ebd0) returned 18 [0131.785] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.785] AdjustWindowRectEx (in: lpRect=0x19ecbc, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ecbc) returned 1 [0131.785] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.785] AdjustWindowRectEx (in: lpRect=0x19ec20, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec20) returned 1 [0131.785] GdipGetFamilyName (in: family=0x5a05e10, name=0x19ebec, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0131.785] GetDeviceCaps (hdc=0x2c010a0f, index=90) returned 96 [0131.786] CoTaskMemAlloc (cb=0x5c) returned 0x5d0d60 [0131.786] CreateFontIndirectW (lplf=0x5d0d60) returned 0x440a0687 [0131.786] CoTaskMemFree (pv=0x5d0d60) [0131.786] GetObjectW (in: h=0x440a0687, c=92, pv=0x19ebc4 | out: pv=0x19ebc4) returned 92 [0131.786] SelectObject (hdc=0x2c010a0f, h=0x440a0687) returned 0x100a09f1 [0131.786] DeleteObject (ho=0x100a09f1) returned 1 [0131.786] GetTextExtentPoint32W (in: hdc=0x2c010a0f, lpString="0", c=1, psizl=0x20ee788 | out: psizl=0x20ee788) returned 1 [0131.787] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.787] AdjustWindowRectEx (in: lpRect=0x19ecf4, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ecf4) returned 1 [0131.787] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.787] AdjustWindowRectEx (in: lpRect=0x19ec18, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec18) returned 1 [0131.787] GdipGetFamilyName (in: family=0x5a05e10, name=0x19ebe4, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0131.787] GetDeviceCaps (hdc=0x2c010a0f, index=90) returned 96 [0131.788] CoTaskMemAlloc (cb=0x5c) returned 0x5d0f68 [0131.788] CreateFontIndirectW (lplf=0x5d0f68) returned 0x110a09f1 [0131.788] CoTaskMemFree (pv=0x5d0f68) [0131.788] GetObjectW (in: h=0x110a09f1, c=92, pv=0x19ebbc | out: pv=0x19ebbc) returned 92 [0131.788] GetTextExtentPoint32W (in: hdc=0x2c010a0f, lpString="0", c=1, psizl=0x20ee9b4 | out: psizl=0x20ee9b4) returned 1 [0131.788] DeleteObject (ho=0x110a09f1) returned 1 [0131.788] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.788] AdjustWindowRectEx (in: lpRect=0x19ecec, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ecec) returned 1 [0131.789] GdipCreateFontFamilyFromName (name="Microsoft Sans Serif", fontCollection=0x0, fontFamily=0x19edbc) returned 0x0 [0131.789] GdipCreateFont (fontFamily=0x5a05e10, emSize=0x41300000, style=1, unit=0x3, font=0x20eea2c) returned 0x0 [0131.789] GdipGetFontSize (font=0x5a0b0c8, size=0x20eea30) returned 0x0 [0131.789] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.789] AdjustWindowRectEx (in: lpRect=0x19ebd8, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ebd8) returned 1 [0131.789] GdipGetFamilyName (in: family=0x5a05e10, name=0x19eba4, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0131.789] GetDeviceCaps (hdc=0x2c010a0f, index=90) returned 96 [0131.789] CoTaskMemAlloc (cb=0x5c) returned 0x5d0c28 [0131.790] CreateFontIndirectW (lplf=0x5d0c28) returned 0x120a09f1 [0131.790] CoTaskMemFree (pv=0x5d0c28) [0131.790] GetObjectW (in: h=0x120a09f1, c=92, pv=0x19eb7c | out: pv=0x19eb7c) returned 92 [0131.790] SelectObject (hdc=0x2c010a0f, h=0x120a09f1) returned 0x440a0687 [0131.790] DeleteObject (ho=0x440a0687) returned 1 [0131.790] GetTextExtentPoint32W (in: hdc=0x2c010a0f, lpString="0", c=1, psizl=0x20eed40 | out: psizl=0x20eed40) returned 1 [0131.791] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.801] AdjustWindowRectEx (in: lpRect=0x19ecac, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ecac) returned 1 [0131.801] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.802] AdjustWindowRectEx (in: lpRect=0x19ec0c, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec0c) returned 1 [0131.802] GdipGetFamilyName (in: family=0x5a05e10, name=0x19ebd8, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0131.802] GetDeviceCaps (hdc=0x2c010a0f, index=90) returned 96 [0131.802] CoTaskMemAlloc (cb=0x5c) returned 0x5d0cf8 [0131.802] CreateFontIndirectW (lplf=0x5d0cf8) returned 0x450a0687 [0131.802] CoTaskMemFree (pv=0x5d0cf8) [0131.802] GetObjectW (in: h=0x450a0687, c=92, pv=0x19ebb0 | out: pv=0x19ebb0) returned 92 [0131.803] GetTextExtentPoint32W (in: hdc=0x2c010a0f, lpString="0", c=1, psizl=0x20eef50 | out: psizl=0x20eef50) returned 1 [0131.803] DeleteObject (ho=0x450a0687) returned 1 [0131.803] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.804] AdjustWindowRectEx (in: lpRect=0x19ed40, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed40) returned 1 [0131.804] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.804] AdjustWindowRectEx (in: lpRect=0x19ec0c, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec0c) returned 1 [0131.804] GdipGetFamilyName (in: family=0x5a05e10, name=0x19ebd8, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0131.804] GetDeviceCaps (hdc=0x2c010a0f, index=90) returned 96 [0131.804] CoTaskMemAlloc (cb=0x5c) returned 0x5d11d8 [0131.804] CreateFontIndirectW (lplf=0x5d11d8) returned 0x460a0687 [0131.804] CoTaskMemFree (pv=0x5d11d8) [0131.805] GetObjectW (in: h=0x460a0687, c=92, pv=0x19ebb0 | out: pv=0x19ebb0) returned 92 [0131.805] GetTextExtentPoint32W (in: hdc=0x2c010a0f, lpString="0", c=1, psizl=0x20ef19c | out: psizl=0x20ef19c) returned 1 [0131.805] DeleteObject (ho=0x460a0687) returned 1 [0131.805] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.805] AdjustWindowRectEx (in: lpRect=0x19ebe8, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ebe8) returned 1 [0131.806] DrawTextExW (in: hdc=0x2c010a0f, lpchText="HIGHEST SCORE", cchText=13, lprc=0x19ebd0, format=0x2400, lpdtp=0x20ef210 | out: lpchText="HIGHEST SCORE", lprc=0x19ebd0) returned 18 [0131.806] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.806] AdjustWindowRectEx (in: lpRect=0x19ecbc, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ecbc) returned 1 [0131.806] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.806] AdjustWindowRectEx (in: lpRect=0x19ec20, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec20) returned 1 [0131.807] GdipGetFamilyName (in: family=0x5a05e10, name=0x19ebec, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0131.807] GetDeviceCaps (hdc=0x2c010a0f, index=90) returned 96 [0131.807] CoTaskMemAlloc (cb=0x5c) returned 0x5d0c28 [0131.807] CreateFontIndirectW (lplf=0x5d0c28) returned 0x470a0687 [0131.807] CoTaskMemFree (pv=0x5d0c28) [0131.807] GetObjectW (in: h=0x470a0687, c=92, pv=0x19ebc4 | out: pv=0x19ebc4) returned 92 [0131.807] SelectObject (hdc=0x2c010a0f, h=0x470a0687) returned 0x120a09f1 [0131.807] DeleteObject (ho=0x120a09f1) returned 1 [0131.807] GetTextExtentPoint32W (in: hdc=0x2c010a0f, lpString="0", c=1, psizl=0x20ef4a4 | out: psizl=0x20ef4a4) returned 1 [0131.808] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.808] AdjustWindowRectEx (in: lpRect=0x19ecf4, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ecf4) returned 1 [0131.808] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.809] AdjustWindowRectEx (in: lpRect=0x19ec18, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec18) returned 1 [0131.809] GdipGetFamilyName (in: family=0x5a05e10, name=0x19ebe4, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0131.809] GetDeviceCaps (hdc=0x2c010a0f, index=90) returned 96 [0131.809] CoTaskMemAlloc (cb=0x5c) returned 0x5d0cf8 [0131.809] CreateFontIndirectW (lplf=0x5d0cf8) returned 0x130a09f1 [0131.809] CoTaskMemFree (pv=0x5d0cf8) [0131.809] GetObjectW (in: h=0x130a09f1, c=92, pv=0x19ebbc | out: pv=0x19ebbc) returned 92 [0131.809] GetTextExtentPoint32W (in: hdc=0x2c010a0f, lpString="0", c=1, psizl=0x20ef6d0 | out: psizl=0x20ef6d0) returned 1 [0131.809] DeleteObject (ho=0x130a09f1) returned 1 [0131.810] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.810] AdjustWindowRectEx (in: lpRect=0x19ecec, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ecec) returned 1 [0131.810] GdipCreateFontFamilyFromName (name="Microsoft Sans Serif", fontCollection=0x0, fontFamily=0x19edbc) returned 0x0 [0131.810] GdipCreateFont (fontFamily=0x5a05e10, emSize=0x41300000, style=1, unit=0x3, font=0x20ef748) returned 0x0 [0131.810] GdipGetFontSize (font=0x5a0b0f0, size=0x20ef74c) returned 0x0 [0131.810] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.811] AdjustWindowRectEx (in: lpRect=0x19ebd8, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ebd8) returned 1 [0131.811] GdipGetFamilyName (in: family=0x5a05e10, name=0x19eba4, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0131.811] GetDeviceCaps (hdc=0x2c010a0f, index=90) returned 96 [0131.811] CoTaskMemAlloc (cb=0x5c) returned 0x5d0f68 [0131.811] CreateFontIndirectW (lplf=0x5d0f68) returned 0x140a09f1 [0131.811] CoTaskMemFree (pv=0x5d0f68) [0131.811] GetObjectW (in: h=0x140a09f1, c=92, pv=0x19eb7c | out: pv=0x19eb7c) returned 92 [0131.811] SelectObject (hdc=0x2c010a0f, h=0x140a09f1) returned 0x470a0687 [0131.811] DeleteObject (ho=0x470a0687) returned 1 [0131.812] GetTextExtentPoint32W (in: hdc=0x2c010a0f, lpString="0", c=1, psizl=0x20efa5c | out: psizl=0x20efa5c) returned 1 [0131.812] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.812] AdjustWindowRectEx (in: lpRect=0x19ecac, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ecac) returned 1 [0131.813] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.813] AdjustWindowRectEx (in: lpRect=0x19ec0c, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec0c) returned 1 [0131.813] GdipGetFamilyName (in: family=0x5a05e10, name=0x19ebd8, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0131.813] GetDeviceCaps (hdc=0x2c010a0f, index=90) returned 96 [0131.813] CoTaskMemAlloc (cb=0x5c) returned 0x5d11d8 [0131.813] CreateFontIndirectW (lplf=0x5d11d8) returned 0x480a0687 [0131.813] CoTaskMemFree (pv=0x5d11d8) [0131.813] GetObjectW (in: h=0x480a0687, c=92, pv=0x19ebb0 | out: pv=0x19ebb0) returned 92 [0131.814] GetTextExtentPoint32W (in: hdc=0x2c010a0f, lpString="0", c=1, psizl=0x20efc6c | out: psizl=0x20efc6c) returned 1 [0131.814] DeleteObject (ho=0x480a0687) returned 1 [0131.814] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.814] AdjustWindowRectEx (in: lpRect=0x19ed40, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed40) returned 1 [0131.814] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.814] AdjustWindowRectEx (in: lpRect=0x19ec0c, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec0c) returned 1 [0131.814] GdipGetFamilyName (in: family=0x5a05e10, name=0x19ebd8, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0131.815] GetDeviceCaps (hdc=0x2c010a0f, index=90) returned 96 [0131.815] CoTaskMemAlloc (cb=0x5c) returned 0x5d0d60 [0131.815] CreateFontIndirectW (lplf=0x5d0d60) returned 0x490a0687 [0131.815] CoTaskMemFree (pv=0x5d0d60) [0131.815] GetObjectW (in: h=0x490a0687, c=92, pv=0x19ebb0 | out: pv=0x19ebb0) returned 92 [0131.815] GetTextExtentPoint32W (in: hdc=0x2c010a0f, lpString="0", c=1, psizl=0x20efeb8 | out: psizl=0x20efeb8) returned 1 [0131.815] DeleteObject (ho=0x490a0687) returned 1 [0131.816] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.816] AdjustWindowRectEx (in: lpRect=0x19ebe8, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ebe8) returned 1 [0131.816] DrawTextExW (in: hdc=0x2c010a0f, lpchText="HELP", cchText=4, lprc=0x19ebd0, format=0x2400, lpdtp=0x20eff2c | out: lpchText="HELP", lprc=0x19ebd0) returned 18 [0131.816] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.817] AdjustWindowRectEx (in: lpRect=0x19ecbc, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ecbc) returned 1 [0131.817] GdipCreateFontFamilyFromName (name="Mistral", fontCollection=0x0, fontFamily=0x19edbc) returned 0x0 [0131.817] GdipCreateFont (fontFamily=0x48f8140, emSize=0x41b00000, style=3, unit=0x3, font=0x20effcc) returned 0x0 [0131.817] GdipGetFontSize (font=0x5a0b118, size=0x20effd0) returned 0x0 [0131.817] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.817] AdjustWindowRectEx (in: lpRect=0x19ed40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed40) returned 1 [0131.818] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.818] AdjustWindowRectEx (in: lpRect=0x19ed40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed40) returned 1 [0131.818] GdipCreateFontFamilyFromName (name="Mistral", fontCollection=0x0, fontFamily=0x19edbc) returned 0x0 [0131.818] GdipCreateFont (fontFamily=0x48f8140, emSize=0x41b00000, style=3, unit=0x3, font=0x20f017c) returned 0x0 [0131.818] GdipGetFontSize (font=0x5a0b140, size=0x20f0180) returned 0x0 [0131.818] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.818] AdjustWindowRectEx (in: lpRect=0x19ed40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed40) returned 1 [0131.818] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.819] AdjustWindowRectEx (in: lpRect=0x19ed40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed40) returned 1 [0131.819] GdipCreateFontFamilyFromName (name="Mistral", fontCollection=0x0, fontFamily=0x19edbc) returned 0x0 [0131.819] GdipCreateFont (fontFamily=0x48f8140, emSize=0x41b00000, style=3, unit=0x3, font=0x20f032c) returned 0x0 [0131.819] GdipGetFontSize (font=0x5a0b168, size=0x20f0330) returned 0x0 [0131.819] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.819] AdjustWindowRectEx (in: lpRect=0x19ed40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed40) returned 1 [0131.820] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.820] AdjustWindowRectEx (in: lpRect=0x19ed40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed40) returned 1 [0131.820] GdipCreateFontFamilyFromName (name="Mistral", fontCollection=0x0, fontFamily=0x19edbc) returned 0x0 [0131.820] GdipCreateFont (fontFamily=0x48f8140, emSize=0x41a00000, style=3, unit=0x3, font=0x20f04dc) returned 0x0 [0131.820] GdipGetFontSize (font=0x5a0b190, size=0x20f04e0) returned 0x0 [0131.820] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.820] AdjustWindowRectEx (in: lpRect=0x19ed40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed40) returned 1 [0131.821] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.821] AdjustWindowRectEx (in: lpRect=0x19ed40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed40) returned 1 [0131.822] GdipCreateFontFamilyFromName (name="Mistral", fontCollection=0x0, fontFamily=0x19edbc) returned 0x0 [0131.822] GdipCreateFont (fontFamily=0x48f8140, emSize=0x41a00000, style=3, unit=0x3, font=0x20f06dc) returned 0x0 [0131.822] GdipGetFontSize (font=0x5a0b1b8, size=0x20f06e0) returned 0x0 [0131.824] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.824] AdjustWindowRectEx (in: lpRect=0x19ed40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed40) returned 1 [0131.824] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.824] AdjustWindowRectEx (in: lpRect=0x19ed40, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed40) returned 1 [0131.827] GdipCreateFontFamilyFromName (name="Microsoft Sans Serif", fontCollection=0x0, fontFamily=0x19edbc) returned 0x0 [0131.827] GdipCreateFont (fontFamily=0x5a05e10, emSize=0x41800000, style=1, unit=0x3, font=0x20f09a0) returned 0x0 [0131.827] GdipGetFontSize (font=0x5a0b1e0, size=0x20f09a4) returned 0x0 [0131.827] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.827] AdjustWindowRectEx (in: lpRect=0x19ed40, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed40) returned 1 [0131.828] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.828] AdjustWindowRectEx (in: lpRect=0x19ed40, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed40) returned 1 [0131.828] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.828] AdjustWindowRectEx (in: lpRect=0x19ed6c, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed6c) returned 1 [0131.828] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.828] AdjustWindowRectEx (in: lpRect=0x19ed6c, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed6c) returned 1 [0131.830] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.831] AdjustWindowRectEx (in: lpRect=0x19ed6c, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed6c) returned 1 [0131.831] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.831] AdjustWindowRectEx (in: lpRect=0x19ed6c, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed6c) returned 1 [0131.836] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.836] AdjustWindowRectEx (in: lpRect=0x19ed6c, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed6c) returned 1 [0131.836] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.836] AdjustWindowRectEx (in: lpRect=0x19ed6c, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed6c) returned 1 [0131.836] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.836] AdjustWindowRectEx (in: lpRect=0x19ed6c, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed6c) returned 1 [0131.837] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.837] AdjustWindowRectEx (in: lpRect=0x19ed6c, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed6c) returned 1 [0131.837] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.837] AdjustWindowRectEx (in: lpRect=0x19ed6c, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed6c) returned 1 [0131.837] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.838] AdjustWindowRectEx (in: lpRect=0x19ed6c, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ed6c) returned 1 [0131.844] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.845] AdjustWindowRectEx (in: lpRect=0x19eda0, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19eda0) returned 1 [0131.845] GetSystemMetrics (nIndex=59) returned 1456 [0131.845] GetSystemMetrics (nIndex=60) returned 916 [0131.845] GetSystemMetrics (nIndex=34) returned 136 [0131.845] GetSystemMetrics (nIndex=35) returned 39 [0131.846] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.846] AdjustWindowRectEx (in: lpRect=0x19eca0, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19eca0) returned 1 [0131.846] GetCurrentThreadId () returned 0x3f8 [0131.846] GetCurrentThreadId () returned 0x3f8 [0131.846] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.850] AdjustWindowRectEx (in: lpRect=0x19eb9c, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eb9c) returned 1 [0131.850] GdipGetFamilyName (in: family=0x5a05e10, name=0x19ea8c, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0131.850] GetDeviceCaps (hdc=0x2c010a0f, index=90) returned 96 [0131.850] CoTaskMemAlloc (cb=0x5c) returned 0x5d0f68 [0131.850] CreateFontIndirectW (lplf=0x5d0f68) returned 0x4a0a0687 [0131.850] CoTaskMemFree (pv=0x5d0f68) [0131.850] GetObjectW (in: h=0x4a0a0687, c=92, pv=0x19ea64 | out: pv=0x19ea64) returned 92 [0131.851] SelectObject (hdc=0x2c010a0f, h=0x4a0a0687) returned 0x140a09f1 [0131.851] DeleteObject (ho=0x140a09f1) returned 1 [0131.851] GetMapMode (hdc=0x2c010a0f) returned 1 [0131.851] GetTextMetricsW (in: hdc=0x2c010a0f, lptm=0x19ea70 | out: lptm=0x19ea70) returned 1 [0131.876] DrawTextExW (in: hdc=0x2c010a0f, lpchText="Switch Mode", cchText=11, lprc=0x19eb84, format=0x2400, lpdtp=0x20f1320 | out: lpchText="Switch Mode", lprc=0x19eb84) returned 26 [0131.894] GetCurrentThreadId () returned 0x3f8 [0131.894] GetCurrentThreadId () returned 0x3f8 [0131.894] GetCurrentThreadId () returned 0x3f8 [0131.894] GetCurrentThreadId () returned 0x3f8 [0131.895] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.895] AdjustWindowRectEx (in: lpRect=0x19eb9c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eb9c) returned 1 [0131.895] GdipGetFamilyName (in: family=0x48f8140, name=0x19ea8c, language=0x409 | out: name="Mistral") returned 0x0 [0131.895] GetDeviceCaps (hdc=0x2c010a0f, index=90) returned 96 [0131.896] CoTaskMemAlloc (cb=0x5c) returned 0x5d0f68 [0131.896] CreateFontIndirectW (lplf=0x5d0f68) returned 0x150a09f1 [0131.896] CoTaskMemFree (pv=0x5d0f68) [0131.896] GetObjectW (in: h=0x150a09f1, c=92, pv=0x19ea64 | out: pv=0x19ea64) returned 92 [0131.896] SelectObject (hdc=0x2c010a0f, h=0x150a09f1) returned 0x4a0a0687 [0131.896] GetMapMode (hdc=0x2c010a0f) returned 1 [0131.896] GetTextMetricsW (in: hdc=0x2c010a0f, lptm=0x19ea70 | out: lptm=0x19ea70) returned 1 [0131.899] DrawTextExW (in: hdc=0x2c010a0f, lpchText="Easy", cchText=4, lprc=0x19eb84, format=0x2400, lpdtp=0x20f15b8 | out: lpchText="Easy", lprc=0x19eb84) returned 33 [0131.905] GetCurrentThreadId () returned 0x3f8 [0131.905] GetCurrentThreadId () returned 0x3f8 [0131.905] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.905] AdjustWindowRectEx (in: lpRect=0x19eb9c, dwStyle=0x4600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eb9c) returned 1 [0131.905] DrawTextExW (in: hdc=0x2c010a0f, lpchText="NightMare", cchText=9, lprc=0x19eb84, format=0x2400, lpdtp=0x20f1694 | out: lpchText="NightMare", lprc=0x19eb84) returned 33 [0131.907] GetCurrentThreadId () returned 0x3f8 [0131.907] GetCurrentThreadId () returned 0x3f8 [0131.907] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.907] AdjustWindowRectEx (in: lpRect=0x19eb9c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eb9c) returned 1 [0131.907] GdipGetFamilyName (in: family=0x48f8140, name=0x19ea8c, language=0x409 | out: name="Mistral") returned 0x0 [0131.907] GetDeviceCaps (hdc=0x2c010a0f, index=90) returned 96 [0131.907] CoTaskMemAlloc (cb=0x5c) returned 0x5d11d8 [0131.908] CreateFontIndirectW (lplf=0x5d11d8) returned 0x450a067b [0131.908] CoTaskMemFree (pv=0x5d11d8) [0131.908] GetObjectW (in: h=0x450a067b, c=92, pv=0x19ea64 | out: pv=0x19ea64) returned 92 [0131.908] SelectObject (hdc=0x2c010a0f, h=0x450a067b) returned 0x150a09f1 [0131.908] GetMapMode (hdc=0x2c010a0f) returned 1 [0131.909] GetTextMetricsW (in: hdc=0x2c010a0f, lptm=0x19ea70 | out: lptm=0x19ea70) returned 1 [0131.909] DrawTextExW (in: hdc=0x2c010a0f, lpchText="MODE:", cchText=5, lprc=0x19eb84, format=0x2400, lpdtp=0x20f190c | out: lpchText="MODE:", lprc=0x19eb84) returned 35 [0131.911] GetCurrentThreadId () returned 0x3f8 [0131.911] GetCurrentThreadId () returned 0x3f8 [0131.911] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.911] AdjustWindowRectEx (in: lpRect=0x19eb9c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eb9c) returned 1 [0131.911] DrawTextExW (in: hdc=0x2c010a0f, lpchText="SPEED:", cchText=6, lprc=0x19eb84, format=0x2400, lpdtp=0x20f19e8 | out: lpchText="SPEED:", lprc=0x19eb84) returned 35 [0131.912] GetCurrentThreadId () returned 0x3f8 [0131.912] GetCurrentThreadId () returned 0x3f8 [0131.912] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.912] AdjustWindowRectEx (in: lpRect=0x19eb9c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eb9c) returned 1 [0131.912] DrawTextExW (in: hdc=0x2c010a0f, lpchText="15", cchText=2, lprc=0x19eb84, format=0x2400, lpdtp=0x20f1ac4 | out: lpchText="15", lprc=0x19eb84) returned 35 [0131.913] GetCurrentThreadId () returned 0x3f8 [0131.913] GetCurrentThreadId () returned 0x3f8 [0131.913] GetCurrentThreadId () returned 0x3f8 [0131.913] GetCurrentThreadId () returned 0x3f8 [0131.913] GetCurrentThreadId () returned 0x3f8 [0131.913] GetCurrentThreadId () returned 0x3f8 [0131.913] GetCurrentThreadId () returned 0x3f8 [0131.913] GetCurrentThreadId () returned 0x3f8 [0131.913] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.913] AdjustWindowRectEx (in: lpRect=0x19eb9c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eb9c) returned 1 [0131.913] DrawTextExW (in: hdc=0x2c010a0f, lpchText="00:01", cchText=5, lprc=0x19eb84, format=0x2400, lpdtp=0x20f1cd0 | out: lpchText="00:01", lprc=0x19eb84) returned 35 [0131.914] GetCurrentThreadId () returned 0x3f8 [0131.914] GetCurrentThreadId () returned 0x3f8 [0131.914] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.914] AdjustWindowRectEx (in: lpRect=0x19eb9c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eb9c) returned 1 [0131.914] DrawTextExW (in: hdc=0x2c010a0f, lpchText="TIME:", cchText=5, lprc=0x19eb84, format=0x2400, lpdtp=0x20f1dac | out: lpchText="TIME:", lprc=0x19eb84) returned 35 [0131.915] GetCurrentThreadId () returned 0x3f8 [0131.915] GetCurrentThreadId () returned 0x3f8 [0131.915] GetCurrentThreadId () returned 0x3f8 [0131.915] GetCurrentThreadId () returned 0x3f8 [0131.915] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.915] AdjustWindowRectEx (in: lpRect=0x19eb9c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eb9c) returned 1 [0131.915] GdipGetFamilyName (in: family=0x48f8140, name=0x19ea8c, language=0x409 | out: name="Mistral") returned 0x0 [0131.916] GetDeviceCaps (hdc=0x2c010a0f, index=90) returned 96 [0131.916] CoTaskMemAlloc (cb=0x5c) returned 0x5d0f68 [0131.916] CreateFontIndirectW (lplf=0x5d0f68) returned 0x300a0551 [0131.917] CoTaskMemFree (pv=0x5d0f68) [0131.917] GetObjectW (in: h=0x300a0551, c=92, pv=0x19ea64 | out: pv=0x19ea64) returned 92 [0131.917] SelectObject (hdc=0x2c010a0f, h=0x300a0551) returned 0x450a067b [0131.921] GetMapMode (hdc=0x2c010a0f) returned 1 [0131.921] GetTextMetricsW (in: hdc=0x2c010a0f, lptm=0x19ea70 | out: lptm=0x19ea70) returned 1 [0131.921] DrawTextExW (in: hdc=0x2c010a0f, lpchText="Snake World !!!", cchText=15, lprc=0x19eb84, format=0x2400, lpdtp=0x20f2044 | out: lpchText="Snake World !!!", lprc=0x19eb84) returned 38 [0131.930] GetCurrentThreadId () returned 0x3f8 [0131.930] GetCurrentThreadId () returned 0x3f8 [0131.930] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.931] AdjustWindowRectEx (in: lpRect=0x19eb9c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eb9c) returned 1 [0131.931] SelectObject (hdc=0x2c010a0f, h=0x450a067b) returned 0x300a0551 [0131.931] DrawTextExW (in: hdc=0x2c010a0f, lpchText="100", cchText=3, lprc=0x19eb84, format=0x2400, lpdtp=0x20f213c | out: lpchText="100", lprc=0x19eb84) returned 35 [0131.931] GetCurrentThreadId () returned 0x3f8 [0131.931] GetCurrentThreadId () returned 0x3f8 [0131.931] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.932] AdjustWindowRectEx (in: lpRect=0x19eb9c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eb9c) returned 1 [0131.932] GdipGetFamilyName (in: family=0x48f8140, name=0x19ea8c, language=0x409 | out: name="Mistral") returned 0x0 [0131.932] GetDeviceCaps (hdc=0x2c010a0f, index=90) returned 96 [0131.932] CoTaskMemAlloc (cb=0x5c) returned 0x5d0c28 [0131.932] CreateFontIndirectW (lplf=0x5d0c28) returned 0x170a06db [0131.932] CoTaskMemFree (pv=0x5d0c28) [0131.932] GetObjectW (in: h=0x170a06db, c=92, pv=0x19ea64 | out: pv=0x19ea64) returned 92 [0131.939] SelectObject (hdc=0x2c010a0f, h=0x170a06db) returned 0x450a067b [0131.939] GetMapMode (hdc=0x2c010a0f) returned 1 [0131.939] GetTextMetricsW (in: hdc=0x2c010a0f, lptm=0x19ea70 | out: lptm=0x19ea70) returned 1 [0131.939] DrawTextExW (in: hdc=0x2c010a0f, lpchText="SCORE:", cchText=6, lprc=0x19eb84, format=0x2400, lpdtp=0x20f2388 | out: lpchText="SCORE:", lprc=0x19eb84) returned 35 [0131.942] GetCurrentThreadId () returned 0x3f8 [0131.942] GetCurrentThreadId () returned 0x3f8 [0131.943] CreateCompatibleDC (hdc=0x0) returned 0x120106d2 [0131.944] GetDC (hWnd=0x0) returned 0xa0100d0 [0131.944] GdipCreateFromHDC (hdc=0xa0100d0, graphics=0x19ebf0) returned 0x0 [0131.945] CoTaskMemAlloc (cb=0x5c) returned 0x5d11d8 [0131.945] GdipGetLogFontW (font=0x5a0ab38, graphics=0x5a0f5e8, logfontW=0x5d11d8) returned 0x0 [0131.951] CoTaskMemFree (pv=0x5d11d8) [0131.951] CoTaskMemAlloc (cb=0x5c) returned 0x5d11d8 [0131.951] CoTaskMemFree (pv=0x5d11d8) [0131.951] CoTaskMemAlloc (cb=0x5c) returned 0x5d0e30 [0131.952] CoTaskMemFree (pv=0x5d0e30) [0131.952] GdipDeleteGraphics (graphics=0x5a0f5e8) returned 0x0 [0131.952] ReleaseDC (hWnd=0x0, hDC=0xa0100d0) returned 1 [0131.954] CoTaskMemAlloc (cb=0x5c) returned 0x5d11d8 [0131.954] CreateFontIndirectW (lplf=0x5d11d8) returned 0xb40a0a31 [0131.955] CoTaskMemFree (pv=0x5d11d8) [0131.955] SelectObject (hdc=0x120106d2, h=0xb40a0a31) returned 0x18a0048 [0131.957] GetTextMetricsW (in: hdc=0x120106d2, lptm=0x19ecfc | out: lptm=0x19ecfc) returned 1 [0131.957] GetTextExtentPoint32W (in: hdc=0x120106d2, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x20f281c | out: psizl=0x20f281c) returned 1 [0131.957] SelectObject (hdc=0x120106d2, h=0x18a0048) returned 0xb40a0a31 [0131.958] DeleteDC (hdc=0x120106d2) returned 1 [0131.958] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.958] AdjustWindowRectEx (in: lpRect=0x19ecdc, dwStyle=0x56000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19ecdc) returned 1 [0131.958] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.966] AdjustWindowRectEx (in: lpRect=0x19eb40, dwStyle=0x56000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19eb40) returned 1 [0131.966] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.966] AdjustWindowRectEx (in: lpRect=0x19eca8, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eca8) returned 1 [0131.966] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.967] AdjustWindowRectEx (in: lpRect=0x19eb0c, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eb0c) returned 1 [0131.967] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.967] AdjustWindowRectEx (in: lpRect=0x19e968, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19e968) returned 1 [0131.968] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.968] AdjustWindowRectEx (in: lpRect=0x19eca8, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eca8) returned 1 [0131.968] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.968] AdjustWindowRectEx (in: lpRect=0x19eb0c, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eb0c) returned 1 [0131.968] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.969] AdjustWindowRectEx (in: lpRect=0x19e968, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19e968) returned 1 [0131.969] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.969] AdjustWindowRectEx (in: lpRect=0x19eca8, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eca8) returned 1 [0131.969] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.969] AdjustWindowRectEx (in: lpRect=0x19eb0c, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eb0c) returned 1 [0131.970] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.970] AdjustWindowRectEx (in: lpRect=0x19e968, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19e968) returned 1 [0131.970] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.970] AdjustWindowRectEx (in: lpRect=0x19eca8, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eca8) returned 1 [0131.970] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.971] AdjustWindowRectEx (in: lpRect=0x19eb0c, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eb0c) returned 1 [0131.971] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.971] AdjustWindowRectEx (in: lpRect=0x19e968, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19e968) returned 1 [0131.973] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.974] AdjustWindowRectEx (in: lpRect=0x19ea54, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19ea54) returned 1 [0131.974] GetCursorPos (in: lpPoint=0x20f2f4c | out: lpPoint=0x20f2f4c*(x=1142, y=305)) returned 1 [0131.976] GetSystemMetrics (nIndex=80) returned 1 [0131.980] MonitorFromPoint (pt=0x476, dwFlags=0x131) returned 0x10001 [0131.981] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19e930 | out: lpmi=0x19e930) returned 1 [0131.981] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x140106d2 [0131.982] GetDeviceCaps (hdc=0x140106d2, index=12) returned 32 [0131.982] GetDeviceCaps (hdc=0x140106d2, index=14) returned 1 [0131.982] DeleteDC (hdc=0x140106d2) returned 1 [0131.982] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19e984 | out: lpmi=0x19e984) returned 1 [0131.982] AdjustWindowRectEx (in: lpRect=0x19ec74, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19ec74) returned 1 [0131.982] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.983] AdjustWindowRectEx (in: lpRect=0x19e9cc, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19e9cc) returned 1 [0131.983] GetCursorPos (in: lpPoint=0x20f3280 | out: lpPoint=0x20f3280*(x=1142, y=305)) returned 1 [0131.983] MonitorFromPoint (pt=0x473, dwFlags=0x130) returned 0x10001 [0131.983] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19e8a8 | out: lpmi=0x19e8a8) returned 1 [0131.983] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x150106d2 [0131.983] GetDeviceCaps (hdc=0x150106d2, index=12) returned 32 [0131.983] GetDeviceCaps (hdc=0x150106d2, index=14) returned 1 [0131.983] DeleteDC (hdc=0x150106d2) returned 1 [0131.983] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19e8fc | out: lpmi=0x19e8fc) returned 1 [0131.984] AdjustWindowRectEx (in: lpRect=0x19eaac, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19eaac) returned 1 [0131.984] GetSystemMetrics (nIndex=34) returned 136 [0131.984] GetSystemMetrics (nIndex=35) returned 39 [0131.984] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.984] AdjustWindowRectEx (in: lpRect=0x19ec6c, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec6c) returned 1 [0131.984] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.984] AdjustWindowRectEx (in: lpRect=0x19ead0, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ead0) returned 1 [0131.984] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.992] AdjustWindowRectEx (in: lpRect=0x19e92c, dwStyle=0x5680000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19e92c) returned 1 [0131.992] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.993] AdjustWindowRectEx (in: lpRect=0x19ec6c, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec6c) returned 1 [0131.993] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.993] AdjustWindowRectEx (in: lpRect=0x19ead0, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ead0) returned 1 [0131.993] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.993] AdjustWindowRectEx (in: lpRect=0x19ec6c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec6c) returned 1 [0131.993] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.993] AdjustWindowRectEx (in: lpRect=0x19ead0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ead0) returned 1 [0131.993] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.994] AdjustWindowRectEx (in: lpRect=0x19e92c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19e92c) returned 1 [0131.994] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.994] AdjustWindowRectEx (in: lpRect=0x19ec6c, dwStyle=0x4600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec6c) returned 1 [0131.994] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.994] AdjustWindowRectEx (in: lpRect=0x19ead0, dwStyle=0x4600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ead0) returned 1 [0131.994] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.994] AdjustWindowRectEx (in: lpRect=0x19e92c, dwStyle=0x4600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19e92c) returned 1 [0131.995] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.995] AdjustWindowRectEx (in: lpRect=0x19ec6c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec6c) returned 1 [0131.995] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.995] AdjustWindowRectEx (in: lpRect=0x19ead0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ead0) returned 1 [0131.995] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.995] AdjustWindowRectEx (in: lpRect=0x19e92c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19e92c) returned 1 [0131.995] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.995] AdjustWindowRectEx (in: lpRect=0x19ec6c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec6c) returned 1 [0131.996] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.996] AdjustWindowRectEx (in: lpRect=0x19ead0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ead0) returned 1 [0131.996] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.999] AdjustWindowRectEx (in: lpRect=0x19e92c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19e92c) returned 1 [0131.999] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.999] AdjustWindowRectEx (in: lpRect=0x19ec6c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec6c) returned 1 [0131.999] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0131.999] AdjustWindowRectEx (in: lpRect=0x19ead0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ead0) returned 1 [0131.999] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0132.000] AdjustWindowRectEx (in: lpRect=0x19e92c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19e92c) returned 1 [0132.000] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0132.000] AdjustWindowRectEx (in: lpRect=0x19ec6c, dwStyle=0x46000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec6c) returned 1 [0132.000] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0132.000] AdjustWindowRectEx (in: lpRect=0x19ead0, dwStyle=0x46000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ead0) returned 1 [0132.000] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0132.000] AdjustWindowRectEx (in: lpRect=0x19ec6c, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec6c) returned 1 [0132.001] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0132.001] AdjustWindowRectEx (in: lpRect=0x19ead0, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ead0) returned 1 [0132.001] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0132.001] AdjustWindowRectEx (in: lpRect=0x19ec6c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec6c) returned 1 [0132.001] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0132.001] AdjustWindowRectEx (in: lpRect=0x19ead0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ead0) returned 1 [0132.001] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0132.001] AdjustWindowRectEx (in: lpRect=0x19e92c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19e92c) returned 1 [0132.002] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0132.002] AdjustWindowRectEx (in: lpRect=0x19ec6c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec6c) returned 1 [0132.002] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0132.002] AdjustWindowRectEx (in: lpRect=0x19ead0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ead0) returned 1 [0132.002] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0132.002] AdjustWindowRectEx (in: lpRect=0x19e92c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19e92c) returned 1 [0132.002] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0132.002] AdjustWindowRectEx (in: lpRect=0x19ec6c, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec6c) returned 1 [0132.003] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0132.003] AdjustWindowRectEx (in: lpRect=0x19ead0, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ead0) returned 1 [0132.003] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0132.003] AdjustWindowRectEx (in: lpRect=0x19ec6c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec6c) returned 1 [0132.003] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0132.003] AdjustWindowRectEx (in: lpRect=0x19ead0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ead0) returned 1 [0132.003] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0132.003] AdjustWindowRectEx (in: lpRect=0x19e92c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19e92c) returned 1 [0132.003] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0132.004] AdjustWindowRectEx (in: lpRect=0x19ec6c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec6c) returned 1 [0132.004] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0132.004] AdjustWindowRectEx (in: lpRect=0x19ead0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ead0) returned 1 [0132.004] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0132.004] AdjustWindowRectEx (in: lpRect=0x19e92c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19e92c) returned 1 [0132.004] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0132.004] AdjustWindowRectEx (in: lpRect=0x19ec6c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec6c) returned 1 [0132.004] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0132.005] AdjustWindowRectEx (in: lpRect=0x19ead0, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ead0) returned 1 [0132.005] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0132.005] AdjustWindowRectEx (in: lpRect=0x19e92c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19e92c) returned 1 [0132.005] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0132.005] AdjustWindowRectEx (in: lpRect=0x19ec6c, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ec6c) returned 1 [0132.005] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c870000 [0132.005] AdjustWindowRectEx (in: lpRect=0x19ead0, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ead0) returned 1 [0132.063] EtwEventRegister (in: ProviderId=0x20f3d54, EnableCallback=0x473065e, CallbackContext=0x0, RegHandle=0x20f3d30 | out: RegHandle=0x20f3d30) returned 0x0 [0132.070] EtwEventSetInformation (RegHandle=0x5ba6c8, InformationClass=0x2c, EventInformation=0x2, InformationLength=0x20f3cc4) returned 0x0 [0132.250] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe.config", nBufferLength=0x105, lpBuffer=0x19e670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe.config", lpFilePart=0x0) returned 0x69 [0132.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eb04) returned 1 [0132.252] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe.config" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19eb80 | out: lpFileInformation=0x19eb80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0132.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eb00) returned 1 [0133.283] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11400, lpName=0x0) returned 0x2cc [0133.284] memcpy (in: _Dst=0x75b0000, _Src=0x20f65a8, _Size=0x11400 | out: _Dst=0x75b0000) returned 0x75b0000 [0133.285] CloseHandle (hObject=0x2cc) returned 1 [0182.522] GdipLoadImageFromStream (stream=0x4b0030, image=0x19e9d0) returned 0x0 [0182.901] GdipImageForceValidation (image=0x5a0f5e8) returned 0x0 [0182.926] GdipGetImageType (image=0x5a0f5e8, type=0x19e9cc) returned 0x0 [0182.926] GdipGetImageRawFormat (image=0x5a0f5e8, format=0x19e94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0182.960] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef30) returned 0x0 [0182.961] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef30) returned 0x0 [0182.978] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.978] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.978] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=0, color=0x19ef20) returned 0x0 [0182.991] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.991] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.991] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=1, color=0x19ef20) returned 0x0 [0182.991] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.991] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.991] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=2, color=0x19ef20) returned 0x0 [0182.991] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.991] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.991] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=3, color=0x19ef20) returned 0x0 [0182.991] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.991] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.992] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=4, color=0x19ef20) returned 0x0 [0182.992] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.992] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.992] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=5, color=0x19ef20) returned 0x0 [0182.992] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.992] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.992] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=6, color=0x19ef20) returned 0x0 [0182.992] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.992] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.992] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=7, color=0x19ef20) returned 0x0 [0182.992] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.992] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.992] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=8, color=0x19ef20) returned 0x0 [0182.992] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.992] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.992] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=9, color=0x19ef20) returned 0x0 [0182.992] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.992] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.992] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=10, color=0x19ef20) returned 0x0 [0182.993] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.993] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.993] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=11, color=0x19ef20) returned 0x0 [0182.993] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.993] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.993] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=12, color=0x19ef20) returned 0x0 [0182.993] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.993] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.993] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=13, color=0x19ef20) returned 0x0 [0182.993] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.993] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.993] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=14, color=0x19ef20) returned 0x0 [0182.993] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.993] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.993] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=15, color=0x19ef20) returned 0x0 [0182.993] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.993] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.993] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=16, color=0x19ef20) returned 0x0 [0182.993] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.993] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.994] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=17, color=0x19ef20) returned 0x0 [0182.994] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.994] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.994] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=18, color=0x19ef20) returned 0x0 [0182.994] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.994] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.994] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=19, color=0x19ef20) returned 0x0 [0182.994] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.994] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.994] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=20, color=0x19ef20) returned 0x0 [0182.994] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.994] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.994] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=21, color=0x19ef20) returned 0x0 [0182.994] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.994] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.994] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=22, color=0x19ef20) returned 0x0 [0182.994] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.994] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.995] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=23, color=0x19ef20) returned 0x0 [0182.995] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.995] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.995] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=24, color=0x19ef20) returned 0x0 [0182.995] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.995] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.995] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=25, color=0x19ef20) returned 0x0 [0182.995] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.995] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.995] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=26, color=0x19ef20) returned 0x0 [0182.995] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.995] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.995] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=27, color=0x19ef20) returned 0x0 [0182.995] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.995] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.995] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=28, color=0x19ef20) returned 0x0 [0182.995] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.996] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.996] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=29, color=0x19ef20) returned 0x0 [0182.996] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.996] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.996] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=30, color=0x19ef20) returned 0x0 [0182.996] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.996] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.996] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=31, color=0x19ef20) returned 0x0 [0182.996] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.996] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.996] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=32, color=0x19ef20) returned 0x0 [0182.996] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.996] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.996] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=33, color=0x19ef20) returned 0x0 [0182.997] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.997] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.997] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=34, color=0x19ef20) returned 0x0 [0182.997] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.997] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.997] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=35, color=0x19ef20) returned 0x0 [0182.997] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.997] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.997] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=36, color=0x19ef20) returned 0x0 [0182.997] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.997] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.997] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=37, color=0x19ef20) returned 0x0 [0182.997] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.997] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.997] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=38, color=0x19ef20) returned 0x0 [0182.997] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.998] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.998] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=39, color=0x19ef20) returned 0x0 [0182.998] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.998] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.998] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=40, color=0x19ef20) returned 0x0 [0182.998] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.998] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.998] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=41, color=0x19ef20) returned 0x0 [0182.998] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.998] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.998] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=42, color=0x19ef20) returned 0x0 [0182.998] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.998] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.998] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=43, color=0x19ef20) returned 0x0 [0182.998] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.998] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.998] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=44, color=0x19ef20) returned 0x0 [0182.998] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.999] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.999] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=45, color=0x19ef20) returned 0x0 [0182.999] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.999] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.999] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=46, color=0x19ef20) returned 0x0 [0182.999] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.999] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0182.999] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=47, color=0x19ef20) returned 0x0 [0182.999] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0182.999] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.000] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=48, color=0x19ef20) returned 0x0 [0183.000] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.000] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.000] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=49, color=0x19ef20) returned 0x0 [0183.000] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.000] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.000] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=50, color=0x19ef20) returned 0x0 [0183.000] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.000] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.000] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=51, color=0x19ef20) returned 0x0 [0183.000] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.000] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.000] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=52, color=0x19ef20) returned 0x0 [0183.001] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.001] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.001] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=53, color=0x19ef20) returned 0x0 [0183.001] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.001] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.001] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=54, color=0x19ef20) returned 0x0 [0183.001] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.001] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.001] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=55, color=0x19ef20) returned 0x0 [0183.001] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.001] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.001] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=56, color=0x19ef20) returned 0x0 [0183.002] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.002] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.002] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=57, color=0x19ef20) returned 0x0 [0183.002] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.002] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.002] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=58, color=0x19ef20) returned 0x0 [0183.002] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.002] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.002] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=59, color=0x19ef20) returned 0x0 [0183.002] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.002] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.002] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=60, color=0x19ef20) returned 0x0 [0183.002] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.002] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.002] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=61, color=0x19ef20) returned 0x0 [0183.002] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.002] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.002] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=62, color=0x19ef20) returned 0x0 [0183.003] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.003] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.003] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=63, color=0x19ef20) returned 0x0 [0183.003] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.003] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.003] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=64, color=0x19ef20) returned 0x0 [0183.003] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.003] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.003] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=65, color=0x19ef20) returned 0x0 [0183.003] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.003] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.003] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=66, color=0x19ef20) returned 0x0 [0183.003] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.003] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.003] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=67, color=0x19ef20) returned 0x0 [0183.003] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.003] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.003] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=68, color=0x19ef20) returned 0x0 [0183.004] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.004] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.004] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=69, color=0x19ef20) returned 0x0 [0183.004] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.004] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.004] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=70, color=0x19ef20) returned 0x0 [0183.004] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.004] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.004] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=71, color=0x19ef20) returned 0x0 [0183.004] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.004] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.004] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=72, color=0x19ef20) returned 0x0 [0183.004] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.004] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.004] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=73, color=0x19ef20) returned 0x0 [0183.004] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.004] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.004] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=74, color=0x19ef20) returned 0x0 [0183.005] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.005] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.005] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=75, color=0x19ef20) returned 0x0 [0183.005] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.005] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.005] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=76, color=0x19ef20) returned 0x0 [0183.005] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.005] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.005] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=77, color=0x19ef20) returned 0x0 [0183.005] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.005] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.005] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=78, color=0x19ef20) returned 0x0 [0183.005] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.005] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.005] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=79, color=0x19ef20) returned 0x0 [0183.005] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.005] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.005] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=80, color=0x19ef20) returned 0x0 [0183.006] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.006] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.006] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=81, color=0x19ef20) returned 0x0 [0183.006] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.006] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.006] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=82, color=0x19ef20) returned 0x0 [0183.006] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.006] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.006] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=83, color=0x19ef20) returned 0x0 [0183.006] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.006] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.006] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=84, color=0x19ef20) returned 0x0 [0183.006] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.006] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.006] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=85, color=0x19ef20) returned 0x0 [0183.006] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.006] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.006] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=86, color=0x19ef20) returned 0x0 [0183.006] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.007] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.007] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=87, color=0x19ef20) returned 0x0 [0183.007] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.007] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.007] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=88, color=0x19ef20) returned 0x0 [0183.007] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.007] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.007] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=89, color=0x19ef20) returned 0x0 [0183.007] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.007] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.007] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=90, color=0x19ef20) returned 0x0 [0183.007] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.007] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.007] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=91, color=0x19ef20) returned 0x0 [0183.007] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.007] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.007] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=92, color=0x19ef20) returned 0x0 [0183.007] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.007] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.007] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=93, color=0x19ef20) returned 0x0 [0183.008] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.008] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.008] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=94, color=0x19ef20) returned 0x0 [0183.008] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.008] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.008] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=95, color=0x19ef20) returned 0x0 [0183.008] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.008] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.008] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=96, color=0x19ef20) returned 0x0 [0183.008] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.008] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.008] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=97, color=0x19ef20) returned 0x0 [0183.008] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.008] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.008] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=98, color=0x19ef20) returned 0x0 [0183.008] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.008] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.008] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=99, color=0x19ef20) returned 0x0 [0183.008] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.008] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.008] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=100, color=0x19ef20) returned 0x0 [0183.008] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.008] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.009] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=101, color=0x19ef20) returned 0x0 [0183.009] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.009] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.009] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=102, color=0x19ef20) returned 0x0 [0183.009] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.009] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.009] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=103, color=0x19ef20) returned 0x0 [0183.009] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.009] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.009] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=104, color=0x19ef20) returned 0x0 [0183.009] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.010] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.010] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=105, color=0x19ef20) returned 0x0 [0183.010] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.010] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.010] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=106, color=0x19ef20) returned 0x0 [0183.010] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.010] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.010] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=107, color=0x19ef20) returned 0x0 [0183.010] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.010] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.010] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=108, color=0x19ef20) returned 0x0 [0183.010] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.010] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.010] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=109, color=0x19ef20) returned 0x0 [0183.010] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.010] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.011] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=110, color=0x19ef20) returned 0x0 [0183.011] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.011] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.011] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=111, color=0x19ef20) returned 0x0 [0183.011] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.011] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.011] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=112, color=0x19ef20) returned 0x0 [0183.011] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.011] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.011] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=113, color=0x19ef20) returned 0x0 [0183.011] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.011] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.011] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=114, color=0x19ef20) returned 0x0 [0183.012] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.012] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.012] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=115, color=0x19ef20) returned 0x0 [0183.012] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.012] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.012] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=116, color=0x19ef20) returned 0x0 [0183.012] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.012] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.012] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=117, color=0x19ef20) returned 0x0 [0183.012] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.012] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.012] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=118, color=0x19ef20) returned 0x0 [0183.012] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.012] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.012] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=119, color=0x19ef20) returned 0x0 [0183.012] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.012] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.013] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=120, color=0x19ef20) returned 0x0 [0183.013] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.013] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.013] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=121, color=0x19ef20) returned 0x0 [0183.013] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.013] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.013] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=122, color=0x19ef20) returned 0x0 [0183.013] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.013] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.013] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=123, color=0x19ef20) returned 0x0 [0183.013] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.013] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.013] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=124, color=0x19ef20) returned 0x0 [0183.013] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.014] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.014] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=125, color=0x19ef20) returned 0x0 [0183.014] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.014] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.014] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=126, color=0x19ef20) returned 0x0 [0183.014] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.014] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.014] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=127, color=0x19ef20) returned 0x0 [0183.014] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.014] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.014] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=128, color=0x19ef20) returned 0x0 [0183.014] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.014] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.014] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=129, color=0x19ef20) returned 0x0 [0183.014] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.014] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.014] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=130, color=0x19ef20) returned 0x0 [0183.014] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.014] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.014] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=131, color=0x19ef20) returned 0x0 [0183.015] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.015] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.015] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=132, color=0x19ef20) returned 0x0 [0183.015] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.015] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.015] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=133, color=0x19ef20) returned 0x0 [0183.015] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.015] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.015] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=134, color=0x19ef20) returned 0x0 [0183.015] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.015] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.015] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=135, color=0x19ef20) returned 0x0 [0183.015] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.015] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.015] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=136, color=0x19ef20) returned 0x0 [0183.015] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.016] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.016] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=137, color=0x19ef20) returned 0x0 [0183.016] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.016] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.016] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=138, color=0x19ef20) returned 0x0 [0183.016] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.016] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.016] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=139, color=0x19ef20) returned 0x0 [0183.016] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.016] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.016] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=140, color=0x19ef20) returned 0x0 [0183.016] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.016] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.016] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=141, color=0x19ef20) returned 0x0 [0183.016] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.016] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.017] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=142, color=0x19ef20) returned 0x0 [0183.017] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.017] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.017] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=143, color=0x19ef20) returned 0x0 [0183.017] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.017] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.017] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=144, color=0x19ef20) returned 0x0 [0183.017] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.017] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.017] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=145, color=0x19ef20) returned 0x0 [0183.017] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.017] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.017] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=146, color=0x19ef20) returned 0x0 [0183.017] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.017] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.017] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=147, color=0x19ef20) returned 0x0 [0183.017] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.017] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.018] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=148, color=0x19ef20) returned 0x0 [0183.018] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.018] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.018] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=149, color=0x19ef20) returned 0x0 [0183.018] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.018] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.018] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=150, color=0x19ef20) returned 0x0 [0183.018] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.018] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.018] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=151, color=0x19ef20) returned 0x0 [0183.018] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.018] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.018] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=152, color=0x19ef20) returned 0x0 [0183.018] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.018] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.018] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=153, color=0x19ef20) returned 0x0 [0183.018] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.018] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.018] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=154, color=0x19ef20) returned 0x0 [0183.019] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.019] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.019] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=155, color=0x19ef20) returned 0x0 [0183.019] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.019] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.019] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=156, color=0x19ef20) returned 0x0 [0183.019] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.019] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.019] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=157, color=0x19ef20) returned 0x0 [0183.019] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.019] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.019] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=158, color=0x19ef20) returned 0x0 [0183.019] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.020] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.020] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=159, color=0x19ef20) returned 0x0 [0183.020] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.020] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.020] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=160, color=0x19ef20) returned 0x0 [0183.020] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.020] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.020] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=161, color=0x19ef20) returned 0x0 [0183.020] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.020] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.020] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=162, color=0x19ef20) returned 0x0 [0183.020] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.020] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.020] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=163, color=0x19ef20) returned 0x0 [0183.020] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.020] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.020] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=164, color=0x19ef20) returned 0x0 [0183.020] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.020] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.020] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=165, color=0x19ef20) returned 0x0 [0183.021] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.021] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.021] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=166, color=0x19ef20) returned 0x0 [0183.021] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.021] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.021] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=167, color=0x19ef20) returned 0x0 [0183.021] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.021] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.021] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=168, color=0x19ef20) returned 0x0 [0183.021] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.021] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.021] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=169, color=0x19ef20) returned 0x0 [0183.021] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.021] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.021] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=170, color=0x19ef20) returned 0x0 [0183.022] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.022] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.022] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=171, color=0x19ef20) returned 0x0 [0183.022] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.022] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.022] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=172, color=0x19ef20) returned 0x0 [0183.022] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.022] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.022] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=173, color=0x19ef20) returned 0x0 [0183.022] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.022] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.022] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=174, color=0x19ef20) returned 0x0 [0183.022] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.022] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.022] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=175, color=0x19ef20) returned 0x0 [0183.022] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.022] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.022] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=176, color=0x19ef20) returned 0x0 [0183.022] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.022] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.023] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=177, color=0x19ef20) returned 0x0 [0183.023] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.023] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.023] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=178, color=0x19ef20) returned 0x0 [0183.023] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.023] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.023] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=179, color=0x19ef20) returned 0x0 [0183.023] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.023] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.023] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=180, color=0x19ef20) returned 0x0 [0183.023] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.023] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.023] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=181, color=0x19ef20) returned 0x0 [0183.023] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.023] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.023] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=182, color=0x19ef20) returned 0x0 [0183.023] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.023] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.023] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=183, color=0x19ef20) returned 0x0 [0183.024] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.024] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.024] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=184, color=0x19ef20) returned 0x0 [0183.024] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.024] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.024] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=185, color=0x19ef20) returned 0x0 [0183.024] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.024] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.024] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=186, color=0x19ef20) returned 0x0 [0183.024] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.024] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.024] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=187, color=0x19ef20) returned 0x0 [0183.024] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.024] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.024] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=188, color=0x19ef20) returned 0x0 [0183.024] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.024] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.024] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=189, color=0x19ef20) returned 0x0 [0183.024] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.025] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.025] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=190, color=0x19ef20) returned 0x0 [0183.025] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.025] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.025] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=191, color=0x19ef20) returned 0x0 [0183.025] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.025] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.025] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=192, color=0x19ef20) returned 0x0 [0183.025] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.025] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.025] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=193, color=0x19ef20) returned 0x0 [0183.025] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.025] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.025] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=194, color=0x19ef20) returned 0x0 [0183.025] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.025] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.025] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=195, color=0x19ef20) returned 0x0 [0183.025] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.025] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.026] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=196, color=0x19ef20) returned 0x0 [0183.026] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.026] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.026] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=197, color=0x19ef20) returned 0x0 [0183.026] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.026] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.026] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=198, color=0x19ef20) returned 0x0 [0183.026] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.026] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.026] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=199, color=0x19ef20) returned 0x0 [0183.026] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.026] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.026] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=200, color=0x19ef20) returned 0x0 [0183.026] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.026] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.026] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=201, color=0x19ef20) returned 0x0 [0183.026] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.026] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.026] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=202, color=0x19ef20) returned 0x0 [0183.027] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.027] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.027] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=203, color=0x19ef20) returned 0x0 [0183.027] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.027] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.027] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=204, color=0x19ef20) returned 0x0 [0183.027] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.027] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.027] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=205, color=0x19ef20) returned 0x0 [0183.027] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.027] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.027] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=206, color=0x19ef20) returned 0x0 [0183.027] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.027] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.027] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=207, color=0x19ef20) returned 0x0 [0183.027] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.027] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.027] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=208, color=0x19ef20) returned 0x0 [0183.027] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.027] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.027] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=209, color=0x19ef20) returned 0x0 [0183.028] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.028] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.028] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=210, color=0x19ef20) returned 0x0 [0183.028] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.028] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.028] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=211, color=0x19ef20) returned 0x0 [0183.028] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.028] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.028] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=212, color=0x19ef20) returned 0x0 [0183.028] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.028] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.028] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=213, color=0x19ef20) returned 0x0 [0183.028] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.028] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.028] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=214, color=0x19ef20) returned 0x0 [0183.028] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.028] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.028] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=215, color=0x19ef20) returned 0x0 [0183.028] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.028] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.029] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=216, color=0x19ef20) returned 0x0 [0183.029] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.029] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.029] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=217, color=0x19ef20) returned 0x0 [0183.029] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.029] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.030] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=218, color=0x19ef20) returned 0x0 [0183.030] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.030] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.030] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=219, color=0x19ef20) returned 0x0 [0183.030] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.031] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.031] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=220, color=0x19ef20) returned 0x0 [0183.031] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.031] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.031] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=221, color=0x19ef20) returned 0x0 [0183.031] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.031] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.031] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=222, color=0x19ef20) returned 0x0 [0183.031] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.031] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.031] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=223, color=0x19ef20) returned 0x0 [0183.034] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.034] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.034] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=224, color=0x19ef20) returned 0x0 [0183.034] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.034] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.034] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=225, color=0x19ef20) returned 0x0 [0183.034] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.034] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.034] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=226, color=0x19ef20) returned 0x0 [0183.035] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.035] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.035] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=227, color=0x19ef20) returned 0x0 [0183.035] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.035] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.035] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=228, color=0x19ef20) returned 0x0 [0183.035] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.035] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.035] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=229, color=0x19ef20) returned 0x0 [0183.035] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.035] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.035] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=230, color=0x19ef20) returned 0x0 [0183.035] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.036] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.036] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=231, color=0x19ef20) returned 0x0 [0183.036] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.036] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.036] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=232, color=0x19ef20) returned 0x0 [0183.036] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.036] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.036] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=233, color=0x19ef20) returned 0x0 [0183.036] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.036] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.036] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=234, color=0x19ef20) returned 0x0 [0183.036] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.036] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.036] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=235, color=0x19ef20) returned 0x0 [0183.037] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.037] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.037] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=236, color=0x19ef20) returned 0x0 [0183.037] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.037] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.037] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=237, color=0x19ef20) returned 0x0 [0183.037] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.037] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.037] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=238, color=0x19ef20) returned 0x0 [0183.037] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.037] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.037] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=239, color=0x19ef20) returned 0x0 [0183.037] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.037] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.037] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=240, color=0x19ef20) returned 0x0 [0183.038] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.038] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.038] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=241, color=0x19ef20) returned 0x0 [0183.038] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.038] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.038] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=242, color=0x19ef20) returned 0x0 [0183.038] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.038] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.038] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=243, color=0x19ef20) returned 0x0 [0183.038] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.038] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.038] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=244, color=0x19ef20) returned 0x0 [0183.038] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.038] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.038] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=245, color=0x19ef20) returned 0x0 [0183.038] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.039] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.039] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=246, color=0x19ef20) returned 0x0 [0183.039] GdipGetImageWidth (image=0x5a0f5e8, width=0x19ef10) returned 0x0 [0183.039] GdipGetImageHeight (image=0x5a0f5e8, height=0x19ef10) returned 0x0 [0183.039] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=247, color=0x19ef20) returned 0x0 [0183.039] GdipBitmapGetPixel (bitmap=0x5a0f5e8, x=0, y=248, color=0x19ef20) returned 0x0 [0183.326] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x77800, lpName=0x0) returned 0x304 [0183.326] memcpy (in: _Dst=0x7b90000, _Src=0x3326380, _Size=0x77800 | out: _Dst=0x7b90000) returned 0x7b90000 [0183.333] CloseHandle (hObject=0x304) returned 1 [0184.064] CoTaskMemAlloc (cb=0xd) returned 0x5ef800 [0184.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x214352c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0184.065] LoadLibraryA (lpLibFileName="kernel32") returned 0x74580000 [0184.066] CoTaskMemFree (pv=0x5ef800) [0184.079] CoTaskMemAlloc (cb=0x11) returned 0x5b3e68 [0184.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResumeThread", cchWideChar=12, lpMultiByteStr=0x2143868, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResumeThread", lpUsedDefaultChar=0x0) returned 12 [0184.079] GetProcAddress (hModule=0x74580000, lpProcName="ResumeThread") returned 0x7459a800 [0184.079] CoTaskMemFree (pv=0x5b3e68) [0184.104] CoTaskMemAlloc (cb=0xd) returned 0x5ef6b0 [0184.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2143fec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0184.104] LoadLibraryA (lpLibFileName="kernel32") returned 0x74580000 [0184.105] CoTaskMemFree (pv=0x5ef6b0) [0184.105] CoTaskMemAlloc (cb=0x1a) returned 0x5f91f0 [0184.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Wow64SetThreadContext", cchWideChar=21, lpMultiByteStr=0x2144024, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wow64SetThreadContext", lpUsedDefaultChar=0x0) returned 21 [0184.105] GetProcAddress (hModule=0x74580000, lpProcName="Wow64SetThreadContext") returned 0x745c3e60 [0184.105] CoTaskMemFree (pv=0x5f91f0) [0184.115] CoTaskMemAlloc (cb=0xd) returned 0x5ef548 [0184.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x21440f0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0184.115] LoadLibraryA (lpLibFileName="kernel32") returned 0x74580000 [0184.116] CoTaskMemFree (pv=0x5ef548) [0184.116] CoTaskMemAlloc (cb=0x15) returned 0x5b3e68 [0184.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetThreadContext", cchWideChar=16, lpMultiByteStr=0x2144128, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetThreadContext", lpUsedDefaultChar=0x0) returned 16 [0184.116] GetProcAddress (hModule=0x74580000, lpProcName="SetThreadContext") returned 0x745c2490 [0184.116] CoTaskMemFree (pv=0x5b3e68) [0184.119] CoTaskMemAlloc (cb=0xd) returned 0x5ef668 [0184.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x21441f0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0184.119] LoadLibraryA (lpLibFileName="kernel32") returned 0x74580000 [0184.119] CoTaskMemFree (pv=0x5ef668) [0184.119] CoTaskMemAlloc (cb=0x1a) returned 0x5f91f0 [0184.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Wow64GetThreadContext", cchWideChar=21, lpMultiByteStr=0x2144228, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wow64GetThreadContext", lpUsedDefaultChar=0x0) returned 21 [0184.119] GetProcAddress (hModule=0x74580000, lpProcName="Wow64GetThreadContext") returned 0x745c3e30 [0184.119] CoTaskMemFree (pv=0x5f91f0) [0184.122] CoTaskMemAlloc (cb=0xd) returned 0x5ef608 [0184.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x21442f4, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0184.122] LoadLibraryA (lpLibFileName="kernel32") returned 0x74580000 [0184.122] CoTaskMemFree (pv=0x5ef608) [0184.122] CoTaskMemAlloc (cb=0x15) returned 0x5b3e68 [0184.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetThreadContext", cchWideChar=16, lpMultiByteStr=0x214432c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThreadContext", lpUsedDefaultChar=0x0) returned 16 [0184.123] GetProcAddress (hModule=0x74580000, lpProcName="GetThreadContext") returned 0x7459ec60 [0184.123] CoTaskMemFree (pv=0x5b3e68) [0184.126] CoTaskMemAlloc (cb=0xd) returned 0x5ef5f0 [0184.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x21443e8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0184.126] LoadLibraryA (lpLibFileName="kernel32") returned 0x74580000 [0184.126] CoTaskMemFree (pv=0x5ef5f0) [0184.126] CoTaskMemAlloc (cb=0x13) returned 0x5b3e68 [0184.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualAllocEx", cchWideChar=14, lpMultiByteStr=0x2144420, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VirtualAllocEx", lpUsedDefaultChar=0x0) returned 14 [0184.127] GetProcAddress (hModule=0x74580000, lpProcName="VirtualAllocEx") returned 0x745c2730 [0184.127] CoTaskMemFree (pv=0x5b3e68) [0184.134] CoTaskMemAlloc (cb=0xd) returned 0x5ef788 [0184.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x21444dc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0184.134] LoadLibraryA (lpLibFileName="kernel32") returned 0x74580000 [0184.134] CoTaskMemFree (pv=0x5ef788) [0184.135] CoTaskMemAlloc (cb=0x17) returned 0x5b3e68 [0184.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WriteProcessMemory", cchWideChar=18, lpMultiByteStr=0x2144514, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WriteProcessMemory", lpUsedDefaultChar=0x0) returned 18 [0184.135] GetProcAddress (hModule=0x74580000, lpProcName="WriteProcessMemory") returned 0x745c2850 [0184.135] CoTaskMemFree (pv=0x5b3e68) [0184.140] CoTaskMemAlloc (cb=0xd) returned 0x5ef728 [0184.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x21445d8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0184.141] LoadLibraryA (lpLibFileName="kernel32") returned 0x74580000 [0184.141] CoTaskMemFree (pv=0x5ef728) [0184.141] CoTaskMemAlloc (cb=0x16) returned 0x5b3e68 [0184.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ReadProcessMemory", cchWideChar=17, lpMultiByteStr=0x2144610, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadProcessMemory", lpUsedDefaultChar=0x0) returned 17 [0184.141] GetProcAddress (hModule=0x74580000, lpProcName="ReadProcessMemory") returned 0x745c1c80 [0184.141] CoTaskMemFree (pv=0x5b3e68) [0184.147] CoTaskMemAlloc (cb=0xa) returned 0x5ef680 [0184.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntdll", cchWideChar=5, lpMultiByteStr=0x21446d0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ntdll", lpUsedDefaultChar=0x0) returned 5 [0184.147] LoadLibraryA (lpLibFileName="ntdll") returned 0x77830000 [0184.148] CoTaskMemFree (pv=0x5ef680) [0184.148] CoTaskMemAlloc (cb=0x19) returned 0x5f91f0 [0184.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ZwUnmapViewOfSection", cchWideChar=20, lpMultiByteStr=0x21446fc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ZwUnmapViewOfSection", lpUsedDefaultChar=0x0) returned 20 [0184.148] GetProcAddress (hModule=0x77830000, lpProcName="ZwUnmapViewOfSection") returned 0x778a6f40 [0184.148] CoTaskMemFree (pv=0x5f91f0) [0184.152] CoTaskMemAlloc (cb=0xd) returned 0x5ef6e0 [0184.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x21447c4, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0184.152] LoadLibraryA (lpLibFileName="kernel32") returned 0x74580000 [0184.152] CoTaskMemFree (pv=0x5ef6e0) [0184.152] CoTaskMemAlloc (cb=0x13) returned 0x5b3e68 [0184.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateProcessA", cchWideChar=14, lpMultiByteStr=0x21447fc, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateProcessA", lpUsedDefaultChar=0x0) returned 14 [0184.153] GetProcAddress (hModule=0x74580000, lpProcName="CreateProcessA") returned 0x745c0750 [0184.153] CoTaskMemFree (pv=0x5b3e68) [0184.189] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe", nBufferLength=0x105, lpBuffer=0x19e580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe", lpFilePart=0x0) returned 0x62 [0184.704] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x36400, lpName=0x0) returned 0x304 [0184.704] memcpy (in: _Dst=0x7c20000, _Src=0x31cc1a8, _Size=0x36400 | out: _Dst=0x7c20000) returned 0x7c20000 [0184.707] CloseHandle (hObject=0x304) returned 1 [0184.873] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe", nBufferLength=0x105, lpBuffer=0x19e4cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe", lpFilePart=0x0) returned 0x62 [0184.895] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x19df60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0184.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe", cchWideChar=98, lpMultiByteStr=0x19e758, cbMultiByte=100, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exeÔ\x07´v(\x7f «\x15l\x1cï\x19", lpUsedDefaultChar=0x0) returned 98 [0184.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=0, lpMultiByteStr=0x19e754, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="´…Ô\x07C:\\Users\\RDhJ0CNFevzX\\Desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe", lpUsedDefaultChar=0x0) returned 0 [0184.969] CreateProcessA (in: lpApplicationName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe", lpCommandLine="", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000004, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19e818*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19eaa8 | out: lpCommandLine="", lpProcessInformation=0x19eaa8*(hProcess=0x308, hThread=0x304, dwProcessId=0xe94, dwThreadId=0x46c)) returned 1 [0185.017] CoTaskMemFree (pv=0x0) [0185.040] GetThreadContext (in: hThread=0x304, lpContext=0x21455e8 | out: lpContext=0x21455e8*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x3fe000, Edx=0x0, Ecx=0x0, Eax=0x496fa2, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0185.041] ReadProcessMemory (in: hProcess=0x308, lpBaseAddress=0x3fe008, lpBuffer=0x19ea98, nSize=0x4, lpNumberOfBytesRead=0x19eadc | out: lpBuffer=0x19ea98*, lpNumberOfBytesRead=0x19eadc*=0x4) returned 1 [0185.041] NtUnmapViewOfSection (ProcessHandle=0x308, BaseAddress=0x400000) returned 0x0 [0185.046] VirtualAllocEx (hProcess=0x308, lpAddress=0x400000, dwSize=0x3a000, flAllocationType=0x3000, flProtect=0x40) returned 0x400000 [0185.049] WriteProcessMemory (in: hProcess=0x308, lpBaseAddress=0x400000, lpBuffer=0x3236be8*, nSize=0x200, lpNumberOfBytesWritten=0x19eadc | out: lpBuffer=0x3236be8*, lpNumberOfBytesWritten=0x19eadc*=0x200) returned 1 [0185.065] WriteProcessMemory (in: hProcess=0x308, lpBaseAddress=0x402000, lpBuffer=0x326b208*, nSize=0x33c00, lpNumberOfBytesWritten=0x19eadc | out: lpBuffer=0x326b208*, lpNumberOfBytesWritten=0x19eadc*=0x33c00) returned 1 [0185.078] WriteProcessMemory (in: hProcess=0x308, lpBaseAddress=0x436000, lpBuffer=0x21466b8*, nSize=0x600, lpNumberOfBytesWritten=0x19eadc | out: lpBuffer=0x21466b8*, lpNumberOfBytesWritten=0x19eadc*=0x600) returned 1 [0185.084] WriteProcessMemory (in: hProcess=0x308, lpBaseAddress=0x438000, lpBuffer=0x2146cc4*, nSize=0x200, lpNumberOfBytesWritten=0x19eadc | out: lpBuffer=0x2146cc4*, lpNumberOfBytesWritten=0x19eadc*=0x200) returned 1 [0185.094] WriteProcessMemory (in: hProcess=0x308, lpBaseAddress=0x3fe008, lpBuffer=0x21471d0*, nSize=0x4, lpNumberOfBytesWritten=0x19eadc | out: lpBuffer=0x21471d0*, lpNumberOfBytesWritten=0x19eadc*=0x4) returned 1 [0185.099] SetThreadContext (hThread=0x304, lpContext=0x21455e8*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x3fe000, Edx=0x0, Ecx=0x0, Eax=0x435bce, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0185.100] ResumeThread (hThread=0x304) returned 0x1 [0185.168] CoGetContextToken (in: pToken=0x19ee88 | out: pToken=0x19ee88) returned 0x0 [0185.168] CObjectContext::QueryInterface () returned 0x0 [0185.169] CObjectContext::GetCurrentThreadType () returned 0x0 [0185.169] Release () returned 0x0 [0185.171] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x13880, cHandles=0x1, pHandles=0x5883b8*=0x14c, lpdwindex=0x19ed2c | out: lpdwindex=0x19ed2c) returned 0x0 Thread: id = 2 os_tid = 0x238 Thread: id = 3 os_tid = 0x290 Thread: id = 4 os_tid = 0x508 [0121.563] CoGetContextToken (in: pToken=0x42bfc3c | out: pToken=0x42bfc3c) returned 0x800401f0 [0121.563] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0121.563] RoInitialize () returned 0x1 [0121.563] RoUninitialize () returned 0x0 [0185.193] SetWindowLongW (hWnd=0x70364, nIndex=-4, dwNewLong=1951270880) returned 74647014 [0185.196] SetClassLongW (hWnd=0x70364, nIndex=-24, dwNewLong=1951270880) returned 0x47305be [0185.196] PostMessageW (hWnd=0x70364, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0185.197] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0185.198] UnregisterClassW (lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", hInstance=0x400000) returned 0 [0185.207] IsWindow (hWnd=0x80274) returned 1 [0185.210] GetModuleHandleW (lpModuleName="user32.dll") returned 0x75640000 [0185.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x42bf9dc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcWwj´v(\x7f «\x15lXü+\x048yZ", lpUsedDefaultChar=0x0) returned 14 [0185.211] GetProcAddress (hModule=0x75640000, lpProcName="DefWindowProcW") returned 0x744e07e0 [0185.211] SetWindowLongW (hWnd=0x80274, nIndex=-4, dwNewLong=1951270880) returned 74647094 [0185.212] SetClassLongW (hWnd=0x80274, nIndex=-24, dwNewLong=1951270880) returned 0x4730636 [0185.212] IsWindow (hWnd=0x80274) returned 1 [0185.212] DestroyWindow (hWnd=0x80274) returned 0 [0185.212] PostMessageW (hWnd=0x80274, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0185.212] SetConsoleCtrlHandler (HandlerRoutine=0x473060e, Add=0) returned 1 [0185.213] EtwEventUnregister (RegHandle=0x5ba6c8) returned 0x0 [0185.242] CloseHandle (hObject=0x264) returned 1 [0185.245] GdipDeleteFont (font=0x5a0b1b8) returned 0x0 [0185.246] GdipDeleteFont (font=0x5a0b190) returned 0x0 [0185.246] GdipDeleteFont (font=0x5a0b168) returned 0x0 [0185.246] GdipDeleteFont (font=0x5a0b140) returned 0x0 [0185.246] GdipDeleteFont (font=0x5a0b118) returned 0x0 [0185.247] GdipDeleteFont (font=0x5a0b0f0) returned 0x0 [0185.249] GdipDisposeImage (image=0x5a0f5e8) returned 0x0 [0185.255] GdipDeleteFont (font=0x5a0b0c8) returned 0x0 [0185.256] GdipDeleteFont (font=0x5a0b0a0) returned 0x0 [0185.256] DeleteObject (ho=0xa0a09ec) returned 1 [0185.258] DeleteObject (ho=0xb40a0a31) returned 1 [0185.258] GdipDeleteFont (font=0x5a0b078) returned 0x0 [0185.258] DeleteObject (ho=0x170a06db) returned 1 [0185.259] DeleteObject (ho=0x300a0551) returned 1 [0185.260] DeleteObject (ho=0x450a067b) returned 1 [0185.261] DeleteDC (hdc=0x2c010a0f) returned 1 [0185.264] RestoreDC (hdc=0x0, nSavedDC=-1) returned 0 [0185.264] DeleteObject (ho=0x150a09f1) returned 1 [0185.265] GdipDeleteFont (font=0x5a0b050) returned 0x0 [0185.265] GdipDeleteFont (font=0x5a0b028) returned 0x0 [0185.265] GdipDeleteFont (font=0x5a0b000) returned 0x0 [0185.265] GdipDeleteFont (font=0x5a0a920) returned 0x0 [0185.266] DeleteObject (ho=0x4a0a0687) returned 1 [0185.266] GdipDeleteFont (font=0x5a0ab38) returned 0x0 [0185.266] GdipDeleteFont (font=0x5a0b1e0) returned 0x0 [0185.266] GdipDeleteFont (font=0x48f04c0) returned 0x0 [0185.274] RegCloseKey (hKey=0x80000004) returned 0x0 Thread: id = 5 os_tid = 0x690 Thread: id = 6 os_tid = 0x2f8 Thread: id = 7 os_tid = 0x134c Thread: id = 8 os_tid = 0xc84 Thread: id = 10 os_tid = 0xaf8 Thread: id = 12 os_tid = 0x528 Process: id = "2" image_name = "b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe" filename = "c:\\users\\rdhj0cnfevzx\\desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe" page_root = "0x2c8ed000" os_pid = "0xe94" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xc4c" cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe\"" cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fe14" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 622 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 623 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 624 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 625 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 626 start_va = 0xa0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 627 start_va = 0x1a0000 end_va = 0x1a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 628 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 629 start_va = 0x1c0000 end_va = 0x1c1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 630 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 631 start_va = 0x400000 end_va = 0x49bfff monitored = 1 entry_point = 0x496fa2 region_type = mapped_file name = "b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe") Region: id = 632 start_va = 0x77830000 end_va = 0x779aafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 633 start_va = 0x7ffb0000 end_va = 0x7ffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 634 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 635 start_va = 0x7fff0000 end_va = 0x7ffdab58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 636 start_va = 0x7ffdab590000 end_va = 0x7ffdab750fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 637 start_va = 0x7ffdab751000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffdab751000" filename = "" Region: id = 638 start_va = 0x400000 end_va = 0x439fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 639 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 640 start_va = 0x639e0000 end_va = 0x63a2ffff monitored = 0 entry_point = 0x639f8180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 641 start_va = 0x63a40000 end_va = 0x63ab9fff monitored = 0 entry_point = 0x63a53290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 642 start_va = 0x74580000 end_va = 0x7465ffff monitored = 0 entry_point = 0x74593980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 643 start_va = 0x63a30000 end_va = 0x63a37fff monitored = 0 entry_point = 0x63a317c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 644 start_va = 0x440000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 645 start_va = 0x6cb50000 end_va = 0x6cba8fff monitored = 1 entry_point = 0x6cb60780 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 646 start_va = 0x74580000 end_va = 0x7465ffff monitored = 0 entry_point = 0x74593980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 647 start_va = 0x77420000 end_va = 0x7759dfff monitored = 0 entry_point = 0x774d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 650 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 651 start_va = 0x7feb0000 end_va = 0x7ffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 652 start_va = 0x5a0000 end_va = 0x65dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 653 start_va = 0x660000 end_va = 0x77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 654 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 655 start_va = 0x74810000 end_va = 0x7488afff monitored = 0 entry_point = 0x7482e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 656 start_va = 0x74db0000 end_va = 0x74e6dfff monitored = 0 entry_point = 0x74de5630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 657 start_va = 0x440000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 658 start_va = 0x480000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 659 start_va = 0x660000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 660 start_va = 0x770000 end_va = 0x77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 661 start_va = 0x757e0000 end_va = 0x75823fff monitored = 0 entry_point = 0x757f9d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 662 start_va = 0x759b0000 end_va = 0x75a5cfff monitored = 0 entry_point = 0x759c4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 663 start_va = 0x74560000 end_va = 0x7457dfff monitored = 0 entry_point = 0x7456b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 664 start_va = 0x74550000 end_va = 0x74559fff monitored = 0 entry_point = 0x74552a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 665 start_va = 0x777d0000 end_va = 0x77827fff monitored = 0 entry_point = 0x778125c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 666 start_va = 0x780000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 667 start_va = 0x6cac0000 end_va = 0x6cb38fff monitored = 1 entry_point = 0x6cacf82a region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 668 start_va = 0x77680000 end_va = 0x776c4fff monitored = 0 entry_point = 0x7769de90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 669 start_va = 0x75bf0000 end_va = 0x75dacfff monitored = 0 entry_point = 0x75cd2a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 670 start_va = 0x771b0000 end_va = 0x772fefff monitored = 0 entry_point = 0x77266820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 671 start_va = 0x75640000 end_va = 0x75786fff monitored = 0 entry_point = 0x75651cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 672 start_va = 0x1d0000 end_va = 0x1f9fff monitored = 0 entry_point = 0x1d5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 673 start_va = 0x7c0000 end_va = 0x947fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007c0000" filename = "" Region: id = 674 start_va = 0x77740000 end_va = 0x7776afff monitored = 0 entry_point = 0x77745680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 675 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 676 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 677 start_va = 0x950000 end_va = 0xad0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 678 start_va = 0xae0000 end_va = 0x1edffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ae0000" filename = "" Region: id = 679 start_va = 0x1ee0000 end_va = 0x1f76fff monitored = 1 entry_point = 0x1f76fa2 region_type = mapped_file name = "b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe") Region: id = 680 start_va = 0x77730000 end_va = 0x7773bfff monitored = 0 entry_point = 0x77733930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 681 start_va = 0x6cb40000 end_va = 0x6cb47fff monitored = 0 entry_point = 0x6cb417b0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 682 start_va = 0x6c150000 end_va = 0x6c800fff monitored = 1 entry_point = 0x6c165d20 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 683 start_va = 0x6c9c0000 end_va = 0x6cab4fff monitored = 0 entry_point = 0x6ca14160 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll") Region: id = 686 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 687 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 688 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 689 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 690 start_va = 0x780000 end_va = 0x78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 691 start_va = 0x7b0000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 692 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 693 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 694 start_va = 0x1ee0000 end_va = 0x1ee0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ee0000" filename = "" Region: id = 695 start_va = 0x1ef0000 end_va = 0x1ef0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ef0000" filename = "" Region: id = 696 start_va = 0x1f00000 end_va = 0x205ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f00000" filename = "" Region: id = 697 start_va = 0x1f00000 end_va = 0x1f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f00000" filename = "" Region: id = 698 start_va = 0x2050000 end_va = 0x205ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002050000" filename = "" Region: id = 699 start_va = 0x1f00000 end_va = 0x1f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f00000" filename = "" Region: id = 700 start_va = 0x1f70000 end_va = 0x1f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 701 start_va = 0x2060000 end_va = 0x215ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002060000" filename = "" Region: id = 702 start_va = 0x1f40000 end_va = 0x1f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f40000" filename = "" Region: id = 703 start_va = 0x2160000 end_va = 0x415ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002160000" filename = "" Region: id = 704 start_va = 0x1f80000 end_va = 0x201ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f80000" filename = "" Region: id = 705 start_va = 0x4160000 end_va = 0x419ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004160000" filename = "" Region: id = 706 start_va = 0x41a0000 end_va = 0x429ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000041a0000" filename = "" Region: id = 707 start_va = 0x42a0000 end_va = 0x45d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 708 start_va = 0x6af20000 end_va = 0x6c147fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\8062d427acd64e37f4fded7b00f4a869\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\8062d427acd64e37f4fded7b00f4a869\\mscorlib.ni.dll") Region: id = 709 start_va = 0x753d0000 end_va = 0x754bafff monitored = 0 entry_point = 0x7540d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 710 start_va = 0x45e0000 end_va = 0x4670fff monitored = 0 entry_point = 0x4618cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 711 start_va = 0x70610000 end_va = 0x70684fff monitored = 0 entry_point = 0x70649a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 712 start_va = 0x45e0000 end_va = 0x464ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000045e0000" filename = "" Region: id = 713 start_va = 0x1f40000 end_va = 0x1f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f40000" filename = "" Region: id = 714 start_va = 0x1f50000 end_va = 0x1f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f50000" filename = "" Region: id = 715 start_va = 0x6c940000 end_va = 0x6c9bdfff monitored = 1 entry_point = 0x6c941140 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 716 start_va = 0x74660000 end_va = 0x746f1fff monitored = 0 entry_point = 0x74698cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 717 start_va = 0x1f60000 end_va = 0x1f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f60000" filename = "" Region: id = 718 start_va = 0x6a570000 end_va = 0x6af1bfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\cc4e5d110dd318e8b7d61a9ed184ab74\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\cc4e5d110dd318e8b7d61a9ed184ab74\\system.ni.dll") Region: id = 719 start_va = 0x6a3e0000 end_va = 0x6a56cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\9b645a48c9bcfc95aaadf6a069bb4ebe\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\9b645a48c9bcfc95aaadf6a069bb4ebe\\system.drawing.ni.dll") Region: id = 720 start_va = 0x69780000 end_va = 0x6a3d8fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\8cd2187094ba6cade0ca0fab4f932654\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\8cd2187094ba6cade0ca0fab4f932654\\system.windows.forms.ni.dll") Region: id = 721 start_va = 0x69060000 end_va = 0x69771fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\abad45b9cc652ba7e38c4c837234c0ab\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\abad45b9cc652ba7e38c4c837234c0ab\\system.core.ni.dll") Region: id = 722 start_va = 0x6c850000 end_va = 0x6c93efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\1b51e779650e38bb712f3e535efcf132\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\1b51e779650e38bb712f3e535efcf132\\system.configuration.ni.dll") Region: id = 723 start_va = 0x68940000 end_va = 0x69055fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\1f87b5140145c221b5201351fffc52d8\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\1f87b5140145c221b5201351fffc52d8\\system.xml.ni.dll") Region: id = 724 start_va = 0x4650000 end_va = 0x472ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004650000" filename = "" Region: id = 725 start_va = 0x5e430000 end_va = 0x5e4cbfff monitored = 1 entry_point = 0x5e4be9b2 region_type = mapped_file name = "microsoft.visualbasic.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\microsoft.visualbasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\microsoft.visualbasic.dll") Region: id = 726 start_va = 0x4650000 end_va = 0x46ebfff monitored = 1 entry_point = 0x46de9b2 region_type = mapped_file name = "microsoft.visualbasic.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\microsoft.visualbasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\microsoft.visualbasic.dll") Region: id = 727 start_va = 0x4720000 end_va = 0x472ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004720000" filename = "" Region: id = 728 start_va = 0x4730000 end_va = 0x482ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004730000" filename = "" Region: id = 729 start_va = 0x2020000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 730 start_va = 0x2030000 end_va = 0x203ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002030000" filename = "" Region: id = 731 start_va = 0x2020000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 732 start_va = 0x2040000 end_va = 0x204ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002040000" filename = "" Region: id = 733 start_va = 0x2020000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 734 start_va = 0x2020000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 735 start_va = 0x2020000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 736 start_va = 0x2020000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 737 start_va = 0x2020000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 738 start_va = 0x2020000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 739 start_va = 0x2020000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 740 start_va = 0x2020000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 741 start_va = 0x2020000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 742 start_va = 0x75db0000 end_va = 0x771aefff monitored = 0 entry_point = 0x75f6b990 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 743 start_va = 0x77640000 end_va = 0x77676fff monitored = 0 entry_point = 0x77643b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 744 start_va = 0x74ed0000 end_va = 0x753c8fff monitored = 0 entry_point = 0x750d7610 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 745 start_va = 0x77390000 end_va = 0x7741cfff monitored = 0 entry_point = 0x773d9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 746 start_va = 0x74e70000 end_va = 0x74eb3fff monitored = 0 entry_point = 0x74e77410 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 747 start_va = 0x77320000 end_va = 0x7732efff monitored = 0 entry_point = 0x77322e40 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 748 start_va = 0x2020000 end_va = 0x2020fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002020000" filename = "" Region: id = 749 start_va = 0x74200000 end_va = 0x7421afff monitored = 0 entry_point = 0x74209050 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 750 start_va = 0x70410000 end_va = 0x70422fff monitored = 0 entry_point = 0x70419950 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 751 start_va = 0x703e0000 end_va = 0x7040efff monitored = 0 entry_point = 0x703f95e0 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 752 start_va = 0x45e0000 end_va = 0x461ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000045e0000" filename = "" Region: id = 753 start_va = 0x4640000 end_va = 0x464ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004640000" filename = "" Region: id = 754 start_va = 0x4830000 end_va = 0x492ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004830000" filename = "" Region: id = 755 start_va = 0x4930000 end_va = 0x496ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004930000" filename = "" Region: id = 756 start_va = 0x4970000 end_va = 0x4a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004970000" filename = "" Region: id = 757 start_va = 0x4a70000 end_va = 0x4aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a70000" filename = "" Region: id = 758 start_va = 0x4ab0000 end_va = 0x4baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ab0000" filename = "" Region: id = 759 start_va = 0x2040000 end_va = 0x2040fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002040000" filename = "" Region: id = 760 start_va = 0x74d20000 end_va = 0x74da3fff monitored = 0 entry_point = 0x74d46220 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 761 start_va = 0x4620000 end_va = 0x4620fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004620000" filename = "" Region: id = 762 start_va = 0x688f0000 end_va = 0x68931fff monitored = 1 entry_point = 0x688ff380 region_type = mapped_file name = "wbemdisp.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemdisp.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemdisp.dll") Region: id = 763 start_va = 0x68880000 end_va = 0x688e6fff monitored = 0 entry_point = 0x6889b610 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 764 start_va = 0x75b90000 end_va = 0x75beefff monitored = 0 entry_point = 0x75b94af0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 765 start_va = 0x6c840000 end_va = 0x6c84cfff monitored = 0 entry_point = 0x6c843520 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 766 start_va = 0x6c820000 end_va = 0x6c83bfff monitored = 0 entry_point = 0x6c82aa90 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\SysWOW64\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wmiutils.dll") Region: id = 1140 start_va = 0x68860000 end_va = 0x68870fff monitored = 0 entry_point = 0x68868fa0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 1141 start_va = 0x687a0000 end_va = 0x6885efff monitored = 0 entry_point = 0x687d1e80 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 1142 start_va = 0x68710000 end_va = 0x68790fff monitored = 0 entry_point = 0x6872b260 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll") Region: id = 1143 start_va = 0x4630000 end_va = 0x463efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wbemdisp.tlb" filename = "\\Windows\\SysWOW64\\wbem\\wbemdisp.tlb" (normalized: "c:\\windows\\syswow64\\wbem\\wbemdisp.tlb") Region: id = 1144 start_va = 0x46f0000 end_va = 0x46f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000046f0000" filename = "" Region: id = 1145 start_va = 0x4700000 end_va = 0x4700fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004700000" filename = "" Region: id = 1146 start_va = 0x4bb0000 end_va = 0x4c8ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 1147 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1148 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1149 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1150 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1151 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1152 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1153 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1154 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1155 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1156 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1157 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1158 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1159 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1160 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1161 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1162 start_va = 0x4c90000 end_va = 0x4c9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c90000" filename = "" Region: id = 1163 start_va = 0x4c90000 end_va = 0x4c9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c90000" filename = "" Region: id = 1164 start_va = 0x4c90000 end_va = 0x4c9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c90000" filename = "" Region: id = 1165 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1166 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1167 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1168 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1169 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1170 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1260 start_va = 0x686f0000 end_va = 0x68707fff monitored = 1 entry_point = 0x686f5480 region_type = mapped_file name = "custommarshalers.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\custommarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\custommarshalers.dll") Region: id = 1261 start_va = 0x4c90000 end_va = 0x4ca7fff monitored = 1 entry_point = 0x4c95480 region_type = mapped_file name = "custommarshalers.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\custommarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\custommarshalers.dll") Region: id = 1262 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1263 start_va = 0x686f0000 end_va = 0x68707fff monitored = 1 entry_point = 0x686f5480 region_type = mapped_file name = "custommarshalers.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\custommarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\custommarshalers.dll") Region: id = 1264 start_va = 0x4cb0000 end_va = 0x4cc7fff monitored = 1 entry_point = 0x4cb5480 region_type = mapped_file name = "custommarshalers.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\custommarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\custommarshalers.dll") Region: id = 1265 start_va = 0x4cb0000 end_va = 0x4cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cb0000" filename = "" Region: id = 1266 start_va = 0x4cc0000 end_va = 0x4ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cc0000" filename = "" Region: id = 1267 start_va = 0x4cc0000 end_va = 0x4ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cc0000" filename = "" Region: id = 1268 start_va = 0x4cc0000 end_va = 0x4ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cc0000" filename = "" Region: id = 1269 start_va = 0x4cc0000 end_va = 0x4cc4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\SysWOW64\\stdole2.tlb" (normalized: "c:\\windows\\syswow64\\stdole2.tlb") Region: id = 1270 start_va = 0x4cd0000 end_va = 0x4cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 1271 start_va = 0x4cd0000 end_va = 0x4cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 1272 start_va = 0x4cd0000 end_va = 0x4cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 1273 start_va = 0x4cd0000 end_va = 0x4cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 1274 start_va = 0x4cd0000 end_va = 0x4cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 1275 start_va = 0x4cd0000 end_va = 0x4cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 1276 start_va = 0x4cd0000 end_va = 0x4cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 1277 start_va = 0x4cd0000 end_va = 0x4cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 1278 start_va = 0x4cd0000 end_va = 0x4cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 1279 start_va = 0x4cd0000 end_va = 0x4cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 1280 start_va = 0x4cd0000 end_va = 0x4cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 1281 start_va = 0x4cd0000 end_va = 0x4cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 1282 start_va = 0x4ce0000 end_va = 0x4ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ce0000" filename = "" Region: id = 1283 start_va = 0x4ce0000 end_va = 0x4ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ce0000" filename = "" Region: id = 1284 start_va = 0x4ce0000 end_va = 0x4ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ce0000" filename = "" Region: id = 1285 start_va = 0x685d0000 end_va = 0x686ebfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\d2f554a0c84513cd793fdcd77a86dab1\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.management\\d2f554a0c84513cd793fdcd77a86dab1\\system.management.ni.dll") Region: id = 1286 start_va = 0x4cd0000 end_va = 0x4d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 1287 start_va = 0x4d10000 end_va = 0x4e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d10000" filename = "" Region: id = 1288 start_va = 0x7fe60000 end_va = 0x7feaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fe60000" filename = "" Region: id = 1289 start_va = 0x7fe50000 end_va = 0x7fe5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fe50000" filename = "" Region: id = 1290 start_va = 0x4e10000 end_va = 0x4e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 1291 start_va = 0x4e50000 end_va = 0x4f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e50000" filename = "" Region: id = 1292 start_va = 0x6c810000 end_va = 0x6c819fff monitored = 1 entry_point = 0x6c8139f9 region_type = mapped_file name = "wminet_utils.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WMINet_Utils.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\wminet_utils.dll") Region: id = 1293 start_va = 0x4f50000 end_va = 0x4f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f50000" filename = "" Region: id = 1294 start_va = 0x4f50000 end_va = 0x4f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f50000" filename = "" Region: id = 1295 start_va = 0x4f50000 end_va = 0x4f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f50000" filename = "" Region: id = 1297 start_va = 0x4f50000 end_va = 0x4f54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004f50000" filename = "" Region: id = 1724 start_va = 0x4f50000 end_va = 0x4f52fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004f50000" filename = "" Region: id = 1725 start_va = 0x4f50000 end_va = 0x4f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f50000" filename = "" Region: id = 1726 start_va = 0x4f90000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f90000" filename = "" Region: id = 1728 start_va = 0x4f50000 end_va = 0x4f62fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004f50000" filename = "" Region: id = 1743 start_va = 0x4f50000 end_va = 0x4f52fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004f50000" filename = "" Region: id = 1744 start_va = 0x4f50000 end_va = 0x4f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f50000" filename = "" Region: id = 1745 start_va = 0x4f50000 end_va = 0x4f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f50000" filename = "" Region: id = 1746 start_va = 0x4f50000 end_va = 0x4f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f50000" filename = "" Region: id = 1747 start_va = 0x4f90000 end_va = 0x4fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f90000" filename = "" Region: id = 1748 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1749 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1750 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 1751 start_va = 0x4ff0000 end_va = 0x502ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ff0000" filename = "" Region: id = 1752 start_va = 0x5030000 end_va = 0x512ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005030000" filename = "" Region: id = 1753 start_va = 0x5130000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 1754 start_va = 0x5170000 end_va = 0x51affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 1755 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1756 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 1757 start_va = 0x51b0000 end_va = 0x51bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051b0000" filename = "" Region: id = 1758 start_va = 0x51c0000 end_va = 0x51cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051c0000" filename = "" Region: id = 1759 start_va = 0x51d0000 end_va = 0x51dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 1760 start_va = 0x51e0000 end_va = 0x51effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051e0000" filename = "" Region: id = 1761 start_va = 0x51f0000 end_va = 0x51fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051f0000" filename = "" Region: id = 1762 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1763 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1764 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1765 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1766 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 1767 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 1768 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 1769 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1770 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1771 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1772 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1773 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1774 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1775 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1776 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1777 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1778 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1779 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1780 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 1781 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 1782 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 1783 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 1784 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 1785 start_va = 0x51b0000 end_va = 0x51bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051b0000" filename = "" Region: id = 1786 start_va = 0x51c0000 end_va = 0x51cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051c0000" filename = "" Region: id = 1787 start_va = 0x51d0000 end_va = 0x51dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 1788 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1789 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1790 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1791 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1792 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1793 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1794 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1795 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1796 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1797 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1798 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1799 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1800 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1801 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1802 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1803 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1804 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1805 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 1806 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 1807 start_va = 0x51b0000 end_va = 0x51bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051b0000" filename = "" Region: id = 1808 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1809 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1810 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1811 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1812 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1813 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1814 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1815 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1816 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1817 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1818 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1819 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1820 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1821 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1822 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1823 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1824 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1825 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 1826 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 1827 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1828 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1829 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1830 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1831 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1832 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1833 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1834 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1835 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1836 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 1837 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1838 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1839 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1840 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1841 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1842 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1843 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1844 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1845 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1846 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1847 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1848 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1849 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1850 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1851 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 1852 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1853 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1854 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1855 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1856 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1857 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1858 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1859 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1860 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1861 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1862 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1863 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1864 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1865 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1866 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1867 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1868 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1869 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1870 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1871 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1872 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1873 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1874 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 1875 start_va = 0x51c0000 end_va = 0x51cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051c0000" filename = "" Region: id = 1876 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1877 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1878 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1879 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1880 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1881 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1882 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1883 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1884 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1885 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 1886 start_va = 0x51c0000 end_va = 0x51cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051c0000" filename = "" Region: id = 1887 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1888 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1889 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1890 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1891 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1892 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1893 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1894 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1895 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1896 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1897 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1898 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1899 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1900 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1901 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1902 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1903 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1904 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1905 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1906 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1907 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1908 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1909 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1910 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 1911 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 1912 start_va = 0x51c0000 end_va = 0x51cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051c0000" filename = "" Region: id = 1913 start_va = 0x51d0000 end_va = 0x51dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 1914 start_va = 0x51e0000 end_va = 0x51effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051e0000" filename = "" Region: id = 1915 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1916 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1917 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1918 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1919 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1920 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1921 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1922 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1923 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 1924 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 1925 start_va = 0x51c0000 end_va = 0x51cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051c0000" filename = "" Region: id = 1926 start_va = 0x51d0000 end_va = 0x51dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 1927 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1928 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1929 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1930 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1931 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1932 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1933 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1934 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1935 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1936 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1937 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1938 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1939 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1940 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1941 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1942 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1943 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1944 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1945 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1946 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1947 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1948 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1949 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1950 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1951 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1952 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1953 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1954 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1955 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 1956 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 1957 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 1958 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1959 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 1960 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1961 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1962 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 1963 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1964 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1965 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1966 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1967 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1968 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1969 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1970 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1971 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1972 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1973 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1974 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1975 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1976 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1977 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1978 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1979 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1980 start_va = 0x5130000 end_va = 0x5191fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll") Region: id = 1981 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1982 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 1983 start_va = 0x68510000 end_va = 0x685c5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.security.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Security\\4e4cb6e2e651b6d243241e4edd14b3f3\\System.Security.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.security\\4e4cb6e2e651b6d243241e4edd14b3f3\\system.security.ni.dll") Region: id = 1984 start_va = 0x75830000 end_va = 0x759a7fff monitored = 0 entry_point = 0x75888a90 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 1985 start_va = 0x754c0000 end_va = 0x754cdfff monitored = 0 entry_point = 0x754c5410 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 1986 start_va = 0x70430000 end_va = 0x70437fff monitored = 0 entry_point = 0x70431d70 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\SysWOW64\\dpapi.dll" (normalized: "c:\\windows\\syswow64\\dpapi.dll") Region: id = 1987 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1988 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1989 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 1990 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1991 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1992 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 1993 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 1994 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 1995 start_va = 0x51a0000 end_va = 0x51affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051a0000" filename = "" Region: id = 1996 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1997 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1998 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1999 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2000 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2001 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2002 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2003 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2004 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2005 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2006 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2007 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2008 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2009 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2010 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2011 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2012 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2013 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 2014 start_va = 0x51a0000 end_va = 0x51affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051a0000" filename = "" Region: id = 2015 start_va = 0x51c0000 end_va = 0x51cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051c0000" filename = "" Region: id = 2016 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2017 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2018 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2019 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2020 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2021 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2022 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2023 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 2024 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2025 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2026 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2027 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2028 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2029 start_va = 0x4fd0000 end_va = 0x4fd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 2030 start_va = 0x4fd0000 end_va = 0x4fd8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 2031 start_va = 0x4fd0000 end_va = 0x4fd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 2032 start_va = 0x4fd0000 end_va = 0x4fd8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 2033 start_va = 0x4fd0000 end_va = 0x4fd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 2034 start_va = 0x4fd0000 end_va = 0x4fd8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 2035 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2036 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 2037 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2038 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2039 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2040 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2041 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2042 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 2043 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 2044 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 2045 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 2046 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 2047 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 2048 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 2049 start_va = 0x51d0000 end_va = 0x51dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 2050 start_va = 0x51e0000 end_va = 0x51effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051e0000" filename = "" Region: id = 2051 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2052 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2053 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2054 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2055 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2056 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 2057 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2058 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2059 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 2060 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2061 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2062 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 2063 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2064 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2065 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2066 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2067 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2068 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2069 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2070 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2071 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 2072 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 2073 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 2074 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 2075 start_va = 0x51d0000 end_va = 0x51dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 2076 start_va = 0x51e0000 end_va = 0x51effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051e0000" filename = "" Region: id = 2077 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2078 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2079 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 2080 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2081 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 2082 start_va = 0x51d0000 end_va = 0x51dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 2083 start_va = 0x51e0000 end_va = 0x51effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051e0000" filename = "" Region: id = 2084 start_va = 0x51f0000 end_va = 0x51fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051f0000" filename = "" Region: id = 2085 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2086 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2087 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2088 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2089 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2090 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2091 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2092 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2093 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2094 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 2095 start_va = 0x51d0000 end_va = 0x51dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 2096 start_va = 0x4fd0000 end_va = 0x4fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2097 start_va = 0x6cc30000 end_va = 0x6cc69fff monitored = 0 entry_point = 0x6cc49be0 region_type = mapped_file name = "vaultcli.dll" filename = "\\Windows\\SysWOW64\\vaultcli.dll" (normalized: "c:\\windows\\syswow64\\vaultcli.dll") Region: id = 2098 start_va = 0x74130000 end_va = 0x741f7fff monitored = 0 entry_point = 0x7419ae90 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\SysWOW64\\WinTypes.dll" (normalized: "c:\\windows\\syswow64\\wintypes.dll") Region: id = 2099 start_va = 0x4fd0000 end_va = 0x4fd3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 2100 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 2101 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 2102 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 2103 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 2104 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 2105 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 2106 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 2107 start_va = 0x51d0000 end_va = 0x51dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 2108 start_va = 0x51d0000 end_va = 0x51dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 2109 start_va = 0x51d0000 end_va = 0x51dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 2110 start_va = 0x51e0000 end_va = 0x51effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051e0000" filename = "" Region: id = 2111 start_va = 0x51f0000 end_va = 0x51fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051f0000" filename = "" Region: id = 2112 start_va = 0x5200000 end_va = 0x520ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005200000" filename = "" Region: id = 2113 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2114 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 2115 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 2116 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 2117 start_va = 0x4fe0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 2118 start_va = 0x51d0000 end_va = 0x51dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 2119 start_va = 0x51d0000 end_va = 0x51dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 2120 start_va = 0x51d0000 end_va = 0x51dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 2121 start_va = 0x51e0000 end_va = 0x51effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051e0000" filename = "" Region: id = 2122 start_va = 0x51d0000 end_va = 0x51dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 2123 start_va = 0x51e0000 end_va = 0x51effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051e0000" filename = "" Region: id = 2124 start_va = 0x51d0000 end_va = 0x51dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 2125 start_va = 0x51e0000 end_va = 0x51effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051e0000" filename = "" Region: id = 2126 start_va = 0x51d0000 end_va = 0x51dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 2127 start_va = 0x51f0000 end_va = 0x51fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051f0000" filename = "" Region: id = 2128 start_va = 0x51d0000 end_va = 0x51dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 2129 start_va = 0x51d0000 end_va = 0x51dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 2130 start_va = 0x51d0000 end_va = 0x51dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 2131 start_va = 0x51f0000 end_va = 0x51fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051f0000" filename = "" Region: id = 2132 start_va = 0x51d0000 end_va = 0x51dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 2133 start_va = 0x51d0000 end_va = 0x51dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 2134 start_va = 0x51d0000 end_va = 0x51dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 2135 start_va = 0x51f0000 end_va = 0x51fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051f0000" filename = "" Region: id = 2136 start_va = 0x51d0000 end_va = 0x51dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 2137 start_va = 0x51f0000 end_va = 0x51fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051f0000" filename = "" Region: id = 2138 start_va = 0x5200000 end_va = 0x520ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005200000" filename = "" Region: id = 2139 start_va = 0x51d0000 end_va = 0x51dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 2140 start_va = 0x51d0000 end_va = 0x51dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 2141 start_va = 0x51d0000 end_va = 0x51dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 2142 start_va = 0x51d0000 end_va = 0x51dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 2143 start_va = 0x51f0000 end_va = 0x522ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051f0000" filename = "" Region: id = 2144 start_va = 0x5230000 end_va = 0x532ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 2146 start_va = 0x4630000 end_va = 0x4632fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004630000" filename = "" Region: id = 2148 start_va = 0x4630000 end_va = 0x463ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004630000" filename = "" Region: id = 2149 start_va = 0x4630000 end_va = 0x463ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004630000" filename = "" Region: id = 2150 start_va = 0x4630000 end_va = 0x463ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004630000" filename = "" Region: id = 2151 start_va = 0x51f0000 end_va = 0x522ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051f0000" filename = "" Region: id = 2152 start_va = 0x5230000 end_va = 0x532ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 2156 start_va = 0x4630000 end_va = 0x463ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004630000" filename = "" Region: id = 2157 start_va = 0x4630000 end_va = 0x463ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004630000" filename = "" Region: id = 2158 start_va = 0x4630000 end_va = 0x463ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004630000" filename = "" Region: id = 2159 start_va = 0x4630000 end_va = 0x463ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004630000" filename = "" Region: id = 2160 start_va = 0x4630000 end_va = 0x463ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004630000" filename = "" Region: id = 2161 start_va = 0x4630000 end_va = 0x463ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004630000" filename = "" Region: id = 2162 start_va = 0x71f80000 end_va = 0x71faefff monitored = 0 entry_point = 0x71f8bb70 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 2163 start_va = 0x71fb0000 end_va = 0x72033fff monitored = 0 entry_point = 0x71fd6530 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 2164 start_va = 0x74ec0000 end_va = 0x74ec6fff monitored = 0 entry_point = 0x74ec1e10 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 2165 start_va = 0x71f00000 end_va = 0x71f12fff monitored = 0 entry_point = 0x71f025d0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc6.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc6.dll") Region: id = 2166 start_va = 0x71ee0000 end_va = 0x71ef3fff monitored = 0 entry_point = 0x71ee3c10 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc.dll") Region: id = 2167 start_va = 0x70690000 end_va = 0x70697fff monitored = 0 entry_point = 0x70691fc0 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 2168 start_va = 0x51f0000 end_va = 0x522ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051f0000" filename = "" Region: id = 2169 start_va = 0x5230000 end_va = 0x532ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 2170 start_va = 0x72040000 end_va = 0x7208efff monitored = 0 entry_point = 0x7204d850 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 2171 start_va = 0x71f70000 end_va = 0x71f77fff monitored = 0 entry_point = 0x71f71920 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 2172 start_va = 0x71f20000 end_va = 0x71f66fff monitored = 0 entry_point = 0x71f358d0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 2173 start_va = 0x6cc20000 end_va = 0x6cc29fff monitored = 0 entry_point = 0x6cc23200 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 2174 start_va = 0x704c0000 end_va = 0x70523fff monitored = 0 entry_point = 0x704dafd0 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll") Region: id = 2175 start_va = 0x4630000 end_va = 0x463ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004630000" filename = "" Region: id = 2176 start_va = 0x704b0000 end_va = 0x704bffff monitored = 0 entry_point = 0x704b4600 region_type = mapped_file name = "mskeyprotect.dll" filename = "\\Windows\\SysWOW64\\mskeyprotect.dll" (normalized: "c:\\windows\\syswow64\\mskeyprotect.dll") Region: id = 2177 start_va = 0x70490000 end_va = 0x704affff monitored = 0 entry_point = 0x7049d120 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll") Region: id = 2178 start_va = 0x70460000 end_va = 0x7048bfff monitored = 0 entry_point = 0x7047bb10 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\SysWOW64\\ntasn1.dll" (normalized: "c:\\windows\\syswow64\\ntasn1.dll") Region: id = 2179 start_va = 0x70440000 end_va = 0x70459fff monitored = 0 entry_point = 0x7044fa70 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\SysWOW64\\ncryptsslp.dll" (normalized: "c:\\windows\\syswow64\\ncryptsslp.dll") Region: id = 2180 start_va = 0x5330000 end_va = 0x536ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005330000" filename = "" Region: id = 2181 start_va = 0x5370000 end_va = 0x546ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005370000" filename = "" Region: id = 2182 start_va = 0x5470000 end_va = 0x556ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 2183 start_va = 0x5570000 end_va = 0x55fefff monitored = 0 entry_point = 0x557dd60 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll") Region: id = 2184 start_va = 0x68470000 end_va = 0x68501fff monitored = 0 entry_point = 0x6847dd60 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll") Region: id = 2185 start_va = 0x5570000 end_va = 0x55effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005570000" filename = "" Region: id = 2186 start_va = 0x4cc0000 end_va = 0x4cc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004cc0000" filename = "" Region: id = 2187 start_va = 0x55f0000 end_va = 0x56abfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000055f0000" filename = "" Region: id = 2188 start_va = 0x4cc0000 end_va = 0x4cc3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004cc0000" filename = "" Region: id = 2189 start_va = 0x51d0000 end_va = 0x51d3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 2190 start_va = 0x6fe50000 end_va = 0x6fe6cfff monitored = 0 entry_point = 0x6fe53b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 2195 start_va = 0x5570000 end_va = 0x55affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005570000" filename = "" Region: id = 2196 start_va = 0x55e0000 end_va = 0x55effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000055e0000" filename = "" Region: id = 2197 start_va = 0x56b0000 end_va = 0x56effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000056b0000" filename = "" Region: id = 2198 start_va = 0x56f0000 end_va = 0x572ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000056f0000" filename = "" Region: id = 2199 start_va = 0x5730000 end_va = 0x582ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005730000" filename = "" Region: id = 2200 start_va = 0x5030000 end_va = 0x506ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005030000" filename = "" Region: id = 2201 start_va = 0x5070000 end_va = 0x50affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005070000" filename = "" Region: id = 2202 start_va = 0x56b0000 end_va = 0x57affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000056b0000" filename = "" Region: id = 2203 start_va = 0x4e50000 end_va = 0x4e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e50000" filename = "" Thread: id = 9 os_tid = 0x46c [0186.261] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0186.282] RoInitialize () returned 0x1 [0186.283] RoUninitialize () returned 0x0 [0186.800] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x248 [0186.801] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x24c [0186.832] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e60c | out: phkResult=0x19e60c*=0x25c) returned 0x0 [0186.833] RegQueryValueExW (in: hKey=0x25c, lpValueName="InstallationType", lpReserved=0x0, lpType=0x19e62c, lpData=0x0, lpcbData=0x19e628*=0x0 | out: lpType=0x19e62c*=0x1, lpData=0x0, lpcbData=0x19e628*=0xe) returned 0x0 [0186.833] RegQueryValueExW (in: hKey=0x25c, lpValueName="InstallationType", lpReserved=0x0, lpType=0x19e62c, lpData=0x2164858, lpcbData=0x19e628*=0xe | out: lpType=0x19e62c*=0x1, lpData="Client", lpcbData=0x19e628*=0xe) returned 0x0 [0186.835] RegCloseKey (hKey=0x25c) returned 0x0 [0187.075] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe.config", nBufferLength=0x105, lpBuffer=0x19dfc8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe.config", lpFilePart=0x0) returned 0x69 [0187.078] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe.config", nBufferLength=0x105, lpBuffer=0x19df70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe.config", lpFilePart=0x0) returned 0x69 [0187.516] GetCurrentProcess () returned 0xffffffff [0187.516] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e328 | out: TokenHandle=0x19e328*=0x25c) returned 1 [0187.524] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x19de04, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0187.528] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19e328 | out: lpFileInformation=0x19e328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0187.529] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x19ddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0187.532] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19e328 | out: lpFileInformation=0x19e328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0187.533] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x19dd60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0187.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e254) returned 1 [0187.534] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0187.536] GetFileType (hFile=0x260) returned 0x1 [0187.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e250) returned 1 [0187.536] GetFileType (hFile=0x260) returned 0x1 [0187.567] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0x19e31c | out: lpFileSizeHigh=0x19e31c*=0x0) returned 0x8c8f [0187.568] ReadFile (in: hFile=0x260, lpBuffer=0x2168650, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e2d8, lpOverlapped=0x0 | out: lpBuffer=0x2168650*, lpNumberOfBytesRead=0x19e2d8*=0x1000, lpOverlapped=0x0) returned 1 [0187.598] ReadFile (in: hFile=0x260, lpBuffer=0x2168650, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e174, lpOverlapped=0x0 | out: lpBuffer=0x2168650*, lpNumberOfBytesRead=0x19e174*=0x1000, lpOverlapped=0x0) returned 1 [0187.605] ReadFile (in: hFile=0x260, lpBuffer=0x2168650, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e028, lpOverlapped=0x0 | out: lpBuffer=0x2168650*, lpNumberOfBytesRead=0x19e028*=0x1000, lpOverlapped=0x0) returned 1 [0187.606] ReadFile (in: hFile=0x260, lpBuffer=0x2168650, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e028, lpOverlapped=0x0 | out: lpBuffer=0x2168650*, lpNumberOfBytesRead=0x19e028*=0x1000, lpOverlapped=0x0) returned 1 [0187.607] ReadFile (in: hFile=0x260, lpBuffer=0x2168650, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e028, lpOverlapped=0x0 | out: lpBuffer=0x2168650*, lpNumberOfBytesRead=0x19e028*=0x1000, lpOverlapped=0x0) returned 1 [0187.607] ReadFile (in: hFile=0x260, lpBuffer=0x2168650, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19df60, lpOverlapped=0x0 | out: lpBuffer=0x2168650*, lpNumberOfBytesRead=0x19df60*=0x1000, lpOverlapped=0x0) returned 1 [0187.612] ReadFile (in: hFile=0x260, lpBuffer=0x2168650, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e0dc, lpOverlapped=0x0 | out: lpBuffer=0x2168650*, lpNumberOfBytesRead=0x19e0dc*=0x1000, lpOverlapped=0x0) returned 1 [0187.613] ReadFile (in: hFile=0x260, lpBuffer=0x2168650, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19dff0, lpOverlapped=0x0 | out: lpBuffer=0x2168650*, lpNumberOfBytesRead=0x19dff0*=0x1000, lpOverlapped=0x0) returned 1 [0187.613] ReadFile (in: hFile=0x260, lpBuffer=0x2168650, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19dff0, lpOverlapped=0x0 | out: lpBuffer=0x2168650*, lpNumberOfBytesRead=0x19dff0*=0xc8f, lpOverlapped=0x0) returned 1 [0187.613] ReadFile (in: hFile=0x260, lpBuffer=0x2168650, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e0b0, lpOverlapped=0x0 | out: lpBuffer=0x2168650*, lpNumberOfBytesRead=0x19e0b0*=0x0, lpOverlapped=0x0) returned 1 [0187.614] CloseHandle (hObject=0x260) returned 1 [0187.615] GetCurrentProcess () returned 0xffffffff [0187.615] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e450 | out: TokenHandle=0x19e450*=0x260) returned 1 [0187.615] GetCurrentProcess () returned 0xffffffff [0187.615] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e450 | out: TokenHandle=0x19e450*=0x264) returned 1 [0187.616] GetCurrentProcess () returned 0xffffffff [0187.616] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e328 | out: TokenHandle=0x19e328*=0x268) returned 1 [0187.616] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe.config" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19e328 | out: lpFileInformation=0x19e328*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0187.617] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe.config", nBufferLength=0x105, lpBuffer=0x19ddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe.config", lpFilePart=0x0) returned 0x69 [0187.617] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe.config" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19e328 | out: lpFileInformation=0x19e328*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0187.617] GetCurrentProcess () returned 0xffffffff [0187.618] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e450 | out: TokenHandle=0x19e450*=0x26c) returned 1 [0187.618] GetCurrentProcess () returned 0xffffffff [0187.618] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e450 | out: TokenHandle=0x19e450*=0x270) returned 1 [0187.672] GetCurrentProcess () returned 0xffffffff [0187.672] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e214 | out: TokenHandle=0x19e214*=0x274) returned 1 [0187.826] GetCurrentProcess () returned 0xffffffff [0187.826] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e228 | out: TokenHandle=0x19e228*=0x278) returned 1 [0187.856] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x19def0 | out: phkResult=0x19def0*=0x0) returned 0x2 [0187.864] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f408 | out: phkResult=0x19f408*=0x27c) returned 0x0 [0187.865] RegQueryValueExW (in: hKey=0x27c, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x19f424, lpData=0x0, lpcbData=0x19f420*=0x0 | out: lpType=0x19f424*=0x0, lpData=0x0, lpcbData=0x19f420*=0x0) returned 0x2 [0187.865] RegCloseKey (hKey=0x27c) returned 0x0 [0187.961] GetCurrentProcessId () returned 0xe94 [0187.962] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x19ed74 | out: lpLuid=0x19ed74*(LowPart=0x14, HighPart=0)) returned 1 [0187.966] GetCurrentProcess () returned 0xffffffff [0187.967] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x19ed70 | out: TokenHandle=0x19ed70*=0x28c) returned 1 [0187.968] AdjustTokenPrivileges (in: TokenHandle=0x28c, DisableAllPrivileges=0, NewState=0x2185020*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0187.968] CloseHandle (hObject=0x28c) returned 1 [0187.983] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x31694b0, Length=0x20000, ResultLength=0x19f454 | out: SystemInformation=0x31694b0, ResultLength=0x19f454*=0x17840) returned 0x0 [0188.030] GetCurrentProcessId () returned 0xe94 [0188.034] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x31694b0, Length=0x20000, ResultLength=0x19f444 | out: SystemInformation=0x31694b0, ResultLength=0x19f444*=0x17840) returned 0x0 [0194.550] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x19ee2c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0194.554] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x19ee94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0194.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f2f4) returned 1 [0194.555] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19f370 | out: lpFileInformation=0x19f370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0194.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f2f0) returned 1 [0194.675] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x19f07c | out: pfEnabled=0x19f07c) returned 0x0 [0194.794] CreateBindCtx (in: reserved=0x0, ppbc=0x19f420 | out: ppbc=0x19f420*=0x4e4f50) returned 0x0 [0194.796] IUnknown:QueryInterface (in: This=0x4e4f50, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eedc | out: ppvObject=0x19eedc*=0x4e4f50) returned 0x0 [0194.796] IUnknown:QueryInterface (in: This=0x4e4f50, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ee98 | out: ppvObject=0x19ee98*=0x0) returned 0x80004002 [0194.796] IUnknown:QueryInterface (in: This=0x4e4f50, riid=0x6c29fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ecb4 | out: ppvObject=0x19ecb4*=0x0) returned 0x80004002 [0194.797] IUnknown:QueryInterface (in: This=0x4e4f50, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19ea8c | out: ppvObject=0x19ea8c*=0x0) returned 0x80004002 [0194.797] IUnknown:AddRef (This=0x4e4f50) returned 0x3 [0194.797] IUnknown:QueryInterface (in: This=0x4e4f50, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e7f4 | out: ppvObject=0x19e7f4*=0x0) returned 0x80004002 [0194.797] IUnknown:QueryInterface (in: This=0x4e4f50, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e7a4 | out: ppvObject=0x19e7a4*=0x0) returned 0x80004002 [0194.797] IUnknown:QueryInterface (in: This=0x4e4f50, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e7b0 | out: ppvObject=0x19e7b0*=0x0) returned 0x80004002 [0194.797] CoGetContextToken (in: pToken=0x19e810 | out: pToken=0x19e810) returned 0x0 [0194.797] CObjectContext::QueryInterface () returned 0x0 [0194.797] CObjectContext::GetCurrentApartmentType () returned 0x0 [0194.798] Release () returned 0x0 [0194.798] CoGetObjectContext (in: riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e3464 | out: ppv=0x4e3464*=0x4c0058) returned 0x0 [0194.839] CoGetContextToken (in: pToken=0x19ec18 | out: pToken=0x19ec18) returned 0x0 [0194.840] IUnknown:QueryInterface (in: This=0x4e4f50, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eca8 | out: ppvObject=0x19eca8*=0x0) returned 0x80004002 [0194.841] IUnknown:Release (This=0x4e4f50) returned 0x2 [0194.841] CoGetContextToken (in: pToken=0x19f1f0 | out: pToken=0x19f1f0) returned 0x0 [0194.842] CoGetContextToken (in: pToken=0x19f150 | out: pToken=0x19f150) returned 0x0 [0194.842] IUnknown:QueryInterface (in: This=0x4e4f50, riid=0x19f220*(Data1=0xe, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f21c | out: ppvObject=0x19f21c*=0x4e4f50) returned 0x0 [0194.843] IUnknown:AddRef (This=0x4e4f50) returned 0x4 [0194.843] IUnknown:Release (This=0x4e4f50) returned 0x3 [0194.843] IUnknown:Release (This=0x4e4f50) returned 0x2 [0194.848] CoGetContextToken (in: pToken=0x19f268 | out: pToken=0x19f268) returned 0x0 [0194.848] IUnknown:AddRef (This=0x4e4f50) returned 0x3 [0194.848] MkParseDisplayName (in: pbc=0x4e4f50, szUserName="WinMgmts:", pchEaten=0x19f454, ppmk=0x19f40c | out: pchEaten=0x19f454, ppmk=0x19f40c*=0x4eaea0) returned 0x0 [0197.492] malloc (_Size=0x80) returned 0x7b30a0 [0197.496] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea018 [0197.497] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0197.498] DllGetClassObject (in: rclsid=0x4f4404*(Data1=0x172bddf8, Data2=0xceea, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), riid=0x75c07590*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1f8 | out: ppv=0x19f1f8*=0x4ea150) returned 0x0 [0197.498] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea150 [0197.499] WinMGMTS:IClassFactory:CreateInstance (in: This=0x4ea150, pUnkOuter=0x0, riid=0x753d6800*(Data1=0x11a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1a0 | out: ppvObject=0x19f1a0*=0x4e94f8) returned 0x0 [0197.500] GetVersionExW (in: lpVersionInformation=0x19ef58*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x19efb8, dwMinorVersion=0x7459234f, dwBuildNumber=0xc0150008, dwPlatformId=0x0, szCSDVersion="\쯟≵) | out: lpVersionInformation=0x19ef58*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0197.500] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Wbem\\Scripting", ulOptions=0x0, samDesired=0x1, phkResult=0x19ef50 | out: phkResult=0x19ef50*=0x380) returned 0x0 [0197.501] RegQueryValueExW (in: hKey=0x380, lpValueName="Default Impersonation Level", lpReserved=0x0, lpType=0x0, lpData=0x19ef48, lpcbData=0x19ef54*=0x4 | out: lpType=0x0, lpData=0x19ef48*=0x3, lpcbData=0x19ef54*=0x4) returned 0x0 [0197.501] RegCloseKey (hKey=0x380) returned 0x0 [0197.501] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4f5200 [0197.501] GetSystemDirectoryW (in: lpBuffer=0x4f5200, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0197.501] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\advapi32.dll", hFile=0x0, dwFlags=0x0) returned 0x74810000 [0197.501] GetProcAddress (hModule=0x74810000, lpProcName="DuplicateTokenEx") returned 0x74830ad0 [0197.502] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0197.502] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4eb0f8 [0197.502] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4e94f8 [0197.502] WinMGMTS:IUnknown:Release (This=0x4ea150) returned 0x0 [0197.502] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0197.503] WinMGMTS:IParseDisplayName:ParseDisplayName (in: This=0x4e94f8, pbc=0x4e4f50, pszDisplayName="WinMgmts:", pchEaten=0x19f3b0, ppmkOut=0x19f3ac | out: pchEaten=0x19f3b0*=0x9, ppmkOut=0x19f3ac*=0x4eaea0) returned 0x0 [0197.503] ApiSetQueryApiSetPresence () returned 0x0 [0197.503] _wcsnicmp (_String1="WinMgmts:", _String2="WINMGMTS:", _MaxCount=0x9) returned 0 [0197.503] IBindCtx:GetObjectParam (in: This=0x4e4f50, pszKey=0x688f3e5c, ppunk=0x19f258 | out: ppunk=0x19f258*=0x0) returned 0x80004005 [0197.503] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x494970 [0197.504] _wcsnicmp (_String1="", _String2="{", _MaxCount=0x1) returned -123 [0197.504] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ded50 [0197.504] ResolveDelayLoadedAPI () returned 0x75c70060 [0197.505] CoCreateInstance (in: rclsid=0x688f1c58*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x688f1c48*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x4ded68 | out: ppv=0x4ded68*=0x4e9508) returned 0x0 [0197.705] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4dedb8 [0197.705] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4c7fd0 [0197.705] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4949b0 [0197.705] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0197.705] GetCurrentThreadId () returned 0x46c [0197.705] _wcsnicmp (_String1="", _String2="[", _MaxCount=0x1) returned -91 [0197.705] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0197.705] GetCurrentThreadId () returned 0x46c [0197.707] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Wbem\\Scripting", ulOptions=0x0, samDesired=0x1, phkResult=0x19f0cc | out: phkResult=0x19f0cc*=0x388) returned 0x0 [0197.707] RegQueryValueExW (in: hKey=0x388, lpValueName="Default Namespace", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x19f0d0*=0x0 | out: lpType=0x0, lpData=0x0, lpcbData=0x19f0d0*=0x16) returned 0x0 [0197.707] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x494770 [0197.707] RegQueryValueExW (in: hKey=0x388, lpValueName="Default Namespace", lpReserved=0x0, lpType=0x0, lpData=0x494770, lpcbData=0x19f0d0*=0x16 | out: lpType=0x0, lpData=0x494770*=0x72, lpcbData=0x19f0d0*=0x16) returned 0x0 [0197.708] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4949d0 [0197.709] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0197.709] RegCloseKey (hKey=0x388) returned 0x0 [0197.710] CoCreateInstance (in: rclsid=0x688f21a8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x688f21b8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x19f104 | out: ppv=0x19f104*=0x4e0728) returned 0x0 [0197.916] SysStringLen (param_1=".") returned 0x1 [0197.916] WbemDefPath:IWbemPath:SetServer (This=0x4e0728, Name=".") returned 0x0 [0197.916] CoCreateInstance (in: rclsid=0x688f21a8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x688f21b8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x19f0b0 | out: ppv=0x19f0b0*=0x4e04f8) returned 0x0 [0197.916] CoCreateInstance (in: rclsid=0x688f21a8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x688f21b8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x19f04c | out: ppv=0x19f04c*=0x4e0488) returned 0x0 [0197.917] WbemDefPath:IWbemPath:SetText (This=0x4e0488, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0197.917] WbemDefPath:IUnknown:Release (This=0x4e0488) returned 0x0 [0197.917] SysStringLen (param_1="root\\cimv2") returned 0xa [0197.917] WbemDefPath:IWbemPath:SetText (This=0x4e04f8, uMode=0xc, pszPath="root\\cimv2") returned 0x0 [0197.917] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e04f8, puCount=0x19f0c8 | out: puCount=0x19f0c8*=0x2) returned 0x0 [0197.917] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x4e0728) returned 0x0 [0197.917] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4e04f8, uIndex=0x0, puNameBufLength=0x19f084*=0x0, pName=0x0 | out: puNameBufLength=0x19f084*=0x5, pName=0x0) returned 0x0 [0197.917] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea288 [0197.917] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4e04f8, uIndex=0x0, puNameBufLength=0x19f084*=0x5, pName="root" | out: puNameBufLength=0x19f084*=0x5, pName="root") returned 0x0 [0197.917] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0197.918] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x4e0728, uIndex=0x0, pszName="root") returned 0x0 [0197.918] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4e04f8, uIndex=0x1, puNameBufLength=0x19f084*=0x0, pName=0x0 | out: puNameBufLength=0x19f084*=0x6, pName=0x0) returned 0x0 [0197.918] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4ea210 [0197.918] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4e04f8, uIndex=0x1, puNameBufLength=0x19f084*=0x6, pName="䅬痁䆐痁L" | out: puNameBufLength=0x19f084*=0x6, pName="cimv2") returned 0x0 [0197.918] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0197.918] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x4e0728, uIndex=0x1, pszName="cimv2") returned 0x0 [0197.918] WbemDefPath:IUnknown:Release (This=0x4e04f8) returned 0x0 [0197.918] WbemDefPath:IWbemPath:GetText (in: This=0x4e0728, lFlags=4, puBuffLength=0x19f0cc*=0x0, pszText=0x0 | out: puBuffLength=0x19f0cc*=0xf, pszText=0x0) returned 0x0 [0197.918] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4eaea0 [0197.919] WbemDefPath:IWbemPath:GetText (in: This=0x4e0728, lFlags=4, puBuffLength=0x19f0cc*=0xf, pszText="꺤Nԁ" | out: puBuffLength=0x19f0cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0197.919] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0197.919] WbemDefPath:IUnknown:Release (This=0x4e0728) returned 0x0 [0197.919] WbemLocator:IWbemLocator:ConnectServer (in: This=0x4e9508, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale=0x0, lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x19f14c | out: ppNamespace=0x19f14c*=0x4b27f8) returned 0x0 [0203.811] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4e0028 [0203.812] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4c7c10 [0203.812] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4f8a68 [0203.812] WbemLocator:IUnknown:QueryInterface (in: This=0x4b27f8, riid=0x688f1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f13c | out: ppvObject=0x19f13c*=0x4f94ac) returned 0x0 [0203.812] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x4f94ac, pProxy=0x4b27f8, pAuthnSvc=0x19f118, pAuthzSvc=0x19f11c, pServerPrincName=0x0, pAuthnLevel=0x19f18c, pImpLevel=0x19f194, pAuthInfo=0x0, pCapabilites=0x19f120 | out: pAuthnSvc=0x19f118*=0xa, pAuthzSvc=0x19f11c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19f18c*=0x6, pImpLevel=0x19f194*=0x2, pAuthInfo=0x0, pCapabilites=0x19f120*=0x1) returned 0x0 [0203.812] WbemLocator:IUnknown:Release (This=0x4f94ac) returned 0x1 [0203.812] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0203.813] GetCurrentThreadId () returned 0x46c [0203.813] WbemLocator:IUnknown:QueryInterface (in: This=0x4b27f8, riid=0x688f1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1b4 | out: ppvObject=0x19f1b4*=0x4f94ac) returned 0x0 [0203.813] WbemLocator:IClientSecurity:CopyProxy (in: This=0x4f94ac, pProxy=0x4b27f8, ppCopy=0x19f1d8 | out: ppCopy=0x19f1d8*=0x4fb470) returned 0x0 [0203.813] WbemLocator:IUnknown:QueryInterface (in: This=0x4fb470, riid=0x688f1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f050 | out: ppvObject=0x19f050*=0x4f94ac) returned 0x0 [0203.813] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x4f94ac, pProxy=0x4fb470, pAuthnSvc=0x19f080, pAuthzSvc=0x19f07c, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x19f080*=0xa, pAuthzSvc=0x19f07c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0203.813] WbemLocator:IUnknown:Release (This=0x4f94ac) returned 0x3 [0203.813] WbemLocator:IUnknown:QueryInterface (in: This=0x4fb470, riid=0x688f1f08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f034 | out: ppvObject=0x19f034*=0x4f94d0) returned 0x0 [0203.813] WbemLocator:IUnknown:QueryInterface (in: This=0x4fb470, riid=0x688f1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f038 | out: ppvObject=0x19f038*=0x4f94ac) returned 0x0 [0203.813] WbemLocator:IClientSecurity:SetBlanket (This=0x4f94ac, pProxy=0x4fb470, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0203.814] WbemLocator:IUnknown:Release (This=0x4f94ac) returned 0x4 [0203.814] WbemLocator:IUnknown:Release (This=0x4f94d0) returned 0x3 [0203.814] WbemLocator:IUnknown:Release (This=0x4f94ac) returned 0x2 [0203.814] WbemLocator:IUnknown:AddRef (This=0x4fb470) returned 0x3 [0203.814] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4c7d90 [0203.814] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4f5780 [0203.815] WbemLocator:IUnknown:Release (This=0x4b27f8) returned 0x2 [0203.815] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0203.815] GetCurrentThreadId () returned 0x46c [0203.815] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0203.815] GetCurrentThreadId () returned 0x46c [0203.815] WbemLocator:IUnknown:QueryInterface (in: This=0x4fb470, riid=0x688f1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1dc | out: ppvObject=0x19f1dc*=0x4f94ac) returned 0x0 [0203.816] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x4f94ac, pProxy=0x4fb470, pAuthnSvc=0x19f1c8, pAuthzSvc=0x19f1cc, pServerPrincName=0x0, pAuthnLevel=0x19f1d8, pImpLevel=0x19f1d4, pAuthInfo=0x0, pCapabilites=0x19f1d0 | out: pAuthnSvc=0x19f1c8*=0xa, pAuthzSvc=0x19f1cc*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19f1d8*=0x6, pImpLevel=0x19f1d4*=0x3, pAuthInfo=0x0, pCapabilites=0x19f1d0*=0x20) returned 0x0 [0203.816] WbemLocator:IUnknown:Release (This=0x4f94ac) returned 0x2 [0203.816] ResolveDelayLoadedAPI () returned 0x75402060 [0203.864] CreatePointerMoniker (in: punk=0x4e0028, ppmk=0x19f3ac | out: ppmk=0x19f3ac*=0x4eaea0) returned 0x0 [0203.865] IUnknown:AddRef (This=0x4e0028) returned 0x2 [0203.933] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0203.933] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0203.933] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0203.933] WbemLocator:IUnknown:Release (This=0x4e9508) returned 0x0 [0203.933] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0203.933] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0203.935] WinMGMTS:IUnknown:Release (This=0x4e94f8) returned 0x0 [0203.937] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0203.956] IUnknown:QueryInterface (in: This=0x4eaea0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eed0 | out: ppvObject=0x19eed0*=0x4eaea0) returned 0x0 [0203.956] IUnknown:QueryInterface (in: This=0x4eaea0, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ee8c | out: ppvObject=0x19ee8c*=0x0) returned 0x80004002 [0203.957] IUnknown:QueryInterface (in: This=0x4eaea0, riid=0x6c29fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ecac | out: ppvObject=0x19ecac*=0x0) returned 0x80004002 [0203.957] IUnknown:QueryInterface (in: This=0x4eaea0, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19ea84 | out: ppvObject=0x19ea84*=0x0) returned 0x80004002 [0203.959] IUnknown:AddRef (This=0x4eaea0) returned 0x3 [0203.959] IUnknown:QueryInterface (in: This=0x4eaea0, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e7ec | out: ppvObject=0x19e7ec*=0x0) returned 0x80004002 [0203.959] IUnknown:QueryInterface (in: This=0x4eaea0, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e79c | out: ppvObject=0x19e79c*=0x0) returned 0x80004002 [0203.959] IUnknown:QueryInterface (in: This=0x4eaea0, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e7a8 | out: ppvObject=0x19e7a8*=0x4eaeb4) returned 0x0 [0203.960] IMarshal:GetUnmarshalClass (in: This=0x4eaeb4, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e7b0 | out: pCid=0x19e7b0*(Data1=0x306, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0203.960] IUnknown:Release (This=0x4eaeb4) returned 0x3 [0203.960] CoGetContextToken (in: pToken=0x19e808 | out: pToken=0x19e808) returned 0x0 [0203.960] CoGetContextToken (in: pToken=0x19ec10 | out: pToken=0x19ec10) returned 0x0 [0203.960] IUnknown:QueryInterface (in: This=0x4eaea0, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eca0 | out: ppvObject=0x19eca0*=0x0) returned 0x80004002 [0203.960] IUnknown:Release (This=0x4eaea0) returned 0x2 [0203.960] CoGetContextToken (in: pToken=0x19f1e0 | out: pToken=0x19f1e0) returned 0x0 [0203.961] CoGetContextToken (in: pToken=0x19f140 | out: pToken=0x19f140) returned 0x0 [0203.961] IUnknown:QueryInterface (in: This=0x4eaea0, riid=0x19f210*(Data1=0xf, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f20c | out: ppvObject=0x19f20c*=0x4eaea0) returned 0x0 [0203.961] IUnknown:AddRef (This=0x4eaea0) returned 0x4 [0203.961] IUnknown:Release (This=0x4eaea0) returned 0x3 [0203.961] IUnknown:Release (This=0x4e4f50) returned 0x2 [0203.961] IUnknown:Release (This=0x4eaea0) returned 0x2 [0203.967] CoGetContextToken (in: pToken=0x19f270 | out: pToken=0x19f270) returned 0x0 [0203.967] IUnknown:AddRef (This=0x4eaea0) returned 0x3 [0203.967] BindMoniker (in: pmk=0x4eaea0, grfOpt=0x0, iidResult=0x21ff038*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvResult=0x19f410 | out: ppvResult=0x19f410*=0x4e0028) returned 0x0 [0203.967] IUnknown:QueryInterface (in: This=0x4e0028, riid=0x21ff038*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f410 | out: ppvObject=0x19f410*=0x4e0028) returned 0x0 [0203.968] LoadRegTypeLib (in: rguid=0x688f2198*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x19ec6c*=0x0 | out: pptlib=0x19ec6c*=0x4fe588) returned 0x0 [0204.363] ITypeLib:GetTypeInfoOfGuid (in: This=0x4fe588, GUID=0x4e006c*(Data1=0x62e522dc, Data2=0x8cf3, Data3=0x40a8, Data4=([0]=0x8b, [1]=0x2e, [2]=0x37, [3]=0xd5, [4]=0x95, [5]=0x65, [6]=0x1e, [7]=0x40)), ppTInfo=0x4e0054 | out: ppTInfo=0x4e0054*=0x5000dc) returned 0x0 [0204.366] IUnknown:Release (This=0x4fe588) returned 0x1 [0204.408] CoGetContextToken (in: pToken=0x19e808 | out: pToken=0x19e808) returned 0x0 [0204.408] CoGetContextToken (in: pToken=0x19ec10 | out: pToken=0x19ec10) returned 0x0 [0204.409] IUnknown:Release (This=0x4eaea0) returned 0x2 [0204.859] CoGetContextToken (in: pToken=0x19eef0 | out: pToken=0x19eef0) returned 0x0 [0204.860] LoadRegTypeLib (in: rguid=0x688f2198*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x19eed8*=0x0 | out: pptlib=0x19eed8*=0x4fe588) returned 0x0 [0204.861] ITypeLib:GetTypeInfoOfGuid (in: This=0x4fe588, GUID=0x4e005c*(Data1=0xd2f68443, Data2=0x85dc, Data3=0x427e, Data4=([0]=0x91, [1]=0xd8, [2]=0x36, [3]=0x65, [4]=0x54, [5]=0xcc, [6]=0x75, [7]=0x4c)), ppTInfo=0x4e0050 | out: ppTInfo=0x4e0050*=0x500108) returned 0x0 [0204.861] IUnknown:Release (This=0x4fe588) returned 0x2 [0204.861] IUnknown:AddRef (This=0x500108) returned 0x2 [0204.861] DispGetIDsOfNames (in: ptinfo=0x500108, rgszNames=0x19ef60*="InstancesOf", cNames=0x1, rgdispid=0x19ef50 | out: rgdispid=0x19ef50*=5) returned 0x0 [0204.863] IUnknown:Release (This=0x500108) returned 0x1 [0204.865] IUnknown:AddRef (This=0x500108) returned 0x2 [0204.865] ITypeInfo:LocalInvoke (This=0x500108) returned 0x0 [0204.869] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0204.869] GetCurrentThreadId () returned 0x46c [0204.869] WbemLocator:IUnknown:AddRef (This=0x4fb470) returned 0x3 [0204.870] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0204.870] GetCurrentThreadId () returned 0x46c [0204.870] IWbemServices:CreateInstanceEnum (in: This=0x4fb470, strFilter="Win32_BaseBoard", lFlags=16, pCtx=0x0, ppEnum=0x19e764 | out: ppEnum=0x19e764*=0x503f60) returned 0x0 [0204.890] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4c7fd0 [0204.890] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4c8150 [0204.891] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4c7f10 [0204.891] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4f5540 [0204.891] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4f8280 [0204.891] IUnknown:QueryInterface (in: This=0x503f60, riid=0x688f1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e60c | out: ppvObject=0x19e60c*=0x503f64) returned 0x0 [0204.891] IClientSecurity:QueryBlanket (in: This=0x503f64, pProxy=0x503f60, pAuthnSvc=0x19e5f8, pAuthzSvc=0x19e600, pServerPrincName=0x0, pAuthnLevel=0x19e634, pImpLevel=0x19e638, pAuthInfo=0x0, pCapabilites=0x19e5fc | out: pAuthnSvc=0x19e5f8*=0xa, pAuthzSvc=0x19e600*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19e634*=0x6, pImpLevel=0x19e638*=0x2, pAuthInfo=0x0, pCapabilites=0x19e5fc*=0x1) returned 0x0 [0204.891] IUnknown:Release (This=0x503f64) returned 0x1 [0204.891] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0204.891] GetCurrentThreadId () returned 0x46c [0204.891] WbemLocator:IUnknown:QueryInterface (in: This=0x4fb470, riid=0x688f1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e5fc | out: ppvObject=0x19e5fc*=0x4f94ac) returned 0x0 [0204.891] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x4f94ac, pProxy=0x4fb470, pAuthnSvc=0x19e5e4, pAuthzSvc=0x19e5e8, pServerPrincName=0x0, pAuthnLevel=0x19e5f4, pImpLevel=0x19e5f8, pAuthInfo=0x0, pCapabilites=0x19e5ec | out: pAuthnSvc=0x19e5e4*=0xa, pAuthzSvc=0x19e5e8*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19e5f4*=0x6, pImpLevel=0x19e5f8*=0x3, pAuthInfo=0x0, pCapabilites=0x19e5ec*=0x20) returned 0x0 [0204.891] WbemLocator:IUnknown:Release (This=0x4f94ac) returned 0x3 [0204.892] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0204.892] GetCurrentThreadId () returned 0x46c [0204.892] WbemLocator:IUnknown:QueryInterface (in: This=0x4fb470, riid=0x688f1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e5fc | out: ppvObject=0x19e5fc*=0x4f94ac) returned 0x0 [0204.892] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x4f94ac, pProxy=0x4fb470, pAuthnSvc=0x19e5e4, pAuthzSvc=0x19e5e8, pServerPrincName=0x0, pAuthnLevel=0x19e5f8, pImpLevel=0x19e5f4, pAuthInfo=0x0, pCapabilites=0x19e5ec | out: pAuthnSvc=0x19e5e4*=0xa, pAuthzSvc=0x19e5e8*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19e5f8*=0x6, pImpLevel=0x19e5f4*=0x3, pAuthInfo=0x0, pCapabilites=0x19e5ec*=0x20) returned 0x0 [0204.892] WbemLocator:IUnknown:Release (This=0x4f94ac) returned 0x3 [0204.892] IUnknown:QueryInterface (in: This=0x503f60, riid=0x688f1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e62c | out: ppvObject=0x19e62c*=0x503f64) returned 0x0 [0204.894] IClientSecurity:CopyProxy (in: This=0x503f64, pProxy=0x503f60, ppCopy=0x19e630 | out: ppCopy=0x19e630*=0x506d00) returned 0x0 [0204.894] IUnknown:QueryInterface (in: This=0x506d00, riid=0x688f1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e584 | out: ppvObject=0x19e584*=0x506d04) returned 0x0 [0204.894] IClientSecurity:QueryBlanket (in: This=0x506d04, pProxy=0x506d00, pAuthnSvc=0x19e5b4, pAuthzSvc=0x19e5b0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x19e5b4*=0xa, pAuthzSvc=0x19e5b0*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0204.894] IUnknown:Release (This=0x506d04) returned 0x3 [0204.894] IUnknown:QueryInterface (in: This=0x506d00, riid=0x688f1f08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e568 | out: ppvObject=0x19e568*=0x4fe508) returned 0x0 [0204.894] IUnknown:QueryInterface (in: This=0x506d00, riid=0x688f1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e56c | out: ppvObject=0x19e56c*=0x506d04) returned 0x0 [0204.895] IClientSecurity:SetBlanket (This=0x506d04, pProxy=0x506d00, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0205.201] IUnknown:Release (This=0x506d04) returned 0x4 [0205.201] WbemLocator:IUnknown:Release (This=0x4fe508) returned 0x3 [0205.201] IUnknown:Release (This=0x503f64) returned 0x2 [0205.201] IUnknown:AddRef (This=0x506d00) returned 0x3 [0205.201] IUnknown:Release (This=0x503f60) returned 0x2 [0205.201] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x19e720 | out: pperrinfo=0x19e720*=0x0) returned 0x1 [0205.202] WbemLocator:IUnknown:Release (This=0x4fb470) returned 0x2 [0205.202] IUnknown:Release (This=0x500108) returned 0x1 [0205.203] LoadRegTypeLib (in: rguid=0x688f2198*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x19e734*=0x0 | out: pptlib=0x19e734*=0x4fe588) returned 0x0 [0205.282] ITypeLib:GetTypeInfoOfGuid (in: This=0x4fe588, GUID=0x4c8008*(Data1=0x4b83d61, Data2=0x21ae, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x33, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), ppTInfo=0x4c7ff0 | out: ppTInfo=0x4c7ff0*=0x500210) returned 0x0 [0205.282] IUnknown:Release (This=0x4fe588) returned 0x3 [0205.282] IUnknown:AddRef (This=0x500210) returned 0x2 [0205.282] ITypeInfo:RemoteGetTypeAttr (in: This=0x500210, ppTypeAttr=0x19e770, pDummy=0xdced17c9 | out: ppTypeAttr=0x19e770, pDummy=0xdced17c9) returned 0x0 [0205.283] ITypeInfo:LocalReleaseTypeAttr (This=0x500210) returned 0x0 [0205.283] IUnknown:Release (This=0x500210) returned 0x1 [0205.283] CoGetContextToken (in: pToken=0x19e2d0 | out: pToken=0x19e2d0) returned 0x0 [0205.283] CoGetContextToken (in: pToken=0x19e6d8 | out: pToken=0x19e6d8) returned 0x0 [0205.284] CoGetContextToken (in: pToken=0x19f2b0 | out: pToken=0x19f2b0) returned 0x0 [0205.284] CoGetContextToken (in: pToken=0x19f210 | out: pToken=0x19f210) returned 0x0 [0205.285] CoGetContextToken (in: pToken=0x19f230 | out: pToken=0x19f230) returned 0x0 [0205.285] LoadRegTypeLib (in: rguid=0x688f2198*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x400, pptlib=0x19f220*=0x0 | out: pptlib=0x19f220*=0x4fe588) returned 0x0 [0205.286] ITypeLib:GetTypeInfoOfGuid (in: This=0x4fe588, GUID=0x4c7ff8*(Data1=0x76a6415f, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), ppTInfo=0x4c7fec | out: ppTInfo=0x4c7fec*=0x5001b8) returned 0x0 [0205.286] IUnknown:Release (This=0x4fe588) returned 0x4 [0205.286] IUnknown:AddRef (This=0x5001b8) returned 0x2 [0205.286] ITypeInfo:LocalInvoke (This=0x5001b8) returned 0x0 [0205.286] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0205.286] GetCurrentThreadId () returned 0x46c [0205.286] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x504390 [0205.286] IUnknown:Release (This=0x5001b8) returned 0x1 [0205.286] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0205.735] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x4d9de8 [0205.753] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x4d9d60 [0205.854] CoGetContextToken (in: pToken=0x19ef60 | out: pToken=0x19ef60) returned 0x0 [0205.922] CoGetContextToken (in: pToken=0x19ea60 | out: pToken=0x19ea60) returned 0x0 [0205.922] IUnknown:AddRef (This=0x5001b8) returned 0x2 [0205.922] ITypeInfo:LocalInvoke (This=0x5001b8) returned 0x0 [0205.922] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0205.922] GetCurrentThreadId () returned 0x46c [0205.922] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0205.922] GetCurrentThreadId () returned 0x46c [0205.922] IUnknown:AddRef (This=0x506d00) returned 0x3 [0205.922] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0205.923] GetCurrentThreadId () returned 0x46c [0205.923] IEnumWbemClassObject:Clone (in: This=0x506d00, ppEnum=0x19ea90 | out: ppEnum=0x19ea90*=0x509568) returned 0x0 [0205.940] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5087e8 [0205.941] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x508848 [0205.941] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x508548 [0205.941] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4f57e0 [0205.941] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4f8840 [0205.941] IUnknown:QueryInterface (in: This=0x509568, riid=0x688f1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e93c | out: ppvObject=0x19e93c*=0x50956c) returned 0x0 [0205.941] IClientSecurity:QueryBlanket (in: This=0x50956c, pProxy=0x509568, pAuthnSvc=0x19e928, pAuthzSvc=0x19e930, pServerPrincName=0x0, pAuthnLevel=0x19e964, pImpLevel=0x19e968, pAuthInfo=0x0, pCapabilites=0x19e92c | out: pAuthnSvc=0x19e928*=0xa, pAuthzSvc=0x19e930*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19e964*=0x6, pImpLevel=0x19e968*=0x2, pAuthInfo=0x0, pCapabilites=0x19e92c*=0x1) returned 0x0 [0205.941] IUnknown:Release (This=0x50956c) returned 0x1 [0205.941] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0205.941] GetCurrentThreadId () returned 0x46c [0205.941] IUnknown:QueryInterface (in: This=0x506d00, riid=0x688f1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e92c | out: ppvObject=0x19e92c*=0x506d04) returned 0x0 [0205.941] IClientSecurity:QueryBlanket (in: This=0x506d04, pProxy=0x506d00, pAuthnSvc=0x19e914, pAuthzSvc=0x19e918, pServerPrincName=0x0, pAuthnLevel=0x19e924, pImpLevel=0x19e928, pAuthInfo=0x0, pCapabilites=0x19e91c | out: pAuthnSvc=0x19e914*=0xa, pAuthzSvc=0x19e918*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19e924*=0x6, pImpLevel=0x19e928*=0x3, pAuthInfo=0x0, pCapabilites=0x19e91c*=0x20) returned 0x0 [0205.941] IUnknown:Release (This=0x506d04) returned 0x3 [0205.942] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0205.942] GetCurrentThreadId () returned 0x46c [0205.942] IUnknown:QueryInterface (in: This=0x506d00, riid=0x688f1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e92c | out: ppvObject=0x19e92c*=0x506d04) returned 0x0 [0205.942] IClientSecurity:QueryBlanket (in: This=0x506d04, pProxy=0x506d00, pAuthnSvc=0x19e914, pAuthzSvc=0x19e918, pServerPrincName=0x0, pAuthnLevel=0x19e928, pImpLevel=0x19e924, pAuthInfo=0x0, pCapabilites=0x19e91c | out: pAuthnSvc=0x19e914*=0xa, pAuthzSvc=0x19e918*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19e928*=0x6, pImpLevel=0x19e924*=0x3, pAuthInfo=0x0, pCapabilites=0x19e91c*=0x20) returned 0x0 [0205.942] IUnknown:Release (This=0x506d04) returned 0x3 [0205.942] IUnknown:QueryInterface (in: This=0x509568, riid=0x688f1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e95c | out: ppvObject=0x19e95c*=0x50956c) returned 0x0 [0205.942] IClientSecurity:CopyProxy (in: This=0x50956c, pProxy=0x509568, ppCopy=0x19e960 | out: ppCopy=0x19e960*=0x509950) returned 0x0 [0205.942] IUnknown:QueryInterface (in: This=0x509950, riid=0x688f1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e8b4 | out: ppvObject=0x19e8b4*=0x509954) returned 0x0 [0205.942] IClientSecurity:QueryBlanket (in: This=0x509954, pProxy=0x509950, pAuthnSvc=0x19e8e4, pAuthzSvc=0x19e8e0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x19e8e4*=0xa, pAuthzSvc=0x19e8e0*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0205.942] IUnknown:Release (This=0x509954) returned 0x3 [0205.942] IUnknown:QueryInterface (in: This=0x509950, riid=0x688f1f08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e898 | out: ppvObject=0x19e898*=0x502488) returned 0x0 [0205.942] IUnknown:QueryInterface (in: This=0x509950, riid=0x688f1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e89c | out: ppvObject=0x19e89c*=0x509954) returned 0x0 [0205.942] IClientSecurity:SetBlanket (This=0x509954, pProxy=0x509950, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0205.946] IUnknown:Release (This=0x509954) returned 0x4 [0205.946] WbemLocator:IUnknown:Release (This=0x502488) returned 0x3 [0205.946] IUnknown:Release (This=0x50956c) returned 0x2 [0205.947] IUnknown:AddRef (This=0x509950) returned 0x3 [0205.947] IUnknown:Release (This=0x509568) returned 0x2 [0205.947] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x19ea50 | out: pperrinfo=0x19ea50*=0x0) returned 0x1 [0205.947] IUnknown:Release (This=0x506d00) returned 0x2 [0205.947] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0205.947] GetCurrentThreadId () returned 0x46c [0205.947] IUnknown:AddRef (This=0x509950) returned 0x3 [0205.947] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0205.947] GetCurrentThreadId () returned 0x46c [0205.947] IEnumWbemClassObject:Reset (This=0x509950) returned 0x0 [0205.949] IUnknown:Release (This=0x509950) returned 0x2 [0205.949] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x504270 [0205.949] IUnknown:Release (This=0x5001b8) returned 0x1 [0205.980] CoGetContextToken (in: pToken=0x19e248 | out: pToken=0x19e248) returned 0x0 [0205.980] CoGetContextToken (in: pToken=0x19e650 | out: pToken=0x19e650) returned 0x0 [0206.019] CoGetContextToken (in: pToken=0x19f048 | out: pToken=0x19f048) returned 0x0 [0206.019] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0206.019] GetCurrentThreadId () returned 0x46c [0206.019] IUnknown:AddRef (This=0x509950) returned 0x3 [0206.020] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0206.020] GetCurrentThreadId () returned 0x46c [0206.020] IEnumWbemClassObject:Next (in: This=0x509950, lTimeout=-1, uCount=0x1, apObjects=0x19f3bc, puReturned=0x19f39c | out: apObjects=0x19f3bc*=0x4e8388, puReturned=0x19f39c*=0x1) returned 0x0 [0206.025] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4fa2a0 [0206.025] IUnknown:AddRef (This=0x4e8388) returned 0x2 [0206.025] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4e06b8 [0206.025] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x508668 [0206.025] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x507d08 [0206.025] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4f5880 [0206.025] WbemLocator:IUnknown:AddRef (This=0x4fb470) returned 0x3 [0206.025] IUnknown:AddRef (This=0x509950) returned 0x4 [0206.025] IUnknown:QueryInterface (in: This=0x509950, riid=0x688f1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f3e8 | out: ppvObject=0x19f3e8*=0x509954) returned 0x0 [0206.025] IClientSecurity:QueryBlanket (in: This=0x509954, pProxy=0x509950, pAuthnSvc=0x19f36c, pAuthzSvc=0x19f374, pServerPrincName=0x0, pAuthnLevel=0x19f398, pImpLevel=0x19f3a4, pAuthInfo=0x0, pCapabilites=0x19f368 | out: pAuthnSvc=0x19f36c*=0xa, pAuthzSvc=0x19f374*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19f398*=0x6, pImpLevel=0x19f3a4*=0x3, pAuthInfo=0x0, pCapabilites=0x19f368*=0x20) returned 0x0 [0206.025] IUnknown:Release (This=0x509954) returned 0x4 [0206.025] WbemLocator:IUnknown:Release (This=0x4fb470) returned 0x2 [0206.025] WbemLocator:IUnknown:AddRef (This=0x4fb470) returned 0x3 [0206.025] IUnknown:Release (This=0x509950) returned 0x3 [0206.025] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0206.025] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x506800 [0206.025] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4f58c0 [0206.025] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4eb490 [0206.025] IUnknown:AddRef (This=0x4e8388) returned 0x3 [0206.025] IUnknown:Release (This=0x4e8388) returned 0x2 [0206.026] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x19f334 | out: pperrinfo=0x19f334*=0x0) returned 0x1 [0206.026] IUnknown:Release (This=0x509950) returned 0x2 [0206.026] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x19f3ec | out: pperrinfo=0x19f3ec*=0x0) returned 0x1 [0206.027] LoadRegTypeLib (in: rguid=0x688f2198*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x19eb94*=0x0 | out: pptlib=0x19eb94*=0x4fe588) returned 0x0 [0206.028] ITypeLib:GetTypeInfoOfGuid (in: This=0x4fe588, GUID=0x688f4c08*(Data1=0xd6bdafb2, Data2=0x9435, Data3=0x491f, Data4=([0]=0xbb, [1]=0x87, [2]=0x6a, [3]=0xa0, [4]=0xf0, [5]=0xbc, [6]=0x31, [7]=0xa2)), ppTInfo=0x50681c | out: ppTInfo=0x50681c*=0x50023c) returned 0x0 [0206.028] IUnknown:Release (This=0x4fe588) returned 0x5 [0206.028] IUnknown:AddRef (This=0x50023c) returned 0x2 [0206.028] ITypeInfo:RemoteGetTypeAttr (in: This=0x50023c, ppTypeAttr=0x19ebd0, pDummy=0xdced1ba9 | out: ppTypeAttr=0x19ebd0, pDummy=0xdced1ba9) returned 0x0 [0206.029] ITypeInfo:LocalReleaseTypeAttr (This=0x50023c) returned 0x0 [0206.029] IUnknown:Release (This=0x50023c) returned 0x1 [0206.030] CoGetContextToken (in: pToken=0x19e730 | out: pToken=0x19e730) returned 0x0 [0206.030] CoGetContextToken (in: pToken=0x19eb38 | out: pToken=0x19eb38) returned 0x0 [0206.034] CoGetContextToken (in: pToken=0x19ef00 | out: pToken=0x19ef00) returned 0x0 [0206.034] LoadRegTypeLib (in: rguid=0x688f2198*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x19eee8*=0x0 | out: pptlib=0x19eee8*=0x4fe588) returned 0x0 [0206.035] ITypeLib:GetTypeInfoOfGuid (in: This=0x4fe588, GUID=0x688f1e68*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x506818 | out: ppTInfo=0x506818*=0x500268) returned 0x0 [0206.035] IUnknown:Release (This=0x4fe588) returned 0x6 [0206.035] IUnknown:AddRef (This=0x500268) returned 0x2 [0206.036] DispGetIDsOfNames (in: ptinfo=0x500268, rgszNames=0x19ef70*="SerialNumber", cNames=0x1, rgdispid=0x19ef60 | out: rgdispid=0x19ef60*=-1) returned 0x80020006 [0206.065] IUnknown:AddRef (This=0x4e8388) returned 0x3 [0206.065] IWbemClassObject:Get (in: This=0x4e8388, wszName="SerialNumber", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x19eeb8*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x19eeb8*=0) returned 0x0 [0206.065] IUnknown:Release (This=0x4e8388) returned 0x2 [0206.065] SysStringLen (param_1="SerialNumber") returned 0xc [0206.065] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x510940 [0206.065] SysStringLen (param_1="SerialNumber") returned 0xc [0206.065] IUnknown:Release (This=0x500268) returned 0x1 [0206.066] IUnknown:AddRef (This=0x500268) returned 0x2 [0206.066] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0206.066] GetCurrentThreadId () returned 0x46c [0206.066] SysStringLen (param_1="SerialNumber") returned 0xc [0206.066] IWbemClassObject:Get (in: This=0x4e8388, wszName="SerialNumber", lFlags=0, pVal=0x19ed00*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19ecf8*=0, plFlavor=0x0 | out: pVal=0x19ed00*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="..XXXXXXXXXXXXX.", varVal2=0x0), pType=0x19ecf8*=8, plFlavor=0x0) returned 0x0 [0206.067] IUnknown:Release (This=0x500268) returned 0x1 [0206.068] SysStringByteLen (bstr="..XXXXXXXXXXXXX.") returned 0x20 [0206.068] SysStringByteLen (bstr="..XXXXXXXXXXXXX.") returned 0x20 [0206.247] CoGetContextToken (in: pToken=0x19f048 | out: pToken=0x19f048) returned 0x0 [0206.247] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0206.247] GetCurrentThreadId () returned 0x46c [0206.247] IUnknown:AddRef (This=0x509950) returned 0x3 [0206.247] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0206.247] GetCurrentThreadId () returned 0x46c [0206.248] IEnumWbemClassObject:Next (in: This=0x509950, lTimeout=-1, uCount=0x1, apObjects=0x19f3bc, puReturned=0x19f39c | out: apObjects=0x19f3bc*=0x0, puReturned=0x19f39c*=0x0) returned 0x1 [0206.250] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x19f334 | out: pperrinfo=0x19f334*=0x0) returned 0x1 [0206.251] IUnknown:Release (This=0x509950) returned 0x2 [0206.251] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x19f3ec | out: pperrinfo=0x19f3ec*=0x0) returned 0x1 [0206.425] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3b8 [0206.426] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3c8 [0206.442] SetEvent (hEvent=0x3c8) returned 1 [0206.448] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f3c4*=0x3b8, lpdwindex=0x19f1e4 | out: lpdwindex=0x19f1e4) returned 0x0 [0206.475] CoGetContextToken (in: pToken=0x19f290 | out: pToken=0x19f290) returned 0x0 [0206.475] CoGetContextToken (in: pToken=0x19f1f0 | out: pToken=0x19f1f0) returned 0x0 [0206.475] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0108, riid=0x19f2c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f2bc | out: ppvObject=0x19f2bc*=0x4e0108) returned 0x0 [0206.476] WbemDefPath:IUnknown:AddRef (This=0x4e0108) returned 0x3 [0206.476] WbemDefPath:IUnknown:Release (This=0x4e0108) returned 0x2 [0206.479] WbemDefPath:IWbemPath:SetText (This=0x4e0108, uMode=0x4, pszPath="win32_processor") returned 0x0 [0206.487] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0108, puCount=0x19f444 | out: puCount=0x19f444*=0x0) returned 0x0 [0206.488] WbemDefPath:IWbemPath:GetText (in: This=0x4e0108, lFlags=2, puBuffLength=0x19f440*=0x0, pszText=0x0 | out: puBuffLength=0x19f440*=0x10, pszText=0x0) returned 0x0 [0206.488] WbemDefPath:IWbemPath:GetText (in: This=0x4e0108, lFlags=2, puBuffLength=0x19f440*=0x10, pszText="000000000000000" | out: puBuffLength=0x19f440*=0x10, pszText="win32_processor") returned 0x0 [0206.488] WbemDefPath:IWbemPath:GetInfo (in: This=0x4e0108, uRequestedInfo=0x0, puResponse=0x19f44c | out: puResponse=0x19f44c*=0xc15) returned 0x0 [0206.488] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0108, puCount=0x19f444 | out: puCount=0x19f444*=0x0) returned 0x0 [0206.488] WbemDefPath:IWbemPath:GetInfo (in: This=0x4e0108, uRequestedInfo=0x0, puResponse=0x19f44c | out: puResponse=0x19f44c*=0xc15) returned 0x0 [0206.489] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0108, puCount=0x19f434 | out: puCount=0x19f434*=0x0) returned 0x0 [0206.489] WbemDefPath:IWbemPath:GetText (in: This=0x4e0108, lFlags=2, puBuffLength=0x19f430*=0x0, pszText=0x0 | out: puBuffLength=0x19f430*=0x10, pszText=0x0) returned 0x0 [0206.489] WbemDefPath:IWbemPath:GetText (in: This=0x4e0108, lFlags=2, puBuffLength=0x19f430*=0x10, pszText="000000000000000" | out: puBuffLength=0x19f430*=0x10, pszText="win32_processor") returned 0x0 [0206.489] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0108, puCount=0x19f434 | out: puCount=0x19f434*=0x0) returned 0x0 [0206.489] WbemDefPath:IWbemPath:GetText (in: This=0x4e0108, lFlags=2, puBuffLength=0x19f430*=0x0, pszText=0x0 | out: puBuffLength=0x19f430*=0x10, pszText=0x0) returned 0x0 [0206.489] WbemDefPath:IWbemPath:GetText (in: This=0x4e0108, lFlags=2, puBuffLength=0x19f430*=0x10, pszText="000000000000000" | out: puBuffLength=0x19f430*=0x10, pszText="win32_processor") returned 0x0 [0206.490] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0108, puCount=0x19f3c4 | out: puCount=0x19f3c4*=0x0) returned 0x0 [0206.491] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3f0 [0206.491] SetEvent (hEvent=0x3c8) returned 1 [0206.491] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19ec24*=0x3f0, lpdwindex=0x19ea44 | out: lpdwindex=0x19ea44) returned 0x0 [0206.494] CoGetContextToken (in: pToken=0x19eaf0 | out: pToken=0x19eaf0) returned 0x0 [0206.494] CoGetContextToken (in: pToken=0x19ea50 | out: pToken=0x19ea50) returned 0x0 [0206.494] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0568, riid=0x19eb20*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19eb1c | out: ppvObject=0x19eb1c*=0x4e0568) returned 0x0 [0206.495] WbemDefPath:IUnknown:AddRef (This=0x4e0568) returned 0x3 [0206.495] WbemDefPath:IUnknown:Release (This=0x4e0568) returned 0x2 [0206.495] WbemDefPath:IWbemPath:SetText (This=0x4e0568, uMode=0x4, pszPath="//./root/cimv2") returned 0x0 [0206.495] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0568, puCount=0x19f3b0 | out: puCount=0x19f3b0*=0x2) returned 0x0 [0206.495] WbemDefPath:IWbemPath:GetText (in: This=0x4e0568, lFlags=4, puBuffLength=0x19f3ac*=0x0, pszText=0x0 | out: puBuffLength=0x19f3ac*=0xf, pszText=0x0) returned 0x0 [0206.495] WbemDefPath:IWbemPath:GetText (in: This=0x4e0568, lFlags=4, puBuffLength=0x19f3ac*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3ac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0206.495] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3f4 [0206.495] SetEvent (hEvent=0x3c8) returned 1 [0206.495] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f30c*=0x3f4, lpdwindex=0x19f12c | out: lpdwindex=0x19f12c) returned 0x0 [0206.498] CoGetContextToken (in: pToken=0x19f1d8 | out: pToken=0x19f1d8) returned 0x0 [0206.498] CoGetContextToken (in: pToken=0x19f138 | out: pToken=0x19f138) returned 0x0 [0206.498] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0728, riid=0x19f208*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x4e0728) returned 0x0 [0206.498] WbemDefPath:IUnknown:AddRef (This=0x4e0728) returned 0x3 [0206.498] WbemDefPath:IUnknown:Release (This=0x4e0728) returned 0x2 [0206.498] WbemDefPath:IWbemPath:SetText (This=0x4e0728, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0206.498] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0728, puCount=0x19f388 | out: puCount=0x19f388*=0x2) returned 0x0 [0206.498] WbemDefPath:IWbemPath:GetText (in: This=0x4e0728, lFlags=4, puBuffLength=0x19f384*=0x0, pszText=0x0 | out: puBuffLength=0x19f384*=0xf, pszText=0x0) returned 0x0 [0206.498] WbemDefPath:IWbemPath:GetText (in: This=0x4e0728, lFlags=4, puBuffLength=0x19f384*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f384*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0206.518] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f2a8*=0x40c, lpdwindex=0x19f15c | out: lpdwindex=0x19f15c) returned 0x0 [0207.726] CoGetContextToken (in: pToken=0x19f0a0 | out: pToken=0x19f0a0) returned 0x0 [0207.726] CoGetContextToken (in: pToken=0x19f048 | out: pToken=0x19f048) returned 0x0 [0207.726] IUnknown:QueryInterface (in: This=0x4c0110, riid=0x6c218724*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f028 | out: ppvObject=0x19f028*=0x4c0120) returned 0x0 [0207.727] CObjectContext::ContextCallback () returned 0x0 [0207.747] IUnknown:Release (This=0x4c0120) returned 0x1 [0207.748] CoUnmarshalInterface (in: pStm=0x4f5660, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f090 | out: ppv=0x19f090*=0x502688) returned 0x0 [0207.748] CoMarshalInterface (pStm=0x4f5660, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x502688, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0207.749] WbemLocator:IUnknown:QueryInterface (in: This=0x502688, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ef34 | out: ppvObject=0x19ef34*=0x502688) returned 0x0 [0207.749] WbemLocator:IUnknown:QueryInterface (in: This=0x502688, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19eef0 | out: ppvObject=0x19eef0*=0x0) returned 0x80004002 [0207.751] WbemLocator:IUnknown:QueryInterface (in: This=0x502688, riid=0x6c29fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed0c | out: ppvObject=0x19ed0c*=0x0) returned 0x80004002 [0207.752] WbemLocator:IUnknown:QueryInterface (in: This=0x502688, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19eae4 | out: ppvObject=0x19eae4*=0x0) returned 0x80004002 [0207.753] WbemLocator:IUnknown:AddRef (This=0x502688) returned 0x3 [0207.753] WbemLocator:IUnknown:QueryInterface (in: This=0x502688, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e84c | out: ppvObject=0x19e84c*=0x0) returned 0x80004002 [0207.753] WbemLocator:IUnknown:QueryInterface (in: This=0x502688, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0207.753] WbemLocator:IUnknown:QueryInterface (in: This=0x502688, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e808 | out: ppvObject=0x19e808*=0x5025e4) returned 0x0 [0207.754] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5025e4, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e810 | out: pCid=0x19e810*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0207.754] WbemLocator:IUnknown:Release (This=0x5025e4) returned 0x3 [0207.754] CoGetContextToken (in: pToken=0x19e868 | out: pToken=0x19e868) returned 0x0 [0207.754] CoGetContextToken (in: pToken=0x19ec70 | out: pToken=0x19ec70) returned 0x0 [0207.754] WbemLocator:IUnknown:QueryInterface (in: This=0x502688, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed00 | out: ppvObject=0x19ed00*=0x50266c) returned 0x0 [0207.754] WbemLocator:IRpcOptions:Query (in: This=0x50266c, pPrx=0x502688, dwProperty=2, pdwValue=0x19ed28 | out: pdwValue=0x19ed28) returned 0x0 [0207.754] WbemLocator:IUnknown:Release (This=0x50266c) returned 0x3 [0207.754] WbemLocator:IUnknown:Release (This=0x502688) returned 0x2 [0207.755] WbemLocator:IUnknown:Release (This=0x502688) returned 0x1 [0207.755] CoGetContextToken (in: pToken=0x19efe0 | out: pToken=0x19efe0) returned 0x0 [0207.755] WbemLocator:IUnknown:AddRef (This=0x502688) returned 0x2 [0207.755] WbemLocator:IUnknown:QueryInterface (in: This=0x502688, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x502664) returned 0x0 [0207.755] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x502664, pProxy=0x502688, pAuthnSvc=0x19f2ec, pAuthzSvc=0x19f2e8, pServerPrincName=0x19f2e0, pAuthnLevel=0x19f2e4, pImpLevel=0x19f2d4, pAuthInfo=0x19f2d8, pCapabilites=0x19f2dc | out: pAuthnSvc=0x19f2ec*=0xa, pAuthzSvc=0x19f2e8*=0x0, pServerPrincName=0x19f2e0, pAuthnLevel=0x19f2e4*=0x6, pImpLevel=0x19f2d4*=0x2, pAuthInfo=0x19f2d8, pCapabilites=0x19f2dc*=0x1) returned 0x0 [0207.755] WbemLocator:IUnknown:Release (This=0x502664) returned 0x2 [0207.755] WbemLocator:IUnknown:QueryInterface (in: This=0x502688, riid=0x6c8110f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f290 | out: ppvObject=0x19f290*=0x502688) returned 0x0 [0207.755] WbemLocator:IUnknown:QueryInterface (in: This=0x502688, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f28c | out: ppvObject=0x19f28c*=0x502664) returned 0x0 [0207.756] WbemLocator:IClientSecurity:SetBlanket (This=0x502664, pProxy=0x502688, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0207.756] WbemLocator:IUnknown:Release (This=0x502664) returned 0x3 [0207.756] WbemLocator:IUnknown:Release (This=0x502688) returned 0x2 [0207.756] CoTaskMemFree (pv=0x503b20) [0207.756] WbemLocator:IUnknown:Release (This=0x502688) returned 0x1 [0207.756] SysStringLen (param_1=0x0) returned 0x0 [0207.756] CoGetContextToken (in: pToken=0x19f258 | out: pToken=0x19f258) returned 0x0 [0207.756] CoGetContextToken (in: pToken=0x19f1b8 | out: pToken=0x19f1b8) returned 0x0 [0207.756] WbemLocator:IUnknown:QueryInterface (in: This=0x502688, riid=0x19f288*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19f284 | out: ppvObject=0x19f284*=0x4fb920) returned 0x0 [0207.757] WbemLocator:IUnknown:AddRef (This=0x4fb920) returned 0x3 [0207.758] WbemLocator:IUnknown:Release (This=0x4fb920) returned 0x2 [0207.758] CoGetContextToken (in: pToken=0x19f218 | out: pToken=0x19f218) returned 0x0 [0207.758] WbemLocator:IUnknown:AddRef (This=0x4fb920) returned 0x3 [0207.758] WbemLocator:IUnknown:QueryInterface (in: This=0x4fb920, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x502664) returned 0x0 [0207.758] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x502664, pProxy=0x4fb920, pAuthnSvc=0x19f2ec, pAuthzSvc=0x19f2e8, pServerPrincName=0x19f2e0, pAuthnLevel=0x19f2e4, pImpLevel=0x19f2d4, pAuthInfo=0x19f2d8, pCapabilites=0x19f2dc | out: pAuthnSvc=0x19f2ec*=0xa, pAuthzSvc=0x19f2e8*=0x0, pServerPrincName=0x19f2e0, pAuthnLevel=0x19f2e4*=0x6, pImpLevel=0x19f2d4*=0x2, pAuthInfo=0x19f2d8, pCapabilites=0x19f2dc*=0x1) returned 0x0 [0207.758] WbemLocator:IUnknown:Release (This=0x502664) returned 0x3 [0207.758] WbemLocator:IUnknown:QueryInterface (in: This=0x4fb920, riid=0x6c8110f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f290 | out: ppvObject=0x19f290*=0x502688) returned 0x0 [0207.758] WbemLocator:IUnknown:QueryInterface (in: This=0x4fb920, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f28c | out: ppvObject=0x19f28c*=0x502664) returned 0x0 [0207.758] WbemLocator:IClientSecurity:SetBlanket (This=0x502664, pProxy=0x4fb920, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0207.759] WbemLocator:IUnknown:Release (This=0x502664) returned 0x4 [0207.759] WbemLocator:IUnknown:Release (This=0x502688) returned 0x3 [0207.759] CoTaskMemFree (pv=0x503af0) [0207.759] WbemLocator:IUnknown:Release (This=0x4fb920) returned 0x2 [0207.759] SysStringLen (param_1=0x0) returned 0x0 [0207.760] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0728, puCount=0x19f3ac | out: puCount=0x19f3ac*=0x2) returned 0x0 [0207.760] WbemDefPath:IWbemPath:GetText (in: This=0x4e0728, lFlags=4, puBuffLength=0x19f3a8*=0x0, pszText=0x0 | out: puBuffLength=0x19f3a8*=0xf, pszText=0x0) returned 0x0 [0207.760] WbemDefPath:IWbemPath:GetText (in: This=0x4e0728, lFlags=4, puBuffLength=0x19f3a8*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3a8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0207.760] CoGetContextToken (in: pToken=0x19f018 | out: pToken=0x19f018) returned 0x0 [0207.760] CoUnmarshalInterface (in: pStm=0x4f5660, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f008 | out: ppv=0x19f008*=0x502688) returned 0x0 [0207.760] CoMarshalInterface (pStm=0x4f5660, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x502688, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0207.761] WbemLocator:IUnknown:QueryInterface (in: This=0x502688, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eeac | out: ppvObject=0x19eeac*=0x502688) returned 0x0 [0207.761] WbemLocator:IUnknown:Release (This=0x502688) returned 0x3 [0207.761] WbemLocator:IUnknown:Release (This=0x502688) returned 0x2 [0207.761] CoGetContextToken (in: pToken=0x19ef58 | out: pToken=0x19ef58) returned 0x0 [0207.761] WbemLocator:IUnknown:AddRef (This=0x502688) returned 0x3 [0207.761] WbemLocator:IUnknown:QueryInterface (in: This=0x502688, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f214 | out: ppvObject=0x19f214*=0x502664) returned 0x0 [0207.761] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x502664, pProxy=0x502688, pAuthnSvc=0x19f264, pAuthzSvc=0x19f260, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c, pImpLevel=0x19f24c, pAuthInfo=0x19f250, pCapabilites=0x19f254 | out: pAuthnSvc=0x19f264*=0xa, pAuthzSvc=0x19f260*=0x0, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c*=0x6, pImpLevel=0x19f24c*=0x3, pAuthInfo=0x19f250, pCapabilites=0x19f254*=0x20) returned 0x0 [0207.761] WbemLocator:IUnknown:Release (This=0x502664) returned 0x3 [0207.762] WbemLocator:IUnknown:QueryInterface (in: This=0x502688, riid=0x6c8110f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f208 | out: ppvObject=0x19f208*=0x502688) returned 0x0 [0207.762] WbemLocator:IUnknown:QueryInterface (in: This=0x502688, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x502664) returned 0x0 [0207.762] WbemLocator:IClientSecurity:SetBlanket (This=0x502664, pProxy=0x502688, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0207.762] WbemLocator:IUnknown:Release (This=0x502664) returned 0x4 [0207.763] WbemLocator:IUnknown:Release (This=0x502688) returned 0x3 [0207.763] WbemLocator:IUnknown:Release (This=0x502688) returned 0x2 [0207.763] SysStringLen (param_1=0x0) returned 0x0 [0207.763] CoGetContextToken (in: pToken=0x19f1d0 | out: pToken=0x19f1d0) returned 0x0 [0207.763] WbemLocator:IUnknown:AddRef (This=0x4fb920) returned 0x3 [0207.763] WbemLocator:IUnknown:Release (This=0x4fb920) returned 0x2 [0207.763] CoGetContextToken (in: pToken=0x19f190 | out: pToken=0x19f190) returned 0x0 [0207.763] WbemLocator:IUnknown:AddRef (This=0x4fb920) returned 0x3 [0207.763] WbemLocator:IUnknown:QueryInterface (in: This=0x4fb920, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f214 | out: ppvObject=0x19f214*=0x502664) returned 0x0 [0207.763] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x502664, pProxy=0x4fb920, pAuthnSvc=0x19f264, pAuthzSvc=0x19f260, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c, pImpLevel=0x19f24c, pAuthInfo=0x19f250, pCapabilites=0x19f254 | out: pAuthnSvc=0x19f264*=0xa, pAuthzSvc=0x19f260*=0x0, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c*=0x6, pImpLevel=0x19f24c*=0x3, pAuthInfo=0x19f250, pCapabilites=0x19f254*=0x20) returned 0x0 [0207.763] WbemLocator:IUnknown:Release (This=0x502664) returned 0x3 [0207.764] WbemLocator:IUnknown:QueryInterface (in: This=0x4fb920, riid=0x6c8110f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f208 | out: ppvObject=0x19f208*=0x502688) returned 0x0 [0207.764] WbemLocator:IUnknown:QueryInterface (in: This=0x4fb920, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x502664) returned 0x0 [0207.764] WbemLocator:IClientSecurity:SetBlanket (This=0x502664, pProxy=0x4fb920, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0207.764] WbemLocator:IUnknown:Release (This=0x502664) returned 0x4 [0207.764] WbemLocator:IUnknown:Release (This=0x502688) returned 0x3 [0207.764] WbemLocator:IUnknown:Release (This=0x4fb920) returned 0x2 [0207.764] SysStringLen (param_1=0x0) returned 0x0 [0207.764] WbemDefPath:IWbemPath:GetText (in: This=0x4e0108, lFlags=2, puBuffLength=0x19f3b0*=0x0, pszText=0x0 | out: puBuffLength=0x19f3b0*=0x10, pszText=0x0) returned 0x0 [0207.764] WbemDefPath:IWbemPath:GetText (in: This=0x4e0108, lFlags=2, puBuffLength=0x19f3b0*=0x10, pszText="000000000000000" | out: puBuffLength=0x19f3b0*=0x10, pszText="win32_processor") returned 0x0 [0207.781] IWbemServices:GetObject (in: This=0x4fb920, strObjectPath="win32_processor", lFlags=0, pCtx=0x0, ppObject=0x19f364*=0x0, ppCallResult=0x0 | out: ppObject=0x19f364*=0x521088, ppCallResult=0x0) returned 0x0 [0207.840] IWbemClassObject:Get (in: This=0x521088, wszName="__PATH", lFlags=0, pVal=0x19f34c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f3f4*=0, plFlavor=0x19f3f0*=0 | out: pVal=0x19f34c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_Processor", varVal2=0x0), pType=0x19f3f4*=8, plFlavor=0x19f3f0*=64) returned 0x0 [0207.851] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_Processor") returned 0x46 [0207.851] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_Processor") returned 0x46 [0207.852] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x444 [0207.852] SetEvent (hEvent=0x3c8) returned 1 [0207.852] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f308*=0x444, lpdwindex=0x19f124 | out: lpdwindex=0x19f124) returned 0x0 [0207.857] CoGetContextToken (in: pToken=0x19f1d8 | out: pToken=0x19f1d8) returned 0x0 [0207.857] CoGetContextToken (in: pToken=0x19f138 | out: pToken=0x19f138) returned 0x0 [0207.857] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e01e8, riid=0x19f208*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x4e01e8) returned 0x0 [0207.858] WbemDefPath:IUnknown:AddRef (This=0x4e01e8) returned 0x3 [0207.858] WbemDefPath:IUnknown:Release (This=0x4e01e8) returned 0x2 [0207.858] WbemDefPath:IWbemPath:SetText (This=0x4e01e8, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_Processor") returned 0x0 [0207.858] IWbemClassObject:Get (in: This=0x521088, wszName="__CLASS", lFlags=0, pVal=0x19f3bc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f43c*=0, plFlavor=0x19f438*=0 | out: pVal=0x19f3bc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Processor", varVal2=0x0), pType=0x19f43c*=8, plFlavor=0x19f438*=64) returned 0x0 [0207.858] SysStringByteLen (bstr="Win32_Processor") returned 0x1e [0207.858] SysStringByteLen (bstr="Win32_Processor") returned 0x1e [0207.858] CoGetContextToken (in: pToken=0x19f1d8 | out: pToken=0x19f1d8) returned 0x0 [0207.858] WbemLocator:IUnknown:AddRef (This=0x4fb920) returned 0x3 [0207.858] IWbemServices:CreateInstanceEnum (in: This=0x4fb920, strFilter="Win32_Processor", lFlags=17, pCtx=0x0, ppEnum=0x19f3b8 | out: ppEnum=0x19f3b8*=0x5096f8) returned 0x0 [0207.919] IUnknown:QueryInterface (in: This=0x5096f8, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f24c | out: ppvObject=0x19f24c*=0x5096fc) returned 0x0 [0207.920] IClientSecurity:QueryBlanket (in: This=0x5096fc, pProxy=0x5096f8, pAuthnSvc=0x19f29c, pAuthzSvc=0x19f298, pServerPrincName=0x19f290, pAuthnLevel=0x19f294, pImpLevel=0x19f284, pAuthInfo=0x19f288, pCapabilites=0x19f28c | out: pAuthnSvc=0x19f29c*=0xa, pAuthzSvc=0x19f298*=0x0, pServerPrincName=0x19f290, pAuthnLevel=0x19f294*=0x6, pImpLevel=0x19f284*=0x2, pAuthInfo=0x19f288, pCapabilites=0x19f28c*=0x1) returned 0x0 [0207.920] IUnknown:Release (This=0x5096fc) returned 0x1 [0207.920] IUnknown:QueryInterface (in: This=0x5096f8, riid=0x6c8110f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f240 | out: ppvObject=0x19f240*=0x502088) returned 0x0 [0207.920] IUnknown:QueryInterface (in: This=0x5096f8, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f23c | out: ppvObject=0x19f23c*=0x5096fc) returned 0x0 [0207.920] IClientSecurity:SetBlanket (This=0x5096fc, pProxy=0x5096f8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0208.045] IUnknown:Release (This=0x5096fc) returned 0x2 [0208.045] WbemLocator:IUnknown:Release (This=0x502088) returned 0x1 [0208.045] CoTaskMemFree (pv=0x503970) [0208.045] IUnknown:QueryInterface (in: This=0x5096f8, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee34 | out: ppvObject=0x19ee34*=0x502088) returned 0x0 [0208.046] WbemLocator:IUnknown:QueryInterface (in: This=0x502088, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19edf0 | out: ppvObject=0x19edf0*=0x0) returned 0x80004002 [0208.095] WbemLocator:IUnknown:QueryInterface (in: This=0x502088, riid=0x6c29fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ec0c | out: ppvObject=0x19ec0c*=0x0) returned 0x80004002 [0208.140] IUnknown:QueryInterface (in: This=0x5096f8, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e9e4 | out: ppvObject=0x19e9e4*=0x0) returned 0x80004002 [0208.184] WbemLocator:IUnknown:AddRef (This=0x502088) returned 0x3 [0208.184] WbemLocator:IUnknown:QueryInterface (in: This=0x502088, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e74c | out: ppvObject=0x19e74c*=0x0) returned 0x80004002 [0208.184] WbemLocator:IUnknown:QueryInterface (in: This=0x502088, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e6fc | out: ppvObject=0x19e6fc*=0x0) returned 0x80004002 [0208.184] WbemLocator:IUnknown:QueryInterface (in: This=0x502088, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e708 | out: ppvObject=0x19e708*=0x501fe4) returned 0x0 [0208.184] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x501fe4, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e710 | out: pCid=0x19e710*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0208.184] WbemLocator:IUnknown:Release (This=0x501fe4) returned 0x3 [0208.185] CoGetContextToken (in: pToken=0x19e768 | out: pToken=0x19e768) returned 0x0 [0208.185] CoGetContextToken (in: pToken=0x19eb70 | out: pToken=0x19eb70) returned 0x0 [0208.185] WbemLocator:IUnknown:QueryInterface (in: This=0x502088, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec00 | out: ppvObject=0x19ec00*=0x50206c) returned 0x0 [0208.185] WbemLocator:IRpcOptions:Query (in: This=0x50206c, pPrx=0x502088, dwProperty=2, pdwValue=0x19ec28 | out: pdwValue=0x19ec28) returned 0x80004002 [0208.185] WbemLocator:IUnknown:Release (This=0x50206c) returned 0x3 [0208.185] WbemLocator:IUnknown:Release (This=0x502088) returned 0x2 [0208.185] CoGetContextToken (in: pToken=0x19f148 | out: pToken=0x19f148) returned 0x0 [0208.185] CoGetContextToken (in: pToken=0x19f0a8 | out: pToken=0x19f0a8) returned 0x0 [0208.185] WbemLocator:IUnknown:QueryInterface (in: This=0x502088, riid=0x19f178*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f174 | out: ppvObject=0x19f174*=0x5096f8) returned 0x0 [0208.185] IUnknown:AddRef (This=0x5096f8) returned 0x4 [0208.185] IUnknown:Release (This=0x5096f8) returned 0x3 [0208.185] IUnknown:Release (This=0x5096f8) returned 0x2 [0208.185] WbemLocator:IUnknown:Release (This=0x4fb920) returned 0x2 [0208.185] SysStringLen (param_1=0x0) returned 0x0 [0208.185] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0728, puCount=0x19f3f4 | out: puCount=0x19f3f4*=0x2) returned 0x0 [0208.185] WbemDefPath:IWbemPath:GetText (in: This=0x4e0728, lFlags=4, puBuffLength=0x19f3f0*=0x0, pszText=0x0 | out: puBuffLength=0x19f3f0*=0xf, pszText=0x0) returned 0x0 [0208.186] WbemDefPath:IWbemPath:GetText (in: This=0x4e0728, lFlags=4, puBuffLength=0x19f3f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0208.186] CoGetContextToken (in: pToken=0x19f238 | out: pToken=0x19f238) returned 0x0 [0208.186] IUnknown:AddRef (This=0x5096f8) returned 0x3 [0208.186] IEnumWbemClassObject:Clone (in: This=0x5096f8, ppEnum=0x19f3f4 | out: ppEnum=0x19f3f4*=0x509e00) returned 0x0 [0208.214] IUnknown:QueryInterface (in: This=0x509e00, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f2b8 | out: ppvObject=0x19f2b8*=0x509e04) returned 0x0 [0208.215] IClientSecurity:QueryBlanket (in: This=0x509e04, pProxy=0x509e00, pAuthnSvc=0x19f308, pAuthzSvc=0x19f304, pServerPrincName=0x19f2fc, pAuthnLevel=0x19f300, pImpLevel=0x19f2f0, pAuthInfo=0x19f2f4, pCapabilites=0x19f2f8 | out: pAuthnSvc=0x19f308*=0xa, pAuthzSvc=0x19f304*=0x0, pServerPrincName=0x19f2fc, pAuthnLevel=0x19f300*=0x6, pImpLevel=0x19f2f0*=0x2, pAuthInfo=0x19f2f4, pCapabilites=0x19f2f8*=0x1) returned 0x0 [0208.215] IUnknown:Release (This=0x509e04) returned 0x1 [0208.215] IUnknown:QueryInterface (in: This=0x509e00, riid=0x6c8110f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f2ac | out: ppvObject=0x19f2ac*=0x501d88) returned 0x0 [0208.215] IUnknown:QueryInterface (in: This=0x509e00, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f2a8 | out: ppvObject=0x19f2a8*=0x509e04) returned 0x0 [0208.215] IClientSecurity:SetBlanket (This=0x509e04, pProxy=0x509e00, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0208.786] IUnknown:Release (This=0x509e04) returned 0x2 [0208.786] WbemLocator:IUnknown:Release (This=0x501d88) returned 0x1 [0208.786] CoTaskMemFree (pv=0x5037f0) [0208.786] IUnknown:QueryInterface (in: This=0x509e00, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee94 | out: ppvObject=0x19ee94*=0x501d88) returned 0x0 [0208.786] WbemLocator:IUnknown:QueryInterface (in: This=0x501d88, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ee50 | out: ppvObject=0x19ee50*=0x0) returned 0x80004002 [0208.788] WbemLocator:IUnknown:QueryInterface (in: This=0x501d88, riid=0x6c29fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ec6c | out: ppvObject=0x19ec6c*=0x0) returned 0x80004002 [0208.789] IUnknown:QueryInterface (in: This=0x509e00, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19ea44 | out: ppvObject=0x19ea44*=0x0) returned 0x80004002 [0208.790] WbemLocator:IUnknown:AddRef (This=0x501d88) returned 0x3 [0208.790] WbemLocator:IUnknown:QueryInterface (in: This=0x501d88, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e7ac | out: ppvObject=0x19e7ac*=0x0) returned 0x80004002 [0208.790] WbemLocator:IUnknown:QueryInterface (in: This=0x501d88, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e75c | out: ppvObject=0x19e75c*=0x0) returned 0x80004002 [0208.790] WbemLocator:IUnknown:QueryInterface (in: This=0x501d88, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e768 | out: ppvObject=0x19e768*=0x501ce4) returned 0x0 [0208.790] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x501ce4, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e770 | out: pCid=0x19e770*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0208.790] WbemLocator:IUnknown:Release (This=0x501ce4) returned 0x3 [0208.790] CoGetContextToken (in: pToken=0x19e7c8 | out: pToken=0x19e7c8) returned 0x0 [0208.790] CoGetContextToken (in: pToken=0x19ebd0 | out: pToken=0x19ebd0) returned 0x0 [0208.790] WbemLocator:IUnknown:QueryInterface (in: This=0x501d88, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec60 | out: ppvObject=0x19ec60*=0x501d6c) returned 0x0 [0208.791] WbemLocator:IRpcOptions:Query (in: This=0x501d6c, pPrx=0x501d88, dwProperty=2, pdwValue=0x19ec88 | out: pdwValue=0x19ec88) returned 0x80004002 [0208.791] WbemLocator:IUnknown:Release (This=0x501d6c) returned 0x3 [0208.791] WbemLocator:IUnknown:Release (This=0x501d88) returned 0x2 [0208.791] CoGetContextToken (in: pToken=0x19f1a8 | out: pToken=0x19f1a8) returned 0x0 [0208.791] CoGetContextToken (in: pToken=0x19f108 | out: pToken=0x19f108) returned 0x0 [0208.791] WbemLocator:IUnknown:QueryInterface (in: This=0x501d88, riid=0x19f1d8*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f1d4 | out: ppvObject=0x19f1d4*=0x509e00) returned 0x0 [0208.791] IUnknown:AddRef (This=0x509e00) returned 0x4 [0208.791] IUnknown:Release (This=0x509e00) returned 0x3 [0208.791] IUnknown:Release (This=0x509e00) returned 0x2 [0208.791] IUnknown:Release (This=0x5096f8) returned 0x2 [0208.791] SysStringLen (param_1=0x0) returned 0x0 [0208.792] IEnumWbemClassObject:Reset (This=0x509e00) returned 0x0 [0208.796] CoTaskMemAlloc (cb=0x4) returned 0x517860 [0208.796] IEnumWbemClassObject:Next (in: This=0x509e00, lTimeout=-1, uCount=0x1, apObjects=0x517860, puReturned=0x22050c0 | out: apObjects=0x517860*=0x4e8b80, puReturned=0x22050c0*=0x1) returned 0x0 [0219.950] IUnknown:QueryInterface (in: This=0x4e8b80, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea58 | out: ppvObject=0x19ea58*=0x4e8b80) returned 0x0 [0219.950] IUnknown:QueryInterface (in: This=0x4e8b80, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ea14 | out: ppvObject=0x19ea14*=0x0) returned 0x80004002 [0219.950] IUnknown:QueryInterface (in: This=0x4e8b80, riid=0x6c29fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e834 | out: ppvObject=0x19e834*=0x0) returned 0x80004002 [0219.950] IUnknown:QueryInterface (in: This=0x4e8b80, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e60c | out: ppvObject=0x19e60c*=0x0) returned 0x80004002 [0219.951] IUnknown:AddRef (This=0x4e8b80) returned 0x3 [0219.951] IUnknown:QueryInterface (in: This=0x4e8b80, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e374 | out: ppvObject=0x19e374*=0x0) returned 0x80004002 [0219.951] IUnknown:QueryInterface (in: This=0x4e8b80, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e324 | out: ppvObject=0x19e324*=0x0) returned 0x80004002 [0219.951] IUnknown:QueryInterface (in: This=0x4e8b80, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e330 | out: ppvObject=0x19e330*=0x4e8b84) returned 0x0 [0219.951] IMarshal:GetUnmarshalClass (in: This=0x4e8b84, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e338 | out: pCid=0x19e338*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0219.951] IUnknown:Release (This=0x4e8b84) returned 0x3 [0219.951] CoGetContextToken (in: pToken=0x19e390 | out: pToken=0x19e390) returned 0x0 [0219.951] CoGetContextToken (in: pToken=0x19e798 | out: pToken=0x19e798) returned 0x0 [0219.951] IUnknown:QueryInterface (in: This=0x4e8b80, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e828 | out: ppvObject=0x19e828*=0x0) returned 0x80004002 [0219.951] IUnknown:Release (This=0x4e8b80) returned 0x2 [0219.952] CoGetContextToken (in: pToken=0x19ed68 | out: pToken=0x19ed68) returned 0x0 [0219.952] CoGetContextToken (in: pToken=0x19ecc8 | out: pToken=0x19ecc8) returned 0x0 [0219.952] IUnknown:QueryInterface (in: This=0x4e8b80, riid=0x19ed98*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ed94 | out: ppvObject=0x19ed94*=0x4e8b80) returned 0x0 [0219.952] IUnknown:AddRef (This=0x4e8b80) returned 0x4 [0219.952] IUnknown:Release (This=0x4e8b80) returned 0x3 [0219.952] IUnknown:Release (This=0x4e8b80) returned 0x2 [0219.953] CoTaskMemFree (pv=0x517860) [0219.953] CoGetContextToken (in: pToken=0x19f0d0 | out: pToken=0x19f0d0) returned 0x0 [0219.953] IUnknown:AddRef (This=0x4e8b80) returned 0x3 [0219.955] IWbemClassObject:Get (in: This=0x4e8b80, wszName="__GENUS", lFlags=0, pVal=0x19f3e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f464*=0, plFlavor=0x19f460*=0 | out: pVal=0x19f3e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f464*=3, plFlavor=0x19f460*=64) returned 0x0 [0219.955] IWbemClassObject:Get (in: This=0x4e8b80, wszName="__PATH", lFlags=0, pVal=0x19f3c8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f44c*=0, plFlavor=0x19f448*=0 | out: pVal=0x19f3c8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"", varVal2=0x0), pType=0x19f44c*=8, plFlavor=0x19f448*=64) returned 0x0 [0219.956] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x66 [0219.956] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x66 [0219.957] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x448 [0219.957] SetEvent (hEvent=0x3c8) returned 1 [0219.958] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f3a0*=0x448, lpdwindex=0x19f1bc | out: lpdwindex=0x19f1bc) returned 0x0 [0219.973] CoGetContextToken (in: pToken=0x19f270 | out: pToken=0x19f270) returned 0x0 [0219.974] CoGetContextToken (in: pToken=0x19f1d0 | out: pToken=0x19f1d0) returned 0x0 [0219.974] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0648, riid=0x19f2a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x4e0648) returned 0x0 [0219.974] WbemDefPath:IUnknown:AddRef (This=0x4e0648) returned 0x3 [0219.974] WbemDefPath:IUnknown:Release (This=0x4e0648) returned 0x2 [0219.974] WbemDefPath:IWbemPath:SetText (This=0x4e0648, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x0 [0219.974] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0728, puCount=0x19f420 | out: puCount=0x19f420*=0x2) returned 0x0 [0219.974] WbemDefPath:IWbemPath:GetText (in: This=0x4e0728, lFlags=4, puBuffLength=0x19f41c*=0x0, pszText=0x0 | out: puBuffLength=0x19f41c*=0xf, pszText=0x0) returned 0x0 [0219.974] WbemDefPath:IWbemPath:GetText (in: This=0x4e0728, lFlags=4, puBuffLength=0x19f41c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f41c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0219.975] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0728, puCount=0x19f400 | out: puCount=0x19f400*=0x2) returned 0x0 [0219.975] WbemDefPath:IWbemPath:GetText (in: This=0x4e0728, lFlags=4, puBuffLength=0x19f3fc*=0x0, pszText=0x0 | out: puBuffLength=0x19f3fc*=0xf, pszText=0x0) returned 0x0 [0219.975] WbemDefPath:IWbemPath:GetText (in: This=0x4e0728, lFlags=4, puBuffLength=0x19f3fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0219.980] IWbemClassObject:Get (in: This=0x4e8b80, wszName="processorID", lFlags=0, pVal=0x19f3fc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2205970*=0, plFlavor=0x2205974*=0 | out: pVal=0x19f3fc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0F8BFBFF00050654", varVal2=0x0), pType=0x2205970*=8, plFlavor=0x2205974*=0) returned 0x0 [0219.980] SysStringByteLen (bstr="0F8BFBFF00050654") returned 0x20 [0219.980] SysStringByteLen (bstr="0F8BFBFF00050654") returned 0x20 [0219.980] IWbemClassObject:Get (in: This=0x4e8b80, wszName="processorID", lFlags=0, pVal=0x19f404*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2205970*=8, plFlavor=0x2205974*=0 | out: pVal=0x19f404*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0F8BFBFF00050654", varVal2=0x0), pType=0x2205970*=8, plFlavor=0x2205974*=0) returned 0x0 [0219.980] SysStringByteLen (bstr="0F8BFBFF00050654") returned 0x20 [0219.981] SysStringByteLen (bstr="0F8BFBFF00050654") returned 0x20 [0219.982] CoTaskMemAlloc (cb=0x4) returned 0x517860 [0219.982] IEnumWbemClassObject:Next (in: This=0x509e00, lTimeout=-1, uCount=0x1, apObjects=0x517860, puReturned=0x22050c0 | out: apObjects=0x517860*=0x0, puReturned=0x22050c0*=0x0) returned 0x1 [0219.984] CoTaskMemFree (pv=0x517860) [0219.985] CoGetContextToken (in: pToken=0x19f320 | out: pToken=0x19f320) returned 0x0 [0219.985] WbemLocator:IUnknown:Release (This=0x501d88) returned 0x1 [0219.985] IUnknown:Release (This=0x509e00) returned 0x0 [0220.044] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x44c [0220.044] SetEvent (hEvent=0x3c8) returned 1 [0220.045] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f3c4*=0x44c, lpdwindex=0x19f1e4 | out: lpdwindex=0x19f1e4) returned 0x0 [0220.051] CoGetContextToken (in: pToken=0x19f290 | out: pToken=0x19f290) returned 0x0 [0220.051] CoGetContextToken (in: pToken=0x19f1f0 | out: pToken=0x19f1f0) returned 0x0 [0220.051] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0338, riid=0x19f2c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f2bc | out: ppvObject=0x19f2bc*=0x4e0338) returned 0x0 [0220.051] WbemDefPath:IUnknown:AddRef (This=0x4e0338) returned 0x3 [0220.051] WbemDefPath:IUnknown:Release (This=0x4e0338) returned 0x2 [0220.051] WbemDefPath:IWbemPath:SetText (This=0x4e0338, uMode=0x4, pszPath="Win32_NetworkAdapterConfiguration") returned 0x0 [0220.051] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0338, puCount=0x19f444 | out: puCount=0x19f444*=0x0) returned 0x0 [0220.051] WbemDefPath:IWbemPath:GetText (in: This=0x4e0338, lFlags=2, puBuffLength=0x19f440*=0x0, pszText=0x0 | out: puBuffLength=0x19f440*=0x22, pszText=0x0) returned 0x0 [0220.051] WbemDefPath:IWbemPath:GetText (in: This=0x4e0338, lFlags=2, puBuffLength=0x19f440*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x19f440*=0x22, pszText="Win32_NetworkAdapterConfiguration") returned 0x0 [0220.051] WbemDefPath:IWbemPath:GetInfo (in: This=0x4e0338, uRequestedInfo=0x0, puResponse=0x19f44c | out: puResponse=0x19f44c*=0xc15) returned 0x0 [0220.051] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0338, puCount=0x19f444 | out: puCount=0x19f444*=0x0) returned 0x0 [0220.051] WbemDefPath:IWbemPath:GetInfo (in: This=0x4e0338, uRequestedInfo=0x0, puResponse=0x19f44c | out: puResponse=0x19f44c*=0xc15) returned 0x0 [0220.052] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0338, puCount=0x19f434 | out: puCount=0x19f434*=0x0) returned 0x0 [0220.052] WbemDefPath:IWbemPath:GetText (in: This=0x4e0338, lFlags=2, puBuffLength=0x19f430*=0x0, pszText=0x0 | out: puBuffLength=0x19f430*=0x22, pszText=0x0) returned 0x0 [0220.052] WbemDefPath:IWbemPath:GetText (in: This=0x4e0338, lFlags=2, puBuffLength=0x19f430*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x19f430*=0x22, pszText="Win32_NetworkAdapterConfiguration") returned 0x0 [0220.052] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0338, puCount=0x19f434 | out: puCount=0x19f434*=0x0) returned 0x0 [0220.052] WbemDefPath:IWbemPath:GetText (in: This=0x4e0338, lFlags=2, puBuffLength=0x19f430*=0x0, pszText=0x0 | out: puBuffLength=0x19f430*=0x22, pszText=0x0) returned 0x0 [0220.052] WbemDefPath:IWbemPath:GetText (in: This=0x4e0338, lFlags=2, puBuffLength=0x19f430*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x19f430*=0x22, pszText="Win32_NetworkAdapterConfiguration") returned 0x0 [0220.052] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0338, puCount=0x19f3c4 | out: puCount=0x19f3c4*=0x0) returned 0x0 [0220.052] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0568, puCount=0x19f3b0 | out: puCount=0x19f3b0*=0x2) returned 0x0 [0220.052] WbemDefPath:IWbemPath:GetText (in: This=0x4e0568, lFlags=4, puBuffLength=0x19f3ac*=0x0, pszText=0x0 | out: puBuffLength=0x19f3ac*=0xf, pszText=0x0) returned 0x0 [0220.052] WbemDefPath:IWbemPath:GetText (in: This=0x4e0568, lFlags=4, puBuffLength=0x19f3ac*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3ac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0220.052] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x450 [0220.052] SetEvent (hEvent=0x3c8) returned 1 [0220.053] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f30c*=0x450, lpdwindex=0x19f12c | out: lpdwindex=0x19f12c) returned 0x0 [0220.055] CoGetContextToken (in: pToken=0x19f1d8 | out: pToken=0x19f1d8) returned 0x0 [0220.055] CoGetContextToken (in: pToken=0x19f138 | out: pToken=0x19f138) returned 0x0 [0220.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0418, riid=0x19f208*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x4e0418) returned 0x0 [0220.055] WbemDefPath:IUnknown:AddRef (This=0x4e0418) returned 0x3 [0220.055] WbemDefPath:IUnknown:Release (This=0x4e0418) returned 0x2 [0220.055] WbemDefPath:IWbemPath:SetText (This=0x4e0418, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0220.055] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0418, puCount=0x19f388 | out: puCount=0x19f388*=0x2) returned 0x0 [0220.055] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=4, puBuffLength=0x19f384*=0x0, pszText=0x0 | out: puBuffLength=0x19f384*=0xf, pszText=0x0) returned 0x0 [0220.055] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=4, puBuffLength=0x19f384*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f384*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0220.074] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f2a8*=0x464, lpdwindex=0x19f15c | out: lpdwindex=0x19f15c) returned 0x0 [0220.107] CoGetContextToken (in: pToken=0x19f0a0 | out: pToken=0x19f0a0) returned 0x0 [0220.107] CoGetContextToken (in: pToken=0x19f048 | out: pToken=0x19f048) returned 0x0 [0220.107] IUnknown:QueryInterface (in: This=0x4c0110, riid=0x6c218724*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f028 | out: ppvObject=0x19f028*=0x4c0120) returned 0x0 [0220.107] CObjectContext::ContextCallback () returned 0x0 [0220.110] IUnknown:Release (This=0x4c0120) returned 0x1 [0220.110] CoUnmarshalInterface (in: pStm=0x4f55a0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f090 | out: ppv=0x19f090*=0x502288) returned 0x0 [0220.111] CoMarshalInterface (pStm=0x4f55a0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x502288, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0220.111] WbemLocator:IUnknown:QueryInterface (in: This=0x502288, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ef34 | out: ppvObject=0x19ef34*=0x502288) returned 0x0 [0220.111] WbemLocator:IUnknown:QueryInterface (in: This=0x502288, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19eef0 | out: ppvObject=0x19eef0*=0x0) returned 0x80004002 [0220.112] WbemLocator:IUnknown:QueryInterface (in: This=0x502288, riid=0x6c29fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed0c | out: ppvObject=0x19ed0c*=0x0) returned 0x80004002 [0220.112] WbemLocator:IUnknown:QueryInterface (in: This=0x502288, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19eae4 | out: ppvObject=0x19eae4*=0x0) returned 0x80004002 [0220.113] WbemLocator:IUnknown:AddRef (This=0x502288) returned 0x3 [0220.113] WbemLocator:IUnknown:QueryInterface (in: This=0x502288, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e84c | out: ppvObject=0x19e84c*=0x0) returned 0x80004002 [0220.113] WbemLocator:IUnknown:QueryInterface (in: This=0x502288, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0220.113] WbemLocator:IUnknown:QueryInterface (in: This=0x502288, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e808 | out: ppvObject=0x19e808*=0x5021e4) returned 0x0 [0220.113] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5021e4, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e810 | out: pCid=0x19e810*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0220.113] WbemLocator:IUnknown:Release (This=0x5021e4) returned 0x3 [0220.113] CoGetContextToken (in: pToken=0x19e868 | out: pToken=0x19e868) returned 0x0 [0220.113] CoGetContextToken (in: pToken=0x19ec70 | out: pToken=0x19ec70) returned 0x0 [0220.113] WbemLocator:IUnknown:QueryInterface (in: This=0x502288, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed00 | out: ppvObject=0x19ed00*=0x50226c) returned 0x0 [0220.113] WbemLocator:IRpcOptions:Query (in: This=0x50226c, pPrx=0x502288, dwProperty=2, pdwValue=0x19ed28 | out: pdwValue=0x19ed28) returned 0x0 [0220.113] WbemLocator:IUnknown:Release (This=0x50226c) returned 0x3 [0220.114] WbemLocator:IUnknown:Release (This=0x502288) returned 0x2 [0220.114] WbemLocator:IUnknown:Release (This=0x502288) returned 0x1 [0220.114] CoGetContextToken (in: pToken=0x19efe0 | out: pToken=0x19efe0) returned 0x0 [0220.114] WbemLocator:IUnknown:AddRef (This=0x502288) returned 0x2 [0220.114] WbemLocator:IUnknown:QueryInterface (in: This=0x502288, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x502264) returned 0x0 [0220.114] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x502264, pProxy=0x502288, pAuthnSvc=0x19f2ec, pAuthzSvc=0x19f2e8, pServerPrincName=0x19f2e0, pAuthnLevel=0x19f2e4, pImpLevel=0x19f2d4, pAuthInfo=0x19f2d8, pCapabilites=0x19f2dc | out: pAuthnSvc=0x19f2ec*=0xa, pAuthzSvc=0x19f2e8*=0x0, pServerPrincName=0x19f2e0, pAuthnLevel=0x19f2e4*=0x6, pImpLevel=0x19f2d4*=0x2, pAuthInfo=0x19f2d8, pCapabilites=0x19f2dc*=0x1) returned 0x0 [0220.114] WbemLocator:IUnknown:Release (This=0x502264) returned 0x2 [0220.114] WbemLocator:IUnknown:QueryInterface (in: This=0x502288, riid=0x6c8110f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f290 | out: ppvObject=0x19f290*=0x502288) returned 0x0 [0220.114] WbemLocator:IUnknown:QueryInterface (in: This=0x502288, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f28c | out: ppvObject=0x19f28c*=0x502264) returned 0x0 [0220.114] WbemLocator:IClientSecurity:SetBlanket (This=0x502264, pProxy=0x502288, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0220.114] WbemLocator:IUnknown:Release (This=0x502264) returned 0x3 [0220.114] WbemLocator:IUnknown:Release (This=0x502288) returned 0x2 [0220.114] CoTaskMemFree (pv=0x503ac0) [0220.115] WbemLocator:IUnknown:Release (This=0x502288) returned 0x1 [0220.115] SysStringLen (param_1=0x0) returned 0x0 [0220.115] CoGetContextToken (in: pToken=0x19f258 | out: pToken=0x19f258) returned 0x0 [0220.115] CoGetContextToken (in: pToken=0x19f1b8 | out: pToken=0x19f1b8) returned 0x0 [0220.115] WbemLocator:IUnknown:QueryInterface (in: This=0x502288, riid=0x19f288*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19f284 | out: ppvObject=0x19f284*=0x4fbec0) returned 0x0 [0220.115] WbemLocator:IUnknown:AddRef (This=0x4fbec0) returned 0x3 [0220.115] WbemLocator:IUnknown:Release (This=0x4fbec0) returned 0x2 [0220.115] CoGetContextToken (in: pToken=0x19f218 | out: pToken=0x19f218) returned 0x0 [0220.115] WbemLocator:IUnknown:AddRef (This=0x4fbec0) returned 0x3 [0220.116] WbemLocator:IUnknown:QueryInterface (in: This=0x4fbec0, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x502264) returned 0x0 [0220.116] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x502264, pProxy=0x4fbec0, pAuthnSvc=0x19f2ec, pAuthzSvc=0x19f2e8, pServerPrincName=0x19f2e0, pAuthnLevel=0x19f2e4, pImpLevel=0x19f2d4, pAuthInfo=0x19f2d8, pCapabilites=0x19f2dc | out: pAuthnSvc=0x19f2ec*=0xa, pAuthzSvc=0x19f2e8*=0x0, pServerPrincName=0x19f2e0, pAuthnLevel=0x19f2e4*=0x6, pImpLevel=0x19f2d4*=0x2, pAuthInfo=0x19f2d8, pCapabilites=0x19f2dc*=0x1) returned 0x0 [0220.116] WbemLocator:IUnknown:Release (This=0x502264) returned 0x3 [0220.116] WbemLocator:IUnknown:QueryInterface (in: This=0x4fbec0, riid=0x6c8110f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f290 | out: ppvObject=0x19f290*=0x502288) returned 0x0 [0220.116] WbemLocator:IUnknown:QueryInterface (in: This=0x4fbec0, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f28c | out: ppvObject=0x19f28c*=0x502264) returned 0x0 [0220.116] WbemLocator:IClientSecurity:SetBlanket (This=0x502264, pProxy=0x4fbec0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0220.116] WbemLocator:IUnknown:Release (This=0x502264) returned 0x4 [0220.116] WbemLocator:IUnknown:Release (This=0x502288) returned 0x3 [0220.116] CoTaskMemFree (pv=0x503bb0) [0220.116] WbemLocator:IUnknown:Release (This=0x4fbec0) returned 0x2 [0220.116] SysStringLen (param_1=0x0) returned 0x0 [0220.116] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0418, puCount=0x19f3ac | out: puCount=0x19f3ac*=0x2) returned 0x0 [0220.116] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=4, puBuffLength=0x19f3a8*=0x0, pszText=0x0 | out: puBuffLength=0x19f3a8*=0xf, pszText=0x0) returned 0x0 [0220.117] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=4, puBuffLength=0x19f3a8*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3a8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0220.117] CoGetContextToken (in: pToken=0x19f018 | out: pToken=0x19f018) returned 0x0 [0220.117] CoUnmarshalInterface (in: pStm=0x4f55a0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f008 | out: ppv=0x19f008*=0x502288) returned 0x0 [0220.117] CoMarshalInterface (pStm=0x4f55a0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x502288, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0220.117] WbemLocator:IUnknown:QueryInterface (in: This=0x502288, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eeac | out: ppvObject=0x19eeac*=0x502288) returned 0x0 [0220.117] WbemLocator:IUnknown:Release (This=0x502288) returned 0x3 [0220.117] WbemLocator:IUnknown:Release (This=0x502288) returned 0x2 [0220.117] CoGetContextToken (in: pToken=0x19ef58 | out: pToken=0x19ef58) returned 0x0 [0220.118] WbemLocator:IUnknown:AddRef (This=0x502288) returned 0x3 [0220.118] WbemLocator:IUnknown:QueryInterface (in: This=0x502288, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f214 | out: ppvObject=0x19f214*=0x502264) returned 0x0 [0220.118] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x502264, pProxy=0x502288, pAuthnSvc=0x19f264, pAuthzSvc=0x19f260, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c, pImpLevel=0x19f24c, pAuthInfo=0x19f250, pCapabilites=0x19f254 | out: pAuthnSvc=0x19f264*=0xa, pAuthzSvc=0x19f260*=0x0, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c*=0x6, pImpLevel=0x19f24c*=0x3, pAuthInfo=0x19f250, pCapabilites=0x19f254*=0x20) returned 0x0 [0220.118] WbemLocator:IUnknown:Release (This=0x502264) returned 0x3 [0220.118] WbemLocator:IUnknown:QueryInterface (in: This=0x502288, riid=0x6c8110f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f208 | out: ppvObject=0x19f208*=0x502288) returned 0x0 [0220.118] WbemLocator:IUnknown:QueryInterface (in: This=0x502288, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x502264) returned 0x0 [0220.118] WbemLocator:IClientSecurity:SetBlanket (This=0x502264, pProxy=0x502288, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0220.118] WbemLocator:IUnknown:Release (This=0x502264) returned 0x4 [0220.118] WbemLocator:IUnknown:Release (This=0x502288) returned 0x3 [0220.119] WbemLocator:IUnknown:Release (This=0x502288) returned 0x2 [0220.119] SysStringLen (param_1=0x0) returned 0x0 [0220.119] CoGetContextToken (in: pToken=0x19f1d0 | out: pToken=0x19f1d0) returned 0x0 [0220.119] WbemLocator:IUnknown:AddRef (This=0x4fbec0) returned 0x3 [0220.119] WbemLocator:IUnknown:Release (This=0x4fbec0) returned 0x2 [0220.119] CoGetContextToken (in: pToken=0x19f190 | out: pToken=0x19f190) returned 0x0 [0220.119] WbemLocator:IUnknown:AddRef (This=0x4fbec0) returned 0x3 [0220.119] WbemLocator:IUnknown:QueryInterface (in: This=0x4fbec0, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f214 | out: ppvObject=0x19f214*=0x502264) returned 0x0 [0220.119] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x502264, pProxy=0x4fbec0, pAuthnSvc=0x19f264, pAuthzSvc=0x19f260, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c, pImpLevel=0x19f24c, pAuthInfo=0x19f250, pCapabilites=0x19f254 | out: pAuthnSvc=0x19f264*=0xa, pAuthzSvc=0x19f260*=0x0, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c*=0x6, pImpLevel=0x19f24c*=0x3, pAuthInfo=0x19f250, pCapabilites=0x19f254*=0x20) returned 0x0 [0220.119] WbemLocator:IUnknown:Release (This=0x502264) returned 0x3 [0220.119] WbemLocator:IUnknown:QueryInterface (in: This=0x4fbec0, riid=0x6c8110f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f208 | out: ppvObject=0x19f208*=0x502288) returned 0x0 [0220.119] WbemLocator:IUnknown:QueryInterface (in: This=0x4fbec0, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x502264) returned 0x0 [0220.119] WbemLocator:IClientSecurity:SetBlanket (This=0x502264, pProxy=0x4fbec0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0220.120] WbemLocator:IUnknown:Release (This=0x502264) returned 0x4 [0220.120] WbemLocator:IUnknown:Release (This=0x502288) returned 0x3 [0220.120] WbemLocator:IUnknown:Release (This=0x4fbec0) returned 0x2 [0220.120] SysStringLen (param_1=0x0) returned 0x0 [0220.120] WbemDefPath:IWbemPath:GetText (in: This=0x4e0338, lFlags=2, puBuffLength=0x19f3b0*=0x0, pszText=0x0 | out: puBuffLength=0x19f3b0*=0x22, pszText=0x0) returned 0x0 [0220.120] WbemDefPath:IWbemPath:GetText (in: This=0x4e0338, lFlags=2, puBuffLength=0x19f3b0*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x19f3b0*=0x22, pszText="Win32_NetworkAdapterConfiguration") returned 0x0 [0220.121] IWbemServices:GetObject (in: This=0x4fbec0, strObjectPath="Win32_NetworkAdapterConfiguration", lFlags=0, pCtx=0x0, ppObject=0x19f364*=0x0, ppCallResult=0x0 | out: ppObject=0x19f364*=0x530bd0, ppCallResult=0x0) returned 0x0 [0220.152] IWbemClassObject:Get (in: This=0x530bd0, wszName="__PATH", lFlags=0, pVal=0x19f34c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f3f4*=0, plFlavor=0x19f3f0*=0 | out: pVal=0x19f34c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_NetworkAdapterConfiguration", varVal2=0x0), pType=0x19f3f4*=8, plFlavor=0x19f3f0*=64) returned 0x0 [0220.153] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_NetworkAdapterConfiguration") returned 0x6a [0220.153] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_NetworkAdapterConfiguration") returned 0x6a [0220.153] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x468 [0220.153] SetEvent (hEvent=0x3c8) returned 1 [0220.153] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f308*=0x468, lpdwindex=0x19f124 | out: lpdwindex=0x19f124) returned 0x0 [0220.156] CoGetContextToken (in: pToken=0x19f1d8 | out: pToken=0x19f1d8) returned 0x0 [0220.156] CoGetContextToken (in: pToken=0x19f138 | out: pToken=0x19f138) returned 0x0 [0220.156] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e04f8, riid=0x19f208*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x4e04f8) returned 0x0 [0220.156] WbemDefPath:IUnknown:AddRef (This=0x4e04f8) returned 0x3 [0220.156] WbemDefPath:IUnknown:Release (This=0x4e04f8) returned 0x2 [0220.156] WbemDefPath:IWbemPath:SetText (This=0x4e04f8, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_NetworkAdapterConfiguration") returned 0x0 [0220.156] IWbemClassObject:Get (in: This=0x530bd0, wszName="__CLASS", lFlags=0, pVal=0x19f3bc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f43c*=0, plFlavor=0x19f438*=0 | out: pVal=0x19f3bc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_NetworkAdapterConfiguration", varVal2=0x0), pType=0x19f43c*=8, plFlavor=0x19f438*=64) returned 0x0 [0220.156] SysStringByteLen (bstr="Win32_NetworkAdapterConfiguration") returned 0x42 [0220.156] SysStringByteLen (bstr="Win32_NetworkAdapterConfiguration") returned 0x42 [0220.157] CoGetContextToken (in: pToken=0x19f1b0 | out: pToken=0x19f1b0) returned 0x0 [0220.157] WbemLocator:IUnknown:AddRef (This=0x4fbec0) returned 0x3 [0220.157] IWbemServices:CreateInstanceEnum (in: This=0x4fbec0, strFilter="Win32_NetworkAdapterConfiguration", lFlags=17, pCtx=0x0, ppEnum=0x19f3b8 | out: ppEnum=0x19f3b8*=0x509ae0) returned 0x0 [0220.160] IUnknown:QueryInterface (in: This=0x509ae0, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f228 | out: ppvObject=0x19f228*=0x509ae4) returned 0x0 [0220.160] IClientSecurity:QueryBlanket (in: This=0x509ae4, pProxy=0x509ae0, pAuthnSvc=0x19f278, pAuthzSvc=0x19f274, pServerPrincName=0x19f26c, pAuthnLevel=0x19f270, pImpLevel=0x19f260, pAuthInfo=0x19f264, pCapabilites=0x19f268 | out: pAuthnSvc=0x19f278*=0xa, pAuthzSvc=0x19f274*=0x0, pServerPrincName=0x19f26c, pAuthnLevel=0x19f270*=0x6, pImpLevel=0x19f260*=0x2, pAuthInfo=0x19f264, pCapabilites=0x19f268*=0x1) returned 0x0 [0220.160] IUnknown:Release (This=0x509ae4) returned 0x1 [0220.160] IUnknown:QueryInterface (in: This=0x509ae0, riid=0x6c8110f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f21c | out: ppvObject=0x19f21c*=0x502788) returned 0x0 [0220.160] IUnknown:QueryInterface (in: This=0x509ae0, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f218 | out: ppvObject=0x19f218*=0x509ae4) returned 0x0 [0220.160] IClientSecurity:SetBlanket (This=0x509ae4, pProxy=0x509ae0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0220.198] IUnknown:Release (This=0x509ae4) returned 0x2 [0220.198] WbemLocator:IUnknown:Release (This=0x502788) returned 0x1 [0220.198] CoTaskMemFree (pv=0x503be0) [0220.198] IUnknown:QueryInterface (in: This=0x509ae0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee10 | out: ppvObject=0x19ee10*=0x502788) returned 0x0 [0220.198] WbemLocator:IUnknown:QueryInterface (in: This=0x502788, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19edcc | out: ppvObject=0x19edcc*=0x0) returned 0x80004002 [0220.199] WbemLocator:IUnknown:QueryInterface (in: This=0x502788, riid=0x6c29fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ebec | out: ppvObject=0x19ebec*=0x0) returned 0x80004002 [0220.200] IUnknown:QueryInterface (in: This=0x509ae0, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e9c4 | out: ppvObject=0x19e9c4*=0x0) returned 0x80004002 [0220.201] WbemLocator:IUnknown:AddRef (This=0x502788) returned 0x3 [0220.201] WbemLocator:IUnknown:QueryInterface (in: This=0x502788, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e72c | out: ppvObject=0x19e72c*=0x0) returned 0x80004002 [0220.201] WbemLocator:IUnknown:QueryInterface (in: This=0x502788, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e6dc | out: ppvObject=0x19e6dc*=0x0) returned 0x80004002 [0220.201] WbemLocator:IUnknown:QueryInterface (in: This=0x502788, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e6e8 | out: ppvObject=0x19e6e8*=0x5026e4) returned 0x0 [0220.201] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5026e4, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e6f0 | out: pCid=0x19e6f0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0220.202] WbemLocator:IUnknown:Release (This=0x5026e4) returned 0x3 [0220.202] CoGetContextToken (in: pToken=0x19e748 | out: pToken=0x19e748) returned 0x0 [0220.202] CoGetContextToken (in: pToken=0x19eb50 | out: pToken=0x19eb50) returned 0x0 [0220.202] WbemLocator:IUnknown:QueryInterface (in: This=0x502788, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ebe0 | out: ppvObject=0x19ebe0*=0x50276c) returned 0x0 [0220.202] WbemLocator:IRpcOptions:Query (in: This=0x50276c, pPrx=0x502788, dwProperty=2, pdwValue=0x19ec08 | out: pdwValue=0x19ec08) returned 0x80004002 [0220.202] WbemLocator:IUnknown:Release (This=0x50276c) returned 0x3 [0220.202] WbemLocator:IUnknown:Release (This=0x502788) returned 0x2 [0220.202] CoGetContextToken (in: pToken=0x19f120 | out: pToken=0x19f120) returned 0x0 [0220.202] CoGetContextToken (in: pToken=0x19f080 | out: pToken=0x19f080) returned 0x0 [0220.202] WbemLocator:IUnknown:QueryInterface (in: This=0x502788, riid=0x19f150*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f14c | out: ppvObject=0x19f14c*=0x509ae0) returned 0x0 [0220.202] IUnknown:AddRef (This=0x509ae0) returned 0x4 [0220.203] IUnknown:Release (This=0x509ae0) returned 0x3 [0220.203] IUnknown:Release (This=0x509ae0) returned 0x2 [0220.203] WbemLocator:IUnknown:Release (This=0x4fbec0) returned 0x2 [0220.203] SysStringLen (param_1=0x0) returned 0x0 [0220.203] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0418, puCount=0x19f3f4 | out: puCount=0x19f3f4*=0x2) returned 0x0 [0220.203] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=4, puBuffLength=0x19f3f0*=0x0, pszText=0x0 | out: puBuffLength=0x19f3f0*=0xf, pszText=0x0) returned 0x0 [0220.203] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=4, puBuffLength=0x19f3f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0220.203] CoGetContextToken (in: pToken=0x19f238 | out: pToken=0x19f238) returned 0x0 [0220.203] IUnknown:AddRef (This=0x509ae0) returned 0x3 [0220.203] IEnumWbemClassObject:Clone (in: This=0x509ae0, ppEnum=0x19f3f4 | out: ppEnum=0x19f3f4*=0x5090b8) returned 0x0 [0220.276] IUnknown:QueryInterface (in: This=0x5090b8, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f2b8 | out: ppvObject=0x19f2b8*=0x5090bc) returned 0x0 [0220.277] IClientSecurity:QueryBlanket (in: This=0x5090bc, pProxy=0x5090b8, pAuthnSvc=0x19f308, pAuthzSvc=0x19f304, pServerPrincName=0x19f2fc, pAuthnLevel=0x19f300, pImpLevel=0x19f2f0, pAuthInfo=0x19f2f4, pCapabilites=0x19f2f8 | out: pAuthnSvc=0x19f308*=0xa, pAuthzSvc=0x19f304*=0x0, pServerPrincName=0x19f2fc, pAuthnLevel=0x19f300*=0x6, pImpLevel=0x19f2f0*=0x2, pAuthInfo=0x19f2f4, pCapabilites=0x19f2f8*=0x1) returned 0x0 [0220.277] IUnknown:Release (This=0x5090bc) returned 0x1 [0220.277] IUnknown:QueryInterface (in: This=0x5090b8, riid=0x6c8110f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f2ac | out: ppvObject=0x19f2ac*=0x501388) returned 0x0 [0220.277] IUnknown:QueryInterface (in: This=0x5090b8, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f2a8 | out: ppvObject=0x19f2a8*=0x5090bc) returned 0x0 [0220.277] IClientSecurity:SetBlanket (This=0x5090bc, pProxy=0x5090b8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0220.305] IUnknown:Release (This=0x5090bc) returned 0x2 [0220.305] WbemLocator:IUnknown:Release (This=0x501388) returned 0x1 [0220.305] CoTaskMemFree (pv=0x5038b0) [0220.305] IUnknown:QueryInterface (in: This=0x5090b8, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee94 | out: ppvObject=0x19ee94*=0x501388) returned 0x0 [0220.306] WbemLocator:IUnknown:QueryInterface (in: This=0x501388, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ee50 | out: ppvObject=0x19ee50*=0x0) returned 0x80004002 [0220.315] WbemLocator:IUnknown:QueryInterface (in: This=0x501388, riid=0x6c29fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ec6c | out: ppvObject=0x19ec6c*=0x0) returned 0x80004002 [0220.353] IUnknown:QueryInterface (in: This=0x5090b8, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19ea44 | out: ppvObject=0x19ea44*=0x0) returned 0x80004002 [0220.485] WbemLocator:IUnknown:AddRef (This=0x501388) returned 0x3 [0220.485] WbemLocator:IUnknown:QueryInterface (in: This=0x501388, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e7ac | out: ppvObject=0x19e7ac*=0x0) returned 0x80004002 [0220.485] WbemLocator:IUnknown:QueryInterface (in: This=0x501388, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e75c | out: ppvObject=0x19e75c*=0x0) returned 0x80004002 [0220.485] WbemLocator:IUnknown:QueryInterface (in: This=0x501388, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e768 | out: ppvObject=0x19e768*=0x5012e4) returned 0x0 [0220.485] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5012e4, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e770 | out: pCid=0x19e770*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0220.486] WbemLocator:IUnknown:Release (This=0x5012e4) returned 0x3 [0220.486] CoGetContextToken (in: pToken=0x19e7c8 | out: pToken=0x19e7c8) returned 0x0 [0220.486] CoGetContextToken (in: pToken=0x19ebd0 | out: pToken=0x19ebd0) returned 0x0 [0220.486] WbemLocator:IUnknown:QueryInterface (in: This=0x501388, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec60 | out: ppvObject=0x19ec60*=0x50136c) returned 0x0 [0220.486] WbemLocator:IRpcOptions:Query (in: This=0x50136c, pPrx=0x501388, dwProperty=2, pdwValue=0x19ec88 | out: pdwValue=0x19ec88) returned 0x80004002 [0220.486] WbemLocator:IUnknown:Release (This=0x50136c) returned 0x3 [0220.486] WbemLocator:IUnknown:Release (This=0x501388) returned 0x2 [0220.486] CoGetContextToken (in: pToken=0x19f1a8 | out: pToken=0x19f1a8) returned 0x0 [0220.486] CoGetContextToken (in: pToken=0x19f108 | out: pToken=0x19f108) returned 0x0 [0220.487] WbemLocator:IUnknown:QueryInterface (in: This=0x501388, riid=0x19f1d8*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f1d4 | out: ppvObject=0x19f1d4*=0x5090b8) returned 0x0 [0220.487] IUnknown:AddRef (This=0x5090b8) returned 0x4 [0220.487] IUnknown:Release (This=0x5090b8) returned 0x3 [0220.487] IUnknown:Release (This=0x5090b8) returned 0x2 [0220.487] IUnknown:Release (This=0x509ae0) returned 0x2 [0220.487] SysStringLen (param_1=0x0) returned 0x0 [0220.487] IEnumWbemClassObject:Reset (This=0x5090b8) returned 0x0 [0220.573] CoTaskMemAlloc (cb=0x4) returned 0x517960 [0220.573] IEnumWbemClassObject:Next (in: This=0x5090b8, lTimeout=-1, uCount=0x1, apObjects=0x517960, puReturned=0x22075c8 | out: apObjects=0x517960*=0x4e86b8, puReturned=0x22075c8*=0x1) returned 0x0 [0220.591] IUnknown:QueryInterface (in: This=0x4e86b8, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea58 | out: ppvObject=0x19ea58*=0x4e86b8) returned 0x0 [0220.591] IUnknown:QueryInterface (in: This=0x4e86b8, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ea14 | out: ppvObject=0x19ea14*=0x0) returned 0x80004002 [0220.591] IUnknown:QueryInterface (in: This=0x4e86b8, riid=0x6c29fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e834 | out: ppvObject=0x19e834*=0x0) returned 0x80004002 [0220.591] IUnknown:QueryInterface (in: This=0x4e86b8, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e60c | out: ppvObject=0x19e60c*=0x0) returned 0x80004002 [0220.592] IUnknown:AddRef (This=0x4e86b8) returned 0x3 [0220.592] IUnknown:QueryInterface (in: This=0x4e86b8, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e374 | out: ppvObject=0x19e374*=0x0) returned 0x80004002 [0220.592] IUnknown:QueryInterface (in: This=0x4e86b8, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e324 | out: ppvObject=0x19e324*=0x0) returned 0x80004002 [0220.592] IUnknown:QueryInterface (in: This=0x4e86b8, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e330 | out: ppvObject=0x19e330*=0x4e86bc) returned 0x0 [0220.592] IMarshal:GetUnmarshalClass (in: This=0x4e86bc, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e338 | out: pCid=0x19e338*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0220.592] IUnknown:Release (This=0x4e86bc) returned 0x3 [0220.592] CoGetContextToken (in: pToken=0x19e390 | out: pToken=0x19e390) returned 0x0 [0220.592] CoGetContextToken (in: pToken=0x19e798 | out: pToken=0x19e798) returned 0x0 [0220.592] IUnknown:QueryInterface (in: This=0x4e86b8, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e828 | out: ppvObject=0x19e828*=0x0) returned 0x80004002 [0220.592] IUnknown:Release (This=0x4e86b8) returned 0x2 [0220.592] CoGetContextToken (in: pToken=0x19ed68 | out: pToken=0x19ed68) returned 0x0 [0220.592] CoGetContextToken (in: pToken=0x19ecc8 | out: pToken=0x19ecc8) returned 0x0 [0220.592] IUnknown:QueryInterface (in: This=0x4e86b8, riid=0x19ed98*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ed94 | out: ppvObject=0x19ed94*=0x4e86b8) returned 0x0 [0220.592] IUnknown:AddRef (This=0x4e86b8) returned 0x4 [0220.592] IUnknown:Release (This=0x4e86b8) returned 0x3 [0220.592] IUnknown:Release (This=0x4e86b8) returned 0x2 [0220.593] CoTaskMemFree (pv=0x517960) [0220.593] CoGetContextToken (in: pToken=0x19f0d0 | out: pToken=0x19f0d0) returned 0x0 [0220.593] IUnknown:AddRef (This=0x4e86b8) returned 0x3 [0220.593] IWbemClassObject:Get (in: This=0x4e86b8, wszName="__GENUS", lFlags=0, pVal=0x19f3e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f464*=0, plFlavor=0x19f460*=0 | out: pVal=0x19f3e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f464*=3, plFlavor=0x19f460*=64) returned 0x0 [0220.593] IWbemClassObject:Get (in: This=0x4e86b8, wszName="__PATH", lFlags=0, pVal=0x19f3c8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f44c*=0, plFlavor=0x19f448*=0 | out: pVal=0x19f3c8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=0", varVal2=0x0), pType=0x19f44c*=8, plFlavor=0x19f448*=64) returned 0x0 [0220.593] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=0") returned 0x7a [0220.594] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=0") returned 0x7a [0220.594] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x46c [0220.594] SetEvent (hEvent=0x3c8) returned 1 [0220.594] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f3a0*=0x46c, lpdwindex=0x19f1bc | out: lpdwindex=0x19f1bc) returned 0x0 [0220.605] CoGetContextToken (in: pToken=0x19f270 | out: pToken=0x19f270) returned 0x0 [0220.605] CoGetContextToken (in: pToken=0x19f1d0 | out: pToken=0x19f1d0) returned 0x0 [0220.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x52c558, riid=0x19f2a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x52c558) returned 0x0 [0220.605] WbemDefPath:IUnknown:AddRef (This=0x52c558) returned 0x3 [0220.605] WbemDefPath:IUnknown:Release (This=0x52c558) returned 0x2 [0220.606] WbemDefPath:IWbemPath:SetText (This=0x52c558, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=0") returned 0x0 [0220.606] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0418, puCount=0x19f420 | out: puCount=0x19f420*=0x2) returned 0x0 [0220.606] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=4, puBuffLength=0x19f41c*=0x0, pszText=0x0 | out: puBuffLength=0x19f41c*=0xf, pszText=0x0) returned 0x0 [0220.606] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=4, puBuffLength=0x19f41c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f41c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0220.609] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0418, puCount=0x19f3ec | out: puCount=0x19f3ec*=0x2) returned 0x0 [0220.610] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=4, puBuffLength=0x19f3e8*=0x0, pszText=0x0 | out: puBuffLength=0x19f3e8*=0xf, pszText=0x0) returned 0x0 [0220.610] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=4, puBuffLength=0x19f3e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0220.610] IWbemClassObject:Get (in: This=0x4e86b8, wszName="IPEnabled", lFlags=0, pVal=0x19f3e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2207e60*=0, plFlavor=0x2207e64*=0 | out: pVal=0x19f3e8*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2207e60*=11, plFlavor=0x2207e64*=0) returned 0x0 [0220.610] IWbemClassObject:Get (in: This=0x4e86b8, wszName="IPEnabled", lFlags=0, pVal=0x19f3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2207e60*=11, plFlavor=0x2207e64*=0 | out: pVal=0x19f3f0*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2207e60*=11, plFlavor=0x2207e64*=0) returned 0x0 [0220.648] IUnknown:Release (This=0x4e86b8) returned 0x2 [0220.653] CoTaskMemAlloc (cb=0x4) returned 0x517ac0 [0220.653] IEnumWbemClassObject:Next (in: This=0x5090b8, lTimeout=-1, uCount=0x1, apObjects=0x517ac0, puReturned=0x22075c8 | out: apObjects=0x517ac0*=0x4e8eb0, puReturned=0x22075c8*=0x1) returned 0x0 [0220.657] IUnknown:QueryInterface (in: This=0x4e8eb0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea58 | out: ppvObject=0x19ea58*=0x4e8eb0) returned 0x0 [0220.657] IUnknown:QueryInterface (in: This=0x4e8eb0, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ea14 | out: ppvObject=0x19ea14*=0x0) returned 0x80004002 [0220.657] IUnknown:QueryInterface (in: This=0x4e8eb0, riid=0x6c29fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e834 | out: ppvObject=0x19e834*=0x0) returned 0x80004002 [0220.657] IUnknown:QueryInterface (in: This=0x4e8eb0, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e60c | out: ppvObject=0x19e60c*=0x0) returned 0x80004002 [0220.657] IUnknown:AddRef (This=0x4e8eb0) returned 0x3 [0220.657] IUnknown:QueryInterface (in: This=0x4e8eb0, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e374 | out: ppvObject=0x19e374*=0x0) returned 0x80004002 [0220.657] IUnknown:QueryInterface (in: This=0x4e8eb0, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e324 | out: ppvObject=0x19e324*=0x0) returned 0x80004002 [0220.657] IUnknown:QueryInterface (in: This=0x4e8eb0, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e330 | out: ppvObject=0x19e330*=0x4e8eb4) returned 0x0 [0220.657] IMarshal:GetUnmarshalClass (in: This=0x4e8eb4, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e338 | out: pCid=0x19e338*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0220.657] IUnknown:Release (This=0x4e8eb4) returned 0x3 [0220.658] CoGetContextToken (in: pToken=0x19e390 | out: pToken=0x19e390) returned 0x0 [0220.658] CoGetContextToken (in: pToken=0x19e798 | out: pToken=0x19e798) returned 0x0 [0220.658] IUnknown:QueryInterface (in: This=0x4e8eb0, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e828 | out: ppvObject=0x19e828*=0x0) returned 0x80004002 [0220.658] IUnknown:Release (This=0x4e8eb0) returned 0x2 [0220.658] CoGetContextToken (in: pToken=0x19ed68 | out: pToken=0x19ed68) returned 0x0 [0220.658] CoGetContextToken (in: pToken=0x19ecc8 | out: pToken=0x19ecc8) returned 0x0 [0220.658] IUnknown:QueryInterface (in: This=0x4e8eb0, riid=0x19ed98*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ed94 | out: ppvObject=0x19ed94*=0x4e8eb0) returned 0x0 [0220.658] IUnknown:AddRef (This=0x4e8eb0) returned 0x4 [0220.658] IUnknown:Release (This=0x4e8eb0) returned 0x3 [0220.658] IUnknown:Release (This=0x4e8eb0) returned 0x2 [0220.658] CoTaskMemFree (pv=0x517ac0) [0220.658] CoGetContextToken (in: pToken=0x19f0d0 | out: pToken=0x19f0d0) returned 0x0 [0220.658] IUnknown:AddRef (This=0x4e8eb0) returned 0x3 [0220.658] IWbemClassObject:Get (in: This=0x4e8eb0, wszName="__GENUS", lFlags=0, pVal=0x19f3e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f464*=0, plFlavor=0x19f460*=0 | out: pVal=0x19f3e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f464*=3, plFlavor=0x19f460*=64) returned 0x0 [0220.658] IWbemClassObject:Get (in: This=0x4e8eb0, wszName="__PATH", lFlags=0, pVal=0x19f3c8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f44c*=0, plFlavor=0x19f448*=0 | out: pVal=0x19f3c8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=1", varVal2=0x0), pType=0x19f44c*=8, plFlavor=0x19f448*=64) returned 0x0 [0220.659] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=1") returned 0x7a [0220.659] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=1") returned 0x7a [0220.659] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x470 [0220.659] SetEvent (hEvent=0x3c8) returned 1 [0220.659] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f3a0*=0x470, lpdwindex=0x19f1bc | out: lpdwindex=0x19f1bc) returned 0x0 [0220.662] CoGetContextToken (in: pToken=0x19f270 | out: pToken=0x19f270) returned 0x0 [0220.662] CoGetContextToken (in: pToken=0x19f1d0 | out: pToken=0x19f1d0) returned 0x0 [0220.662] WbemDefPath:IUnknown:QueryInterface (in: This=0x52cb78, riid=0x19f2a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x52cb78) returned 0x0 [0220.662] WbemDefPath:IUnknown:AddRef (This=0x52cb78) returned 0x3 [0220.662] WbemDefPath:IUnknown:Release (This=0x52cb78) returned 0x2 [0220.662] WbemDefPath:IWbemPath:SetText (This=0x52cb78, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=1") returned 0x0 [0220.662] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0418, puCount=0x19f420 | out: puCount=0x19f420*=0x2) returned 0x0 [0220.662] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=4, puBuffLength=0x19f41c*=0x0, pszText=0x0 | out: puBuffLength=0x19f41c*=0xf, pszText=0x0) returned 0x0 [0220.662] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=4, puBuffLength=0x19f41c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f41c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0220.662] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0418, puCount=0x19f3ec | out: puCount=0x19f3ec*=0x2) returned 0x0 [0220.662] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=4, puBuffLength=0x19f3e8*=0x0, pszText=0x0 | out: puBuffLength=0x19f3e8*=0xf, pszText=0x0) returned 0x0 [0220.662] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=4, puBuffLength=0x19f3e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0220.663] IWbemClassObject:Get (in: This=0x4e8eb0, wszName="IPEnabled", lFlags=0, pVal=0x19f3e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2208938*=0, plFlavor=0x220893c*=0 | out: pVal=0x19f3e8*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2208938*=11, plFlavor=0x220893c*=0) returned 0x0 [0220.663] IWbemClassObject:Get (in: This=0x4e8eb0, wszName="IPEnabled", lFlags=0, pVal=0x19f3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2208938*=11, plFlavor=0x220893c*=0 | out: pVal=0x19f3f0*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2208938*=11, plFlavor=0x220893c*=0) returned 0x0 [0220.663] IUnknown:Release (This=0x4e8eb0) returned 0x2 [0220.663] CoTaskMemAlloc (cb=0x4) returned 0x517aa0 [0220.663] IEnumWbemClassObject:Next (in: This=0x5090b8, lTimeout=-1, uCount=0x1, apObjects=0x517aa0, puReturned=0x22075c8 | out: apObjects=0x517aa0*=0x5460c0, puReturned=0x22075c8*=0x1) returned 0x0 [0220.666] IUnknown:QueryInterface (in: This=0x5460c0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea58 | out: ppvObject=0x19ea58*=0x5460c0) returned 0x0 [0220.667] IUnknown:QueryInterface (in: This=0x5460c0, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ea14 | out: ppvObject=0x19ea14*=0x0) returned 0x80004002 [0220.667] IUnknown:QueryInterface (in: This=0x5460c0, riid=0x6c29fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e834 | out: ppvObject=0x19e834*=0x0) returned 0x80004002 [0220.667] IUnknown:QueryInterface (in: This=0x5460c0, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e60c | out: ppvObject=0x19e60c*=0x0) returned 0x80004002 [0220.667] IUnknown:AddRef (This=0x5460c0) returned 0x3 [0220.667] IUnknown:QueryInterface (in: This=0x5460c0, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e374 | out: ppvObject=0x19e374*=0x0) returned 0x80004002 [0220.667] IUnknown:QueryInterface (in: This=0x5460c0, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e324 | out: ppvObject=0x19e324*=0x0) returned 0x80004002 [0220.667] IUnknown:QueryInterface (in: This=0x5460c0, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e330 | out: ppvObject=0x19e330*=0x5460c4) returned 0x0 [0220.667] IMarshal:GetUnmarshalClass (in: This=0x5460c4, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e338 | out: pCid=0x19e338*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0220.667] IUnknown:Release (This=0x5460c4) returned 0x3 [0220.667] CoGetContextToken (in: pToken=0x19e390 | out: pToken=0x19e390) returned 0x0 [0220.667] CoGetContextToken (in: pToken=0x19e798 | out: pToken=0x19e798) returned 0x0 [0220.667] IUnknown:QueryInterface (in: This=0x5460c0, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e828 | out: ppvObject=0x19e828*=0x0) returned 0x80004002 [0220.667] IUnknown:Release (This=0x5460c0) returned 0x2 [0220.667] CoGetContextToken (in: pToken=0x19ed68 | out: pToken=0x19ed68) returned 0x0 [0220.667] CoGetContextToken (in: pToken=0x19ecc8 | out: pToken=0x19ecc8) returned 0x0 [0220.667] IUnknown:QueryInterface (in: This=0x5460c0, riid=0x19ed98*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ed94 | out: ppvObject=0x19ed94*=0x5460c0) returned 0x0 [0220.668] IUnknown:AddRef (This=0x5460c0) returned 0x4 [0220.668] IUnknown:Release (This=0x5460c0) returned 0x3 [0220.668] IUnknown:Release (This=0x5460c0) returned 0x2 [0220.668] CoTaskMemFree (pv=0x517aa0) [0220.668] CoGetContextToken (in: pToken=0x19f0d0 | out: pToken=0x19f0d0) returned 0x0 [0220.668] IUnknown:AddRef (This=0x5460c0) returned 0x3 [0220.668] IWbemClassObject:Get (in: This=0x5460c0, wszName="__GENUS", lFlags=0, pVal=0x19f3e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f464*=0, plFlavor=0x19f460*=0 | out: pVal=0x19f3e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f464*=3, plFlavor=0x19f460*=64) returned 0x0 [0220.668] IWbemClassObject:Get (in: This=0x5460c0, wszName="__PATH", lFlags=0, pVal=0x19f3c8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f44c*=0, plFlavor=0x19f448*=0 | out: pVal=0x19f3c8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=2", varVal2=0x0), pType=0x19f44c*=8, plFlavor=0x19f448*=64) returned 0x0 [0220.668] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=2") returned 0x7a [0220.668] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=2") returned 0x7a [0220.668] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x47c [0220.668] SetEvent (hEvent=0x3c8) returned 1 [0220.668] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f3a0*=0x47c, lpdwindex=0x19f1bc | out: lpdwindex=0x19f1bc) returned 0x0 [0220.671] CoGetContextToken (in: pToken=0x19f270 | out: pToken=0x19f270) returned 0x0 [0220.671] CoGetContextToken (in: pToken=0x19f1d0 | out: pToken=0x19f1d0) returned 0x0 [0220.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x52ca98, riid=0x19f2a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x52ca98) returned 0x0 [0220.671] WbemDefPath:IUnknown:AddRef (This=0x52ca98) returned 0x3 [0220.671] WbemDefPath:IUnknown:Release (This=0x52ca98) returned 0x2 [0220.671] WbemDefPath:IWbemPath:SetText (This=0x52ca98, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=2") returned 0x0 [0220.671] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0418, puCount=0x19f420 | out: puCount=0x19f420*=0x2) returned 0x0 [0220.671] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=4, puBuffLength=0x19f41c*=0x0, pszText=0x0 | out: puBuffLength=0x19f41c*=0xf, pszText=0x0) returned 0x0 [0220.672] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=4, puBuffLength=0x19f41c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f41c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0220.672] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0418, puCount=0x19f3ec | out: puCount=0x19f3ec*=0x2) returned 0x0 [0220.672] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=4, puBuffLength=0x19f3e8*=0x0, pszText=0x0 | out: puBuffLength=0x19f3e8*=0xf, pszText=0x0) returned 0x0 [0220.672] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=4, puBuffLength=0x19f3e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0220.672] IWbemClassObject:Get (in: This=0x5460c0, wszName="IPEnabled", lFlags=0, pVal=0x19f3e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22091ac*=0, plFlavor=0x22091b0*=0 | out: pVal=0x19f3e8*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22091ac*=11, plFlavor=0x22091b0*=0) returned 0x0 [0220.672] IWbemClassObject:Get (in: This=0x5460c0, wszName="IPEnabled", lFlags=0, pVal=0x19f3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22091ac*=11, plFlavor=0x22091b0*=0 | out: pVal=0x19f3f0*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22091ac*=11, plFlavor=0x22091b0*=0) returned 0x0 [0220.672] IUnknown:Release (This=0x5460c0) returned 0x2 [0220.672] CoTaskMemAlloc (cb=0x4) returned 0x517ac0 [0220.672] IEnumWbemClassObject:Next (in: This=0x5090b8, lTimeout=-1, uCount=0x1, apObjects=0x517ac0, puReturned=0x22075c8 | out: apObjects=0x517ac0*=0x546d80, puReturned=0x22075c8*=0x1) returned 0x0 [0220.676] IUnknown:QueryInterface (in: This=0x546d80, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea58 | out: ppvObject=0x19ea58*=0x546d80) returned 0x0 [0220.676] IUnknown:QueryInterface (in: This=0x546d80, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ea14 | out: ppvObject=0x19ea14*=0x0) returned 0x80004002 [0220.676] IUnknown:QueryInterface (in: This=0x546d80, riid=0x6c29fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e834 | out: ppvObject=0x19e834*=0x0) returned 0x80004002 [0220.676] IUnknown:QueryInterface (in: This=0x546d80, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e60c | out: ppvObject=0x19e60c*=0x0) returned 0x80004002 [0220.676] IUnknown:AddRef (This=0x546d80) returned 0x3 [0220.677] IUnknown:QueryInterface (in: This=0x546d80, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e374 | out: ppvObject=0x19e374*=0x0) returned 0x80004002 [0220.677] IUnknown:QueryInterface (in: This=0x546d80, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e324 | out: ppvObject=0x19e324*=0x0) returned 0x80004002 [0220.677] IUnknown:QueryInterface (in: This=0x546d80, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e330 | out: ppvObject=0x19e330*=0x546d84) returned 0x0 [0220.677] IMarshal:GetUnmarshalClass (in: This=0x546d84, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e338 | out: pCid=0x19e338*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0220.677] IUnknown:Release (This=0x546d84) returned 0x3 [0220.677] CoGetContextToken (in: pToken=0x19e390 | out: pToken=0x19e390) returned 0x0 [0220.677] CoGetContextToken (in: pToken=0x19e798 | out: pToken=0x19e798) returned 0x0 [0220.677] IUnknown:QueryInterface (in: This=0x546d80, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e828 | out: ppvObject=0x19e828*=0x0) returned 0x80004002 [0220.677] IUnknown:Release (This=0x546d80) returned 0x2 [0220.677] CoGetContextToken (in: pToken=0x19ed68 | out: pToken=0x19ed68) returned 0x0 [0220.677] CoGetContextToken (in: pToken=0x19ecc8 | out: pToken=0x19ecc8) returned 0x0 [0220.677] IUnknown:QueryInterface (in: This=0x546d80, riid=0x19ed98*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ed94 | out: ppvObject=0x19ed94*=0x546d80) returned 0x0 [0220.677] IUnknown:AddRef (This=0x546d80) returned 0x4 [0220.677] IUnknown:Release (This=0x546d80) returned 0x3 [0220.677] IUnknown:Release (This=0x546d80) returned 0x2 [0220.677] CoTaskMemFree (pv=0x517ac0) [0220.677] CoGetContextToken (in: pToken=0x19f0d0 | out: pToken=0x19f0d0) returned 0x0 [0220.677] IUnknown:AddRef (This=0x546d80) returned 0x3 [0220.677] IWbemClassObject:Get (in: This=0x546d80, wszName="__GENUS", lFlags=0, pVal=0x19f3e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f464*=0, plFlavor=0x19f460*=0 | out: pVal=0x19f3e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f464*=3, plFlavor=0x19f460*=64) returned 0x0 [0220.678] IWbemClassObject:Get (in: This=0x546d80, wszName="__PATH", lFlags=0, pVal=0x19f3c8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f44c*=0, plFlavor=0x19f448*=0 | out: pVal=0x19f3c8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=3", varVal2=0x0), pType=0x19f44c*=8, plFlavor=0x19f448*=64) returned 0x0 [0220.678] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=3") returned 0x7a [0220.678] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=3") returned 0x7a [0220.678] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x480 [0220.678] SetEvent (hEvent=0x3c8) returned 1 [0220.678] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f3a0*=0x480, lpdwindex=0x19f1bc | out: lpdwindex=0x19f1bc) returned 0x0 [0220.680] CoGetContextToken (in: pToken=0x19f270 | out: pToken=0x19f270) returned 0x0 [0220.681] CoGetContextToken (in: pToken=0x19f1d0 | out: pToken=0x19f1d0) returned 0x0 [0220.681] WbemDefPath:IUnknown:QueryInterface (in: This=0x52c328, riid=0x19f2a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x52c328) returned 0x0 [0220.681] WbemDefPath:IUnknown:AddRef (This=0x52c328) returned 0x3 [0220.681] WbemDefPath:IUnknown:Release (This=0x52c328) returned 0x2 [0220.681] WbemDefPath:IWbemPath:SetText (This=0x52c328, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=3") returned 0x0 [0220.681] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0418, puCount=0x19f420 | out: puCount=0x19f420*=0x2) returned 0x0 [0220.681] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=4, puBuffLength=0x19f41c*=0x0, pszText=0x0 | out: puBuffLength=0x19f41c*=0xf, pszText=0x0) returned 0x0 [0220.681] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=4, puBuffLength=0x19f41c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f41c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0220.681] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0418, puCount=0x19f3ec | out: puCount=0x19f3ec*=0x2) returned 0x0 [0220.681] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=4, puBuffLength=0x19f3e8*=0x0, pszText=0x0 | out: puBuffLength=0x19f3e8*=0xf, pszText=0x0) returned 0x0 [0220.681] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=4, puBuffLength=0x19f3e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0220.681] IWbemClassObject:Get (in: This=0x546d80, wszName="IPEnabled", lFlags=0, pVal=0x19f3e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2209a20*=0, plFlavor=0x2209a24*=0 | out: pVal=0x19f3e8*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2209a20*=11, plFlavor=0x2209a24*=0) returned 0x0 [0220.681] IWbemClassObject:Get (in: This=0x546d80, wszName="IPEnabled", lFlags=0, pVal=0x19f3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2209a20*=11, plFlavor=0x2209a24*=0 | out: pVal=0x19f3f0*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2209a20*=11, plFlavor=0x2209a24*=0) returned 0x0 [0220.681] IUnknown:Release (This=0x546d80) returned 0x2 [0220.681] CoTaskMemAlloc (cb=0x4) returned 0x517a00 [0220.681] IEnumWbemClassObject:Next (in: This=0x5090b8, lTimeout=-1, uCount=0x1, apObjects=0x517a00, puReturned=0x22075c8 | out: apObjects=0x517a00*=0x546a50, puReturned=0x22075c8*=0x1) returned 0x0 [0220.685] IUnknown:QueryInterface (in: This=0x546a50, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea58 | out: ppvObject=0x19ea58*=0x546a50) returned 0x0 [0220.686] IUnknown:QueryInterface (in: This=0x546a50, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ea14 | out: ppvObject=0x19ea14*=0x0) returned 0x80004002 [0220.686] IUnknown:QueryInterface (in: This=0x546a50, riid=0x6c29fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e834 | out: ppvObject=0x19e834*=0x0) returned 0x80004002 [0220.686] IUnknown:QueryInterface (in: This=0x546a50, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e60c | out: ppvObject=0x19e60c*=0x0) returned 0x80004002 [0220.686] IUnknown:AddRef (This=0x546a50) returned 0x3 [0220.686] IUnknown:QueryInterface (in: This=0x546a50, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e374 | out: ppvObject=0x19e374*=0x0) returned 0x80004002 [0220.686] IUnknown:QueryInterface (in: This=0x546a50, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e324 | out: ppvObject=0x19e324*=0x0) returned 0x80004002 [0220.686] IUnknown:QueryInterface (in: This=0x546a50, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e330 | out: ppvObject=0x19e330*=0x546a54) returned 0x0 [0220.686] IMarshal:GetUnmarshalClass (in: This=0x546a54, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e338 | out: pCid=0x19e338*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0220.686] IUnknown:Release (This=0x546a54) returned 0x3 [0220.686] CoGetContextToken (in: pToken=0x19e390 | out: pToken=0x19e390) returned 0x0 [0220.687] CoGetContextToken (in: pToken=0x19e798 | out: pToken=0x19e798) returned 0x0 [0220.687] IUnknown:QueryInterface (in: This=0x546a50, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e828 | out: ppvObject=0x19e828*=0x0) returned 0x80004002 [0220.687] IUnknown:Release (This=0x546a50) returned 0x2 [0220.687] CoGetContextToken (in: pToken=0x19ed68 | out: pToken=0x19ed68) returned 0x0 [0220.687] CoGetContextToken (in: pToken=0x19ecc8 | out: pToken=0x19ecc8) returned 0x0 [0220.687] IUnknown:QueryInterface (in: This=0x546a50, riid=0x19ed98*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ed94 | out: ppvObject=0x19ed94*=0x546a50) returned 0x0 [0220.687] IUnknown:AddRef (This=0x546a50) returned 0x4 [0220.687] IUnknown:Release (This=0x546a50) returned 0x3 [0220.687] IUnknown:Release (This=0x546a50) returned 0x2 [0220.687] CoTaskMemFree (pv=0x517a00) [0220.687] CoGetContextToken (in: pToken=0x19f0d0 | out: pToken=0x19f0d0) returned 0x0 [0220.687] IUnknown:AddRef (This=0x546a50) returned 0x3 [0220.687] IWbemClassObject:Get (in: This=0x546a50, wszName="__GENUS", lFlags=0, pVal=0x19f3e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f464*=0, plFlavor=0x19f460*=0 | out: pVal=0x19f3e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f464*=3, plFlavor=0x19f460*=64) returned 0x0 [0220.687] IWbemClassObject:Get (in: This=0x546a50, wszName="__PATH", lFlags=0, pVal=0x19f3c8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f44c*=0, plFlavor=0x19f448*=0 | out: pVal=0x19f3c8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=4", varVal2=0x0), pType=0x19f44c*=8, plFlavor=0x19f448*=64) returned 0x0 [0220.687] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=4") returned 0x7a [0220.687] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=4") returned 0x7a [0220.687] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x484 [0220.688] SetEvent (hEvent=0x3c8) returned 1 [0220.688] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f3a0*=0x484, lpdwindex=0x19f1bc | out: lpdwindex=0x19f1bc) returned 0x0 [0220.691] CoGetContextToken (in: pToken=0x19f270 | out: pToken=0x19f270) returned 0x0 [0220.691] CoGetContextToken (in: pToken=0x19f1d0 | out: pToken=0x19f1d0) returned 0x0 [0220.691] WbemDefPath:IUnknown:QueryInterface (in: This=0x52bde8, riid=0x19f2a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x52bde8) returned 0x0 [0220.691] WbemDefPath:IUnknown:AddRef (This=0x52bde8) returned 0x3 [0220.691] WbemDefPath:IUnknown:Release (This=0x52bde8) returned 0x2 [0220.691] WbemDefPath:IWbemPath:SetText (This=0x52bde8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=4") returned 0x0 [0220.691] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0418, puCount=0x19f420 | out: puCount=0x19f420*=0x2) returned 0x0 [0220.691] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=4, puBuffLength=0x19f41c*=0x0, pszText=0x0 | out: puBuffLength=0x19f41c*=0xf, pszText=0x0) returned 0x0 [0220.691] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=4, puBuffLength=0x19f41c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f41c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0220.691] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0418, puCount=0x19f3ec | out: puCount=0x19f3ec*=0x2) returned 0x0 [0220.691] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=4, puBuffLength=0x19f3e8*=0x0, pszText=0x0 | out: puBuffLength=0x19f3e8*=0xf, pszText=0x0) returned 0x0 [0220.691] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=4, puBuffLength=0x19f3e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0220.691] IWbemClassObject:Get (in: This=0x546a50, wszName="IPEnabled", lFlags=0, pVal=0x19f3e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x220a294*=0, plFlavor=0x220a298*=0 | out: pVal=0x19f3e8*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xffff, varVal2=0x0), pType=0x220a294*=11, plFlavor=0x220a298*=0) returned 0x0 [0220.691] IWbemClassObject:Get (in: This=0x546a50, wszName="IPEnabled", lFlags=0, pVal=0x19f3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x220a294*=11, plFlavor=0x220a298*=0 | out: pVal=0x19f3f0*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xffff, varVal2=0x0), pType=0x220a294*=11, plFlavor=0x220a298*=0) returned 0x0 [0220.694] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0418, puCount=0x19f3ec | out: puCount=0x19f3ec*=0x2) returned 0x0 [0220.694] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=4, puBuffLength=0x19f3e8*=0x0, pszText=0x0 | out: puBuffLength=0x19f3e8*=0xf, pszText=0x0) returned 0x0 [0220.694] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=4, puBuffLength=0x19f3e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0220.694] IWbemClassObject:Get (in: This=0x546a50, wszName="MacAddress", lFlags=0, pVal=0x19f3e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x220a330*=0, plFlavor=0x220a334*=0 | out: pVal=0x19f3e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C8:D5:FE:BF:58:B6", varVal2=0x0), pType=0x220a330*=8, plFlavor=0x220a334*=0) returned 0x0 [0220.695] SysStringByteLen (bstr="C8:D5:FE:BF:58:B6") returned 0x22 [0220.695] SysStringByteLen (bstr="C8:D5:FE:BF:58:B6") returned 0x22 [0220.695] IWbemClassObject:Get (in: This=0x546a50, wszName="MacAddress", lFlags=0, pVal=0x19f3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x220a330*=8, plFlavor=0x220a334*=0 | out: pVal=0x19f3f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C8:D5:FE:BF:58:B6", varVal2=0x0), pType=0x220a330*=8, plFlavor=0x220a334*=0) returned 0x0 [0220.695] SysStringByteLen (bstr="C8:D5:FE:BF:58:B6") returned 0x22 [0220.695] SysStringByteLen (bstr="C8:D5:FE:BF:58:B6") returned 0x22 [0220.695] IUnknown:Release (This=0x546a50) returned 0x2 [0220.695] CoTaskMemAlloc (cb=0x4) returned 0x517a30 [0220.695] IEnumWbemClassObject:Next (in: This=0x5090b8, lTimeout=-1, uCount=0x1, apObjects=0x517a30, puReturned=0x22075c8 | out: apObjects=0x517a30*=0x5470b0, puReturned=0x22075c8*=0x1) returned 0x0 [0220.699] IUnknown:QueryInterface (in: This=0x5470b0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea58 | out: ppvObject=0x19ea58*=0x5470b0) returned 0x0 [0220.699] IUnknown:QueryInterface (in: This=0x5470b0, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ea14 | out: ppvObject=0x19ea14*=0x0) returned 0x80004002 [0220.699] IUnknown:QueryInterface (in: This=0x5470b0, riid=0x6c29fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e834 | out: ppvObject=0x19e834*=0x0) returned 0x80004002 [0220.699] IUnknown:QueryInterface (in: This=0x5470b0, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e60c | out: ppvObject=0x19e60c*=0x0) returned 0x80004002 [0220.700] IUnknown:AddRef (This=0x5470b0) returned 0x3 [0220.700] IUnknown:QueryInterface (in: This=0x5470b0, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e374 | out: ppvObject=0x19e374*=0x0) returned 0x80004002 [0220.700] IUnknown:QueryInterface (in: This=0x5470b0, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e324 | out: ppvObject=0x19e324*=0x0) returned 0x80004002 [0220.700] IUnknown:QueryInterface (in: This=0x5470b0, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e330 | out: ppvObject=0x19e330*=0x5470b4) returned 0x0 [0220.700] IMarshal:GetUnmarshalClass (in: This=0x5470b4, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e338 | out: pCid=0x19e338*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0220.700] IUnknown:Release (This=0x5470b4) returned 0x3 [0220.700] CoGetContextToken (in: pToken=0x19e390 | out: pToken=0x19e390) returned 0x0 [0220.700] CoGetContextToken (in: pToken=0x19e798 | out: pToken=0x19e798) returned 0x0 [0220.700] IUnknown:QueryInterface (in: This=0x5470b0, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e828 | out: ppvObject=0x19e828*=0x0) returned 0x80004002 [0220.700] IUnknown:Release (This=0x5470b0) returned 0x2 [0220.700] CoGetContextToken (in: pToken=0x19ed68 | out: pToken=0x19ed68) returned 0x0 [0220.700] CoGetContextToken (in: pToken=0x19ecc8 | out: pToken=0x19ecc8) returned 0x0 [0220.700] IUnknown:QueryInterface (in: This=0x5470b0, riid=0x19ed98*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ed94 | out: ppvObject=0x19ed94*=0x5470b0) returned 0x0 [0220.700] IUnknown:AddRef (This=0x5470b0) returned 0x4 [0220.700] IUnknown:Release (This=0x5470b0) returned 0x3 [0220.700] IUnknown:Release (This=0x5470b0) returned 0x2 [0220.700] CoTaskMemFree (pv=0x517a30) [0220.700] CoGetContextToken (in: pToken=0x19f0d0 | out: pToken=0x19f0d0) returned 0x0 [0220.700] IUnknown:AddRef (This=0x5470b0) returned 0x3 [0220.701] IWbemClassObject:Get (in: This=0x5470b0, wszName="__GENUS", lFlags=0, pVal=0x19f3e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f464*=0, plFlavor=0x19f460*=0 | out: pVal=0x19f3e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f464*=3, plFlavor=0x19f460*=64) returned 0x0 [0220.701] IWbemClassObject:Get (in: This=0x5470b0, wszName="__PATH", lFlags=0, pVal=0x19f3c8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f44c*=0, plFlavor=0x19f448*=0 | out: pVal=0x19f3c8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=5", varVal2=0x0), pType=0x19f44c*=8, plFlavor=0x19f448*=64) returned 0x0 [0220.701] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=5") returned 0x7a [0220.701] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=5") returned 0x7a [0220.701] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x488 [0220.701] SetEvent (hEvent=0x3c8) returned 1 [0220.701] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f3a0*=0x488, lpdwindex=0x19f1bc | out: lpdwindex=0x19f1bc) returned 0x0 [0220.706] CoGetContextToken (in: pToken=0x19f270 | out: pToken=0x19f270) returned 0x0 [0220.706] CoGetContextToken (in: pToken=0x19f1d0 | out: pToken=0x19f1d0) returned 0x0 [0220.706] WbemDefPath:IUnknown:QueryInterface (in: This=0x52cb08, riid=0x19f2a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x52cb08) returned 0x0 [0220.707] WbemDefPath:IUnknown:AddRef (This=0x52cb08) returned 0x3 [0220.707] WbemDefPath:IUnknown:Release (This=0x52cb08) returned 0x2 [0220.707] WbemDefPath:IWbemPath:SetText (This=0x52cb08, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=5") returned 0x0 [0220.707] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0418, puCount=0x19f420 | out: puCount=0x19f420*=0x2) returned 0x0 [0220.707] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=4, puBuffLength=0x19f41c*=0x0, pszText=0x0 | out: puBuffLength=0x19f41c*=0xf, pszText=0x0) returned 0x0 [0220.707] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=4, puBuffLength=0x19f41c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f41c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0220.707] CoTaskMemAlloc (cb=0x4) returned 0x517a50 [0220.707] IEnumWbemClassObject:Next (in: This=0x5090b8, lTimeout=-1, uCount=0x1, apObjects=0x517a50, puReturned=0x22075c8 | out: apObjects=0x517a50*=0x0, puReturned=0x22075c8*=0x0) returned 0x1 [0220.708] CoTaskMemFree (pv=0x517a50) [0220.708] CoGetContextToken (in: pToken=0x19f320 | out: pToken=0x19f320) returned 0x0 [0220.708] WbemLocator:IUnknown:Release (This=0x501388) returned 0x1 [0220.708] IUnknown:Release (This=0x5090b8) returned 0x0 [0220.762] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe", nBufferLength=0x105, lpBuffer=0x19ef38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46.exe", lpFilePart=0x0) returned 0x62 [0220.766] GetEnvironmentVariableW (in: lpName="%startupfolder%", lpBuffer=0x19f354, nSize=0x80 | out: lpBuffer="") returned 0x0 [0220.780] GetUserNameW (in: lpBuffer=0x19f254, pcbBuffer=0x220bbe8 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x220bbe8) returned 1 [0220.788] GetComputerNameW (in: lpBuffer=0x19f254, nSize=0x220c064 | out: lpBuffer="XC64ZB", nSize=0x220c064) returned 1 [0220.818] EtwEventRegister (in: ProviderId=0x220c60c, EnableCallback=0x4720bf6, CallbackContext=0x0, RegHandle=0x220c5e8 | out: RegHandle=0x220c5e8) returned 0x0 [0220.821] EtwEventSetInformation (RegHandle=0x4e67e0, InformationClass=0x44, EventInformation=0x2, InformationLength=0x220c5ac) returned 0x0 [0220.823] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x19f400 | out: UnbiasedTime=0x19f400) returned 1 [0220.833] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x19f3f0 | out: UnbiasedTime=0x19f3f0) returned 1 [0220.835] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x19f420 | out: UnbiasedTime=0x19f420) returned 1 [0220.835] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x19f410 | out: UnbiasedTime=0x19f410) returned 1 [0221.238] CoTaskMemAlloc (cb=0x20c) returned 0x549d18 [0221.238] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x549d18 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0221.244] CoTaskMemFree (pv=0x549d18) [0221.244] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19eb40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0221.249] CoTaskMemAlloc (cb=0x20c) returned 0x549d18 [0221.249] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x549d18 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0221.249] CoTaskMemFree (pv=0x549d18) [0221.250] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19eb40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0222.560] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data", lpFilePart=0x0) returned 0x33 [0222.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0222.560] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0222.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0222.561] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data", lpFilePart=0x0) returned 0x34 [0222.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0222.562] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\liebao\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0222.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0222.562] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data", lpFilePart=0x0) returned 0x3e [0222.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0222.562] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\elements browser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0222.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0222.562] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data", lpFilePart=0x0) returned 0x3b [0222.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0222.562] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coowon\\coowon\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0222.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0222.563] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data", lpFilePart=0x0) returned 0x34 [0222.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0222.563] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\kometa\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0222.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0222.563] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data", lpFilePart=0x0) returned 0x3d [0222.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0222.563] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\sputnik\\sputnik\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0222.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0222.563] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data", lpFilePart=0x0) returned 0x44 [0222.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0222.563] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\maplestudio\\chromeplus\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0222.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0222.564] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data", lpFilePart=0x0) returned 0x42 [0222.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0222.564] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\catalinagroup\\citrio\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0222.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0222.564] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer", lpFilePart=0x0) returned 0x57 [0222.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0222.564] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\fenrir inc\\sleipnir5\\setting\\modules\\chromiumviewer"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0222.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0222.564] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data", lpFilePart=0x0) returned 0x3c [0222.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0222.564] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\ucozmedia\\uran\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0222.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0222.565] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data", lpFilePart=0x0) returned 0x39 [0222.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0222.565] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0222.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0222.565] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data", lpFilePart=0x0) returned 0x36 [0222.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0222.565] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0222.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0222.565] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data", lpFilePart=0x0) returned 0x34 [0222.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0222.566] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0222.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0222.566] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data", lpFilePart=0x0) returned 0x49 [0222.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0222.566] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\bravesoftware\\brave-browser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0222.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0222.566] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable", lpFilePart=0x0) returned 0x41 [0222.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0222.566] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0222.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0222.567] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Chrome\\Chrome\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Chrome\\Chrome\\User Data", lpFilePart=0x0) returned 0x3e [0222.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0222.567] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Chrome\\Chrome\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\360chrome\\chrome\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0222.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0222.567] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data", lpFilePart=0x0) returned 0x33 [0222.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0222.567] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0222.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0222.567] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data", lpFilePart=0x0) returned 0x3c [0222.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0222.568] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0222.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0222.568] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data", lpFilePart=0x0) returned 0x35 [0222.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0222.568] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\iridium\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0222.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0222.568] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data", lpFilePart=0x0) returned 0x3b [0222.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0222.568] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0222.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0222.568] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data", lpFilePart=0x0) returned 0x35 [0222.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0222.568] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0222.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0222.569] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data", lpFilePart=0x0) returned 0x42 [0222.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0222.569] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\yandex\\yandexbrowser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0222.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0222.569] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data", lpFilePart=0x0) returned 0x35 [0222.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0222.569] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\orbitum\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0222.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0222.569] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data", lpFilePart=0x0) returned 0x39 [0222.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0222.569] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0222.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0222.569] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data", lpFilePart=0x0) returned 0x36 [0222.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0222.570] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\qip surf\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0222.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0222.570] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data", lpFilePart=0x0) returned 0x42 [0222.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0222.570] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0222.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0222.581] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0x19d7c0, nSize=0x80 | out: lpBuffer="") returned 0x25 [0222.707] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\profiles.ini", lpFilePart=0x0) returned 0x52 [0222.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0222.707] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\moonchild productions\\pale moon\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0222.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0222.866] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\profiles.ini", lpFilePart=0x0) returned 0x52 [0222.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0222.867] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\moonchild productions\\pale moon\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0222.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0222.909] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\profiles.ini", lpFilePart=0x0) returned 0x48 [0222.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0222.909] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\8pecxstudios\\cyberfox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0222.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0222.914] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\profiles.ini", lpFilePart=0x0) returned 0x48 [0222.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0222.914] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\8pecxstudios\\cyberfox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0222.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0223.007] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Flock\\Browser\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Flock\\Browser\\profiles.ini", lpFilePart=0x0) returned 0x40 [0223.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef00) returned 1 [0223.007] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Flock\\Browser\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\flock\\browser\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0223.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d5d8) returned 1 [0223.216] CoTaskMemAlloc (cb=0x20c) returned 0x553288 [0223.216] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x553288 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0223.216] CoTaskMemFree (pv=0x553288) [0223.216] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19eb1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0223.220] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\", lpFilePart=0x0) returned 0x3c [0223.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0223.220] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0223.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0223.312] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Qualcomm\\Eudora\\CommandLine", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f038 | out: phkResult=0x19f038*=0x0) returned 0x2 [0223.363] CoTaskMemAlloc (cb=0x20c) returned 0x553288 [0223.363] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x553288 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0223.367] CoTaskMemFree (pv=0x553288) [0223.367] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x105, lpBuffer=0x19eb18, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0223.370] CoTaskMemAlloc (cb=0x20c) returned 0x553288 [0223.370] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x553288 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0223.370] CoTaskMemFree (pv=0x553288) [0223.370] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19eb18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0223.397] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Apple\\Apple Application Support\\plutil.exe", nBufferLength=0x105, lpBuffer=0x19eb84, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Common Files\\Apple\\Apple Application Support\\plutil.exe", lpFilePart=0x0) returned 0x4e [0223.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efe4) returned 1 [0223.397] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Apple\\Apple Application Support\\plutil.exe" (normalized: "c:\\program files (x86)\\common files\\apple\\apple application support\\plutil.exe"), fInfoLevelId=0x0, lpFileInformation=0x19f060 | out: lpFileInformation=0x19f060*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0223.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efe0) returned 1 [0223.539] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x19effc | out: phkResult=0x19effc*=0x0) returned 0x2 [0223.542] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x19effc | out: phkResult=0x19effc*=0x0) returned 0x2 [0223.544] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x19effc | out: phkResult=0x19effc*=0x0) returned 0x2 [0223.546] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x19effc | out: phkResult=0x19effc*=0x4d4) returned 0x0 [0223.547] RegQueryInfoKeyW (in: hKey=0x4d4, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x19f024, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x19f020, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x19f024*=0x3, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x19f020*=0x6, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0223.547] RegEnumKeyExW (in: hKey=0x4d4, dwIndex=0x0, lpName=0x2230204, lpcchName=0x19f040, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000001", lpcchName=0x19f040, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0223.547] RegEnumKeyExW (in: hKey=0x4d4, dwIndex=0x1, lpName=0x2230204, lpcchName=0x19f040, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000002", lpcchName=0x19f040, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0223.547] RegEnumKeyExW (in: hKey=0x4d4, dwIndex=0x2, lpName=0x2230204, lpcchName=0x19f040, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000003", lpcchName=0x19f040, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0223.550] RegOpenKeyExW (in: hKey=0x4d4, lpSubKey="00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x19effc | out: phkResult=0x19effc*=0x4dc) returned 0x0 [0223.552] RegQueryValueExW (in: hKey=0x4dc, lpValueName="Email", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0223.554] RegQueryValueExW (in: hKey=0x4dc, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0223.555] RegQueryValueExW (in: hKey=0x4dc, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0223.556] RegQueryValueExW (in: hKey=0x4dc, lpValueName="HTTP Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0223.557] RegQueryValueExW (in: hKey=0x4dc, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0223.557] RegCloseKey (hKey=0x4dc) returned 0x0 [0223.557] RegOpenKeyExW (in: hKey=0x4d4, lpSubKey="00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x19effc | out: phkResult=0x19effc*=0x4dc) returned 0x0 [0223.557] RegQueryValueExW (in: hKey=0x4dc, lpValueName="Email", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x1, lpData=0x0, lpcbData=0x19f018*=0x1e) returned 0x0 [0223.557] RegQueryValueExW (in: hKey=0x4dc, lpValueName="Email", lpReserved=0x0, lpType=0x19f01c, lpData=0x22307f8, lpcbData=0x19f018*=0x1e | out: lpType=0x19f01c*=0x1, lpData="achoo@gdllo.de", lpcbData=0x19f018*=0x1e) returned 0x0 [0223.557] RegQueryValueExW (in: hKey=0x4dc, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0223.557] RegQueryValueExW (in: hKey=0x4dc, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x3, lpData=0x0, lpcbData=0x19f018*=0x121) returned 0x0 [0223.558] RegQueryValueExW (in: hKey=0x4dc, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x2230850, lpcbData=0x19f018*=0x121 | out: lpType=0x19f01c*=0x3, lpData=0x2230850*, lpcbData=0x19f018*=0x121) returned 0x0 [0223.558] RegQueryValueExW (in: hKey=0x4dc, lpValueName="HTTP Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0223.558] RegQueryValueExW (in: hKey=0x4dc, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0223.558] RegQueryValueExW (in: hKey=0x4dc, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0223.558] RegQueryValueExW (in: hKey=0x4dc, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x3, lpData=0x0, lpcbData=0x19f018*=0x121) returned 0x0 [0223.558] RegQueryValueExW (in: hKey=0x4dc, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x22309b4, lpcbData=0x19f018*=0x121 | out: lpType=0x19f01c*=0x3, lpData=0x22309b4*, lpcbData=0x19f018*=0x121) returned 0x0 [0223.558] RegQueryValueExW (in: hKey=0x4dc, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x3, lpData=0x0, lpcbData=0x19f018*=0x121) returned 0x0 [0223.558] RegQueryValueExW (in: hKey=0x4dc, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x2230ae4, lpcbData=0x19f018*=0x121 | out: lpType=0x19f01c*=0x3, lpData=0x2230ae4*, lpcbData=0x19f018*=0x121) returned 0x0 [0224.452] CryptUnprotectData (in: pDataIn=0x19f004, ppszDataDescr=0x0, pOptionalEntropy=0x19effc, pvReserved=0x0, pPromptStruct=0x0, dwFlags=0x1, pDataOut=0x19f00c | out: ppszDataDescr=0x0, pDataOut=0x19f00c) returned 1 [0224.486] LocalFree (hMem=0x4e5210) returned 0x0 [0224.487] RegQueryValueExW (in: hKey=0x4dc, lpValueName="HTTP Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0224.487] RegQueryValueExW (in: hKey=0x4dc, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0224.487] RegQueryValueExW (in: hKey=0x4dc, lpValueName="Email", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x1, lpData=0x0, lpcbData=0x19f018*=0x1e) returned 0x0 [0224.487] RegQueryValueExW (in: hKey=0x4dc, lpValueName="Email", lpReserved=0x0, lpType=0x19f01c, lpData=0x2230e14, lpcbData=0x19f018*=0x1e | out: lpType=0x19f01c*=0x1, lpData="achoo@gdllo.de", lpcbData=0x19f018*=0x1e) returned 0x0 [0224.490] RegQueryValueExW (in: hKey=0x4dc, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x1, lpData=0x0, lpcbData=0x19f018*=0x1c) returned 0x0 [0224.490] RegQueryValueExW (in: hKey=0x4dc, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x19f01c, lpData=0x2230e90, lpcbData=0x19f018*=0x1c | out: lpType=0x19f01c*=0x1, lpData="smtp.gdllo.de", lpcbData=0x19f018*=0x1c) returned 0x0 [0224.490] RegQueryValueExW (in: hKey=0x4dc, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x1, lpData=0x0, lpcbData=0x19f018*=0x1c) returned 0x0 [0224.490] RegQueryValueExW (in: hKey=0x4dc, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x19f01c, lpData=0x2230ee0, lpcbData=0x19f018*=0x1c | out: lpType=0x19f01c*=0x1, lpData="smtp.gdllo.de", lpcbData=0x19f018*=0x1c) returned 0x0 [0224.500] RegCloseKey (hKey=0x4dc) returned 0x0 [0224.500] RegOpenKeyExW (in: hKey=0x4d4, lpSubKey="00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x19effc | out: phkResult=0x19effc*=0x4dc) returned 0x0 [0224.500] RegQueryValueExW (in: hKey=0x4dc, lpValueName="Email", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0224.500] RegQueryValueExW (in: hKey=0x4dc, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0224.501] RegQueryValueExW (in: hKey=0x4dc, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0224.501] RegQueryValueExW (in: hKey=0x4dc, lpValueName="HTTP Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0224.501] RegQueryValueExW (in: hKey=0x4dc, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0224.501] RegCloseKey (hKey=0x4dc) returned 0x0 [0224.517] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\profiles.ini", lpFilePart=0x0) returned 0x51 [0224.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0224.517] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\netgate technologies\\blackhawk\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0224.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0224.520] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\profiles.ini", lpFilePart=0x0) returned 0x51 [0224.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0224.521] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\netgate technologies\\blackhawk\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0224.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0224.588] GetEnvironmentVariableW (in: lpName="Programfiles(x86)", lpBuffer=0x19eef0, nSize=0x80 | out: lpBuffer="") returned 0x16 [0224.590] GetEnvironmentVariableW (in: lpName="programfiles(x86)", lpBuffer=0x19eef0, nSize=0x80 | out: lpBuffer="") returned 0x16 [0224.593] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\jDownloader\\config\\database.script", nBufferLength=0x105, lpBuffer=0x19eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\jDownloader\\config\\database.script", lpFilePart=0x0) returned 0x39 [0224.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efc4) returned 1 [0224.593] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\jDownloader\\config\\database.script" (normalized: "c:\\program files (x86)\\jdownloader\\config\\database.script"), fInfoLevelId=0x0, lpFileInformation=0x19f040 | out: lpFileInformation=0x19f040*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0224.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efc0) returned 1 [0224.608] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\profiles.ini", lpFilePart=0x0) returned 0x3b [0224.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0224.608] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\k-meleon\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0224.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0224.616] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\profiles.ini", lpFilePart=0x0) returned 0x3b [0224.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0224.616] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\k-meleon\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0224.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0224.631] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Postbox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Postbox\\profiles.ini", lpFilePart=0x0) returned 0x3a [0224.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0224.631] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Postbox\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\postbox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0224.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0224.639] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Postbox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Postbox\\profiles.ini", lpFilePart=0x0) returned 0x3a [0224.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0224.639] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Postbox\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\postbox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0224.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0224.698] CoTaskMemAlloc (cb=0x20c) returned 0x553288 [0224.698] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x553288 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0224.698] CoTaskMemFree (pv=0x553288) [0224.699] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19eaec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0224.786] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x19eb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x3a [0224.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efdc) returned 1 [0224.786] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\credentials"), fInfoLevelId=0x0, lpFileInformation=0x19f058 | out: lpFileInformation=0x19f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x58717184, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x58717184, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0224.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efd8) returned 1 [0224.787] CoTaskMemAlloc (cb=0x20c) returned 0x553288 [0224.787] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x553288 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0224.787] CoTaskMemFree (pv=0x553288) [0224.788] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19eaec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0224.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f058) returned 1 [0224.794] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x19eb60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x3a [0224.796] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x19eb34, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x3a [0224.797] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\credentials\\*"), lpFindFileData=0x19ed80 | out: lpFindFileData=0x19ed80*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x58717184, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x58717184, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4e5010 [0224.803] FindNextFileW (in: hFindFile=0x4e5010, lpFindFileData=0x19ed90 | out: lpFindFileData=0x19ed90*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x58717184, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x58717184, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.803] FindNextFileW (in: hFindFile=0x4e5010, lpFindFileData=0x19ed90 | out: lpFindFileData=0x19ed90*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x508b12b7, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x58717184, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x5871986a, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x2ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DFBE70A7E5CC19A398EBF1B96859CE5D", cAlternateFileName="DFBE70~1")) returned 1 [0224.804] FindNextFileW (in: hFindFile=0x4e5010, lpFindFileData=0x19ed90 | out: lpFindFileData=0x19ed90*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0224.804] FindClose (in: hFindFile=0x4e5010 | out: hFindFile=0x4e5010) returned 1 [0224.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f018) returned 1 [0224.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f024) returned 1 [0224.807] CoTaskMemAlloc (cb=0x20c) returned 0x553288 [0224.807] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x553288 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0224.807] CoTaskMemFree (pv=0x553288) [0224.807] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19eaec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0224.807] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x19eb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x3c [0224.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efdc) returned 1 [0224.807] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\credentials"), fInfoLevelId=0x0, lpFileInformation=0x19f058 | out: lpFileInformation=0x19f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44687ae6, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x44687ae6, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0224.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efd8) returned 1 [0224.807] CoTaskMemAlloc (cb=0x20c) returned 0x553288 [0224.807] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x553288 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0224.807] CoTaskMemFree (pv=0x553288) [0224.808] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19eaec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0224.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f058) returned 1 [0224.808] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x19eb60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x3c [0224.808] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x19eb34, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x3c [0224.808] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\credentials\\*"), lpFindFileData=0x19ed80 | out: lpFindFileData=0x19ed80*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44687ae6, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x44687ae6, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4e53d0 [0224.808] FindNextFileW (in: hFindFile=0x4e53d0, lpFindFileData=0x19ed90 | out: lpFindFileData=0x19ed90*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44687ae6, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x44687ae6, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.809] FindNextFileW (in: hFindFile=0x4e53d0, lpFindFileData=0x19ed90 | out: lpFindFileData=0x19ed90*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44687ae6, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x44687ae6, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0224.809] FindClose (in: hFindFile=0x4e53d0 | out: hFindFile=0x4e53d0) returned 1 [0224.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f018) returned 1 [0224.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f024) returned 1 [0224.951] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D", nBufferLength=0x105, lpBuffer=0x19eaec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D", lpFilePart=0x0) returned 0x5a [0224.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef98) returned 1 [0224.951] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\credentials\\dfbe70a7e5cc19a398ebf1b96859ce5d"), fInfoLevelId=0x0, lpFileInformation=0x223c798 | out: lpFileInformation=0x223c798*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x508b12b7, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x58717184, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x5871986a, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x2ac0)) returned 1 [0224.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef94) returned 1 [0224.952] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D", nBufferLength=0x105, lpBuffer=0x19e9dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D", lpFilePart=0x0) returned 0x5a [0224.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eed0) returned 1 [0224.952] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\credentials\\dfbe70a7e5cc19a398ebf1b96859ce5d"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x4dc [0224.952] GetFileType (hFile=0x4dc) returned 0x1 [0224.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eecc) returned 1 [0224.953] GetFileType (hFile=0x4dc) returned 0x1 [0224.953] GetFileSize (in: hFile=0x4dc, lpFileSizeHigh=0x19efd8 | out: lpFileSizeHigh=0x19efd8*=0x0) returned 0x2ac0 [0224.953] ReadFile (in: hFile=0x4dc, lpBuffer=0x223ca60, nNumberOfBytesToRead=0x2ac0, lpNumberOfBytesRead=0x19ef84, lpOverlapped=0x0 | out: lpBuffer=0x223ca60*, lpNumberOfBytesRead=0x19ef84*=0x2ac0, lpOverlapped=0x0) returned 1 [0224.955] CloseHandle (hObject=0x4dc) returned 1 [0225.217] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D", nBufferLength=0x105, lpBuffer=0x19ead4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D", lpFilePart=0x0) returned 0x5a [0225.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef68) returned 1 [0225.217] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\credentials\\dfbe70a7e5cc19a398ebf1b96859ce5d"), fInfoLevelId=0x0, lpFileInformation=0x19efe4 | out: lpFileInformation=0x19efe4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x508b12b7, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x58717184, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x5871986a, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x2ac0)) returned 1 [0225.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef64) returned 1 [0225.219] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x19ecb0 | out: pTimeZoneInformation=0x19ecb0) returned 0x2 [0225.222] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ed94 | out: phkResult=0x19ed94*=0x4dc) returned 0x0 [0225.224] RegQueryValueExW (in: hKey=0x4dc, lpValueName="TZI", lpReserved=0x0, lpType=0x19edb0, lpData=0x0, lpcbData=0x19edac*=0x0 | out: lpType=0x19edb0*=0x3, lpData=0x0, lpcbData=0x19edac*=0x2c) returned 0x0 [0225.226] RegQueryValueExW (in: hKey=0x4dc, lpValueName="TZI", lpReserved=0x0, lpType=0x19edb0, lpData=0x22420e4, lpcbData=0x19edac*=0x2c | out: lpType=0x19edb0*=0x3, lpData=0x22420e4*, lpcbData=0x19edac*=0x2c) returned 0x0 [0225.226] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ebe8 | out: phkResult=0x19ebe8*=0x0) returned 0x2 [0225.229] RegQueryValueExW (in: hKey=0x4dc, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x19ed88, lpData=0x0, lpcbData=0x19ed84*=0x0 | out: lpType=0x19ed88*=0x1, lpData=0x0, lpcbData=0x19ed84*=0x20) returned 0x0 [0225.229] RegQueryValueExW (in: hKey=0x4dc, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x19ed88, lpData=0x2242508, lpcbData=0x19ed84*=0x20 | out: lpType=0x19ed88*=0x1, lpData="@tzres.dll,-320", lpcbData=0x19ed84*=0x20) returned 0x0 [0225.229] RegQueryValueExW (in: hKey=0x4dc, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x19ed88, lpData=0x0, lpcbData=0x19ed84*=0x0 | out: lpType=0x19ed88*=0x1, lpData=0x0, lpcbData=0x19ed84*=0x20) returned 0x0 [0225.229] RegQueryValueExW (in: hKey=0x4dc, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x19ed88, lpData=0x2242560, lpcbData=0x19ed84*=0x20 | out: lpType=0x19ed88*=0x1, lpData="@tzres.dll,-322", lpcbData=0x19ed84*=0x20) returned 0x0 [0225.229] RegQueryValueExW (in: hKey=0x4dc, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x19ed88, lpData=0x0, lpcbData=0x19ed84*=0x0 | out: lpType=0x19ed88*=0x1, lpData=0x0, lpcbData=0x19ed84*=0x20) returned 0x0 [0225.229] RegQueryValueExW (in: hKey=0x4dc, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x19ed88, lpData=0x22425b8, lpcbData=0x19ed84*=0x20 | out: lpType=0x19ed88*=0x1, lpData="@tzres.dll,-321", lpcbData=0x19ed84*=0x20) returned 0x0 [0225.231] CoTaskMemAlloc (cb=0x20c) returned 0x553288 [0225.231] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x553288 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0225.233] CoTaskMemFree (pv=0x553288) [0225.233] CoTaskMemAlloc (cb=0x20c) returned 0x553288 [0225.234] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x19eda4, pwszFileMUIPath=0x553288, pcchFileMUIPath=0x19eda8, pululEnumerator=0x19ed9c | out: pwszLanguage=0x0, pcchLanguage=0x19eda4, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x19eda8, pululEnumerator=0x19ed9c) returned 1 [0225.260] CoTaskMemFree (pv=0x0) [0225.260] CoTaskMemFree (pv=0x553288) [0225.261] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x4fd0001 [0225.285] CoTaskMemAlloc (cb=0x3ec) returned 0x557588 [0225.285] LoadStringW (in: hInstance=0x4fd0001, uID=0x140, lpBuffer=0x557588, cchBufferMax=500 | out: lpBuffer="(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna") returned 0x3c [0225.285] CoTaskMemFree (pv=0x557588) [0225.285] FreeLibrary (hLibModule=0x4fd0001) returned 1 [0225.286] CoTaskMemAlloc (cb=0x20c) returned 0x553288 [0225.287] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x553288 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0225.287] CoTaskMemFree (pv=0x553288) [0225.287] CoTaskMemAlloc (cb=0x20c) returned 0x553288 [0225.287] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x19eda4, pwszFileMUIPath=0x553288, pcchFileMUIPath=0x19eda8, pululEnumerator=0x19ed9c | out: pwszLanguage=0x0, pcchLanguage=0x19eda4, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x19eda8, pululEnumerator=0x19ed9c) returned 1 [0225.291] CoTaskMemFree (pv=0x0) [0225.291] CoTaskMemFree (pv=0x553288) [0225.291] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x4fd0001 [0225.295] CoTaskMemAlloc (cb=0x3ec) returned 0x557588 [0225.295] LoadStringW (in: hInstance=0x4fd0001, uID=0x142, lpBuffer=0x557588, cchBufferMax=500 | out: lpBuffer="W. Europe Standard Time") returned 0x17 [0225.295] CoTaskMemFree (pv=0x557588) [0225.295] FreeLibrary (hLibModule=0x4fd0001) returned 1 [0225.296] CoTaskMemAlloc (cb=0x20c) returned 0x553288 [0225.296] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x553288 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0225.296] CoTaskMemFree (pv=0x553288) [0225.296] CoTaskMemAlloc (cb=0x20c) returned 0x553288 [0225.296] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x19eda4, pwszFileMUIPath=0x553288, pcchFileMUIPath=0x19eda8, pululEnumerator=0x19ed9c | out: pwszLanguage=0x0, pcchLanguage=0x19eda4, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x19eda8, pululEnumerator=0x19ed9c) returned 1 [0225.299] CoTaskMemFree (pv=0x0) [0225.299] CoTaskMemFree (pv=0x553288) [0225.299] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x4fd0001 [0225.303] CoTaskMemAlloc (cb=0x3ec) returned 0x557588 [0225.303] LoadStringW (in: hInstance=0x4fd0001, uID=0x141, lpBuffer=0x557588, cchBufferMax=500 | out: lpBuffer="W. Europe Daylight Time") returned 0x17 [0225.303] CoTaskMemFree (pv=0x557588) [0225.303] FreeLibrary (hLibModule=0x4fd0001) returned 1 [0225.304] RegCloseKey (hKey=0x4dc) returned 0x0 [0225.305] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D", nBufferLength=0x105, lpBuffer=0x19ead4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D", lpFilePart=0x0) returned 0x5a [0225.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef68) returned 1 [0225.305] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\credentials\\dfbe70a7e5cc19a398ebf1b96859ce5d"), fInfoLevelId=0x0, lpFileInformation=0x19efe4 | out: lpFileInformation=0x19efe4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x508b12b7, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x58717184, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x5871986a, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x2ac0)) returned 1 [0225.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef64) returned 1 [0225.366] CoTaskMemAlloc (cb=0x20c) returned 0x553288 [0225.366] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x553288 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0225.368] CoTaskMemFree (pv=0x553288) [0225.368] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19eaec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0225.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f058) returned 1 [0225.371] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\", nBufferLength=0x105, lpBuffer=0x19eb60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\", lpFilePart=0x0) returned 0x38 [0225.371] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\", nBufferLength=0x105, lpBuffer=0x19eb34, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\", lpFilePart=0x0) returned 0x38 [0225.371] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\protect\\*"), lpFindFileData=0x19ed80 | out: lpFindFileData=0x19ed80*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x50866c1c, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x50866c1c, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4e5010 [0225.372] FindNextFileW (in: hFindFile=0x4e5010, lpFindFileData=0x19ed90 | out: lpFindFileData=0x19ed90*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x50866c1c, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x50866c1c, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0225.372] FindNextFileW (in: hFindFile=0x4e5010, lpFindFileData=0x19ed90 | out: lpFindFileData=0x19ed90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44792966, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xcf68faea, ftLastWriteTime.dwHighDateTime=0x1d85953, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="CREDHIST", cAlternateFileName="")) returned 1 [0225.372] FindNextFileW (in: hFindFile=0x4e5010, lpFindFileData=0x19ed90 | out: lpFindFileData=0x19ed90*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x50866c1c, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x562658a2, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x562658a2, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0225.373] FindNextFileW (in: hFindFile=0x4e5010, lpFindFileData=0x19ed90 | out: lpFindFileData=0x19ed90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44792966, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xcf753085, ftLastWriteTime.dwHighDateTime=0x1d85953, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SYNCHIST", cAlternateFileName="")) returned 1 [0225.373] FindNextFileW (in: hFindFile=0x4e5010, lpFindFileData=0x19ed90 | out: lpFindFileData=0x19ed90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44792966, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xcf753085, ftLastWriteTime.dwHighDateTime=0x1d85953, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SYNCHIST", cAlternateFileName="")) returned 0 [0225.373] FindClose (in: hFindFile=0x4e5010 | out: hFindFile=0x4e5010) returned 1 [0225.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f018) returned 1 [0225.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f024) returned 1 [0225.387] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1", nBufferLength=0x105, lpBuffer=0x19eb88, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1", lpFilePart=0x0) returned 0x8b [0225.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efe8) returned 1 [0225.387] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1"), fInfoLevelId=0x0, lpFileInformation=0x19f064 | out: lpFileInformation=0x19f064*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x562658a2, ftCreationTime.dwHighDateTime=0x1d82a22, ftLastAccessTime.dwLowDateTime=0x562658a2, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0xcf6b6c82, ftLastWriteTime.dwHighDateTime=0x1d85953, nFileSizeHigh=0x0, nFileSizeLow=0x1d4)) returned 1 [0225.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efe4) returned 1 [0225.387] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1", nBufferLength=0x105, lpBuffer=0x19eb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1", lpFilePart=0x0) returned 0x8b [0225.388] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1", nBufferLength=0x105, lpBuffer=0x19eb6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1", lpFilePart=0x0) returned 0x8b [0225.388] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000", nBufferLength=0x105, lpBuffer=0x19eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000", lpFilePart=0x0) returned 0x66 [0225.388] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\.", nBufferLength=0x105, lpBuffer=0x19eb04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000", lpFilePart=0x0) returned 0x66 [0225.539] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1", nBufferLength=0x105, lpBuffer=0x19ea74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1", lpFilePart=0x0) returned 0x8b [0225.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef68) returned 1 [0225.539] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x4dc [0225.539] GetFileType (hFile=0x4dc) returned 0x1 [0225.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef64) returned 1 [0225.539] GetFileType (hFile=0x4dc) returned 0x1 [0225.539] GetFileSize (in: hFile=0x4dc, lpFileSizeHigh=0x19f070 | out: lpFileSizeHigh=0x19f070*=0x0) returned 0x1d4 [0225.540] ReadFile (in: hFile=0x4dc, lpBuffer=0x224bda8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f01c, lpOverlapped=0x0 | out: lpBuffer=0x224bda8*, lpNumberOfBytesRead=0x19f01c*=0x1d4, lpOverlapped=0x0) returned 1 [0225.541] CloseHandle (hObject=0x4dc) returned 1 [0226.769] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D", nBufferLength=0x105, lpBuffer=0x19ea74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D", lpFilePart=0x0) returned 0x5a [0226.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef68) returned 1 [0226.769] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\credentials\\dfbe70a7e5cc19a398ebf1b96859ce5d"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x4f4 [0226.770] GetFileType (hFile=0x4f4) returned 0x1 [0226.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef64) returned 1 [0226.771] GetFileType (hFile=0x4f4) returned 0x1 [0226.771] GetFileSize (in: hFile=0x4f4, lpFileSizeHigh=0x19f070 | out: lpFileSizeHigh=0x19f070*=0x0) returned 0x2ac0 [0226.771] ReadFile (in: hFile=0x4f4, lpBuffer=0x2223304, nNumberOfBytesToRead=0x2ac0, lpNumberOfBytesRead=0x19f01c, lpOverlapped=0x0 | out: lpBuffer=0x2223304*, lpNumberOfBytesRead=0x19f01c*=0x2ac0, lpOverlapped=0x0) returned 1 [0226.771] CloseHandle (hObject=0x4f4) returned 1 [0226.986] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Wow6432Node\\RealVNC\\WinVNC4", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0226.987] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Wow6432Node\\RealVNC\\WinVNC4", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0226.988] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\RealVNC\\vncserver", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0226.989] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\RealVNC\\vncserver", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0226.989] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\RealVNC\\WinVNC4", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0226.989] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\RealVNC\\WinVNC4", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0226.989] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\ORL\\WinVNC3", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0226.990] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\ORL\\WinVNC3", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0226.990] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\TightVNC\\Server", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0226.990] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\TightVNC\\Server", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0226.991] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\TightVNC\\Server", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0226.991] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\TightVNC\\Server", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0226.991] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\TightVNC\\Server", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0226.991] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\TightVNC\\Server", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0226.991] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\TigerVNC\\Server", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0226.992] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\TigerVNC\\Server", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0226.999] CoTaskMemAlloc (cb=0x20c) returned 0x5493e8 [0226.999] GetEnvironmentVariableW (in: lpName="ProgramFiles(x86)", lpBuffer=0x5493e8, nSize=0x104 | out: lpBuffer="") returned 0x16 [0227.000] CoTaskMemFree (pv=0x5493e8) [0227.004] CoTaskMemAlloc (cb=0x20c) returned 0x5493e8 [0227.004] GetEnvironmentVariableW (in: lpName="ProgramFiles(x86)", lpBuffer=0x5493e8, nSize=0x104 | out: lpBuffer="") returned 0x16 [0227.004] CoTaskMemFree (pv=0x5493e8) [0227.008] CoTaskMemAlloc (cb=0x20c) returned 0x5493e8 [0227.008] GetEnvironmentVariableW (in: lpName="ProgramFiles", lpBuffer=0x5493e8, nSize=0x104 | out: lpBuffer="") returned 0x16 [0227.008] CoTaskMemFree (pv=0x5493e8) [0227.008] CoTaskMemAlloc (cb=0x20c) returned 0x5493e8 [0227.008] GetEnvironmentVariableW (in: lpName="ProgramFiles", lpBuffer=0x5493e8, nSize=0x104 | out: lpBuffer="") returned 0x16 [0227.008] CoTaskMemFree (pv=0x5493e8) [0227.008] CoTaskMemAlloc (cb=0x20c) returned 0x5493e8 [0227.008] GetEnvironmentVariableW (in: lpName="ProgramFiles", lpBuffer=0x5493e8, nSize=0x104 | out: lpBuffer="") returned 0x16 [0227.009] CoTaskMemFree (pv=0x5493e8) [0227.011] CoTaskMemAlloc (cb=0x20c) returned 0x5493e8 [0227.011] GetEnvironmentVariableW (in: lpName="ProgramFiles", lpBuffer=0x5493e8, nSize=0x104 | out: lpBuffer="") returned 0x16 [0227.011] CoTaskMemFree (pv=0x5493e8) [0227.011] CoTaskMemAlloc (cb=0x20c) returned 0x5493e8 [0227.011] GetEnvironmentVariableW (in: lpName="ProgramFiles(x86)", lpBuffer=0x5493e8, nSize=0x104 | out: lpBuffer="") returned 0x16 [0227.011] CoTaskMemFree (pv=0x5493e8) [0227.011] CoTaskMemAlloc (cb=0x20c) returned 0x5493e8 [0227.011] GetEnvironmentVariableW (in: lpName="ProgramFiles(x86)", lpBuffer=0x5493e8, nSize=0x104 | out: lpBuffer="") returned 0x16 [0227.011] CoTaskMemFree (pv=0x5493e8) [0227.011] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini", nBufferLength=0x105, lpBuffer=0x19eab4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini", lpFilePart=0x0) returned 0x36 [0227.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef14) returned 1 [0227.012] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini" (normalized: "c:\\program files (x86)\\uvnc bvba\\ultravnc\\ultravnc.ini"), fInfoLevelId=0x0, lpFileInformation=0x19ef90 | out: lpFileInformation=0x19ef90*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0227.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef10) returned 1 [0227.013] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini", nBufferLength=0x105, lpBuffer=0x19eab4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini", lpFilePart=0x0) returned 0x36 [0227.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef14) returned 1 [0227.013] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini" (normalized: "c:\\program files (x86)\\uvnc bvba\\ultravnc\\ultravnc.ini"), fInfoLevelId=0x0, lpFileInformation=0x19ef90 | out: lpFileInformation=0x19ef90*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0227.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef10) returned 1 [0227.014] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini", nBufferLength=0x105, lpBuffer=0x19eab4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini", lpFilePart=0x0) returned 0x36 [0227.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef14) returned 1 [0227.014] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini" (normalized: "c:\\program files (x86)\\uvnc bvba\\ultravnc\\ultravnc.ini"), fInfoLevelId=0x0, lpFileInformation=0x19ef90 | out: lpFileInformation=0x19ef90*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0227.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef10) returned 1 [0227.014] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini", nBufferLength=0x105, lpBuffer=0x19eab4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini", lpFilePart=0x0) returned 0x36 [0227.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef14) returned 1 [0227.014] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini" (normalized: "c:\\program files (x86)\\uvnc bvba\\ultravnc\\ultravnc.ini"), fInfoLevelId=0x0, lpFileInformation=0x19ef90 | out: lpFileInformation=0x19ef90*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0227.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef10) returned 1 [0227.014] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini", nBufferLength=0x105, lpBuffer=0x19eab4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini", lpFilePart=0x0) returned 0x2c [0227.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef14) returned 1 [0227.015] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini" (normalized: "c:\\program files (x86)\\ultravnc\\ultravnc.ini"), fInfoLevelId=0x0, lpFileInformation=0x19ef90 | out: lpFileInformation=0x19ef90*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0227.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef10) returned 1 [0227.015] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini", nBufferLength=0x105, lpBuffer=0x19eab4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini", lpFilePart=0x0) returned 0x2c [0227.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef14) returned 1 [0227.015] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini" (normalized: "c:\\program files (x86)\\ultravnc\\ultravnc.ini"), fInfoLevelId=0x0, lpFileInformation=0x19ef90 | out: lpFileInformation=0x19ef90*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0227.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef10) returned 1 [0227.015] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini", nBufferLength=0x105, lpBuffer=0x19eab4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini", lpFilePart=0x0) returned 0x2c [0227.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef14) returned 1 [0227.015] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini" (normalized: "c:\\program files (x86)\\ultravnc\\ultravnc.ini"), fInfoLevelId=0x0, lpFileInformation=0x19ef90 | out: lpFileInformation=0x19ef90*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0227.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef10) returned 1 [0227.016] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini", nBufferLength=0x105, lpBuffer=0x19eab4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini", lpFilePart=0x0) returned 0x2c [0227.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef14) returned 1 [0227.016] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini" (normalized: "c:\\program files (x86)\\ultravnc\\ultravnc.ini"), fInfoLevelId=0x0, lpFileInformation=0x19ef90 | out: lpFileInformation=0x19ef90*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0227.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef10) returned 1 [0227.026] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini", lpFilePart=0x0) returned 0x44 [0227.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0227.026] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mozilla\\seamonkey\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0227.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0227.081] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini", lpFilePart=0x0) returned 0x44 [0227.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0227.082] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mozilla\\seamonkey\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0227.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0227.099] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\profiles.ini", lpFilePart=0x0) returned 0x3b [0227.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0227.100] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\waterfox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0227.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0227.109] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\profiles.ini", lpFilePart=0x0) returned 0x3b [0227.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0227.109] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\waterfox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0227.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0227.159] CoTaskMemAlloc (cb=0x20c) returned 0x5493e8 [0227.159] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x5493e8 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0227.160] CoTaskMemFree (pv=0x5493e8) [0227.160] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19eaf8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0227.161] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NordVPN", nBufferLength=0x105, lpBuffer=0x19eb8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NordVPN", lpFilePart=0x0) returned 0x2b [0227.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f028) returned 1 [0227.161] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NordVPN" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\nordvpn"), fInfoLevelId=0x0, lpFileInformation=0x22323e0 | out: lpFileInformation=0x22323e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0227.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f024) returned 1 [0227.166] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0227.230] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\RimArts\\B2\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f020 | out: phkResult=0x19f020*=0x0) returned 0x2 [0227.232] GetFullPathNameW (in: lpFileName="Folder.lst", nBufferLength=0x105, lpBuffer=0x19eb8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Folder.lst", lpFilePart=0x0) returned 0x28 [0227.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efec) returned 1 [0227.232] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Folder.lst" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\folder.lst"), fInfoLevelId=0x0, lpFileInformation=0x19f068 | out: lpFileInformation=0x19f068*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0227.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efe8) returned 1 [0227.250] ExpandEnvironmentStringsW (in: lpSrc="%ProgramW6432%", lpDst=0x19ef60, nSize=0x64 | out: lpDst="C:\\Program Files") returned 0x11 [0227.250] ExpandEnvironmentStringsW (in: lpSrc="%ProgramW6432%", lpDst=0x19ef60, nSize=0x64 | out: lpDst="C:\\Program Files") returned 0x11 [0227.254] CoTaskMemAlloc (cb=0x20c) returned 0x5493e8 [0227.254] GetEnvironmentVariableW (in: lpName="ProgramFiles(x86)", lpBuffer=0x5493e8, nSize=0x104 | out: lpBuffer="") returned 0x16 [0227.254] CoTaskMemFree (pv=0x5493e8) [0227.257] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Private Internet Access\\data", nBufferLength=0x105, lpBuffer=0x19eba4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Private Internet Access\\data", lpFilePart=0x0) returned 0x2d [0227.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f000) returned 1 [0227.257] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Private Internet Access\\data" (normalized: "c:\\program files\\private internet access\\data"), fInfoLevelId=0x0, lpFileInformation=0x19f07c | out: lpFileInformation=0x19f07c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0227.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19effc) returned 1 [0227.258] GetFullPathNameW (in: lpFileName="\\Private Internet Access\\data", nBufferLength=0x105, lpBuffer=0x19eba4, lpFilePart=0x0 | out: lpBuffer="C:\\Private Internet Access\\data", lpFilePart=0x0) returned 0x1f [0227.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f000) returned 1 [0227.258] GetFileAttributesExW (in: lpFileName="C:\\Private Internet Access\\data" (normalized: "c:\\private internet access\\data"), fInfoLevelId=0x0, lpFileInformation=0x19f07c | out: lpFileInformation=0x19f07c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0227.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19effc) returned 1 [0227.309] CoTaskMemAlloc (cb=0x20c) returned 0x5493e8 [0227.309] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0x5493e8, nSize=0x104 | out: lpBuffer="") returned 0x25 [0227.309] CoTaskMemFree (pv=0x5493e8) [0227.310] CoTaskMemAlloc (cb=0x20c) returned 0x5493e8 [0227.310] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0x5493e8, nSize=0x104 | out: lpBuffer="") returned 0x25 [0227.311] CoTaskMemFree (pv=0x5493e8) [0227.312] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Psi\\profiles", nBufferLength=0x105, lpBuffer=0x19eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Psi\\profiles", lpFilePart=0x0) returned 0x32 [0227.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efc0) returned 1 [0227.312] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Psi\\profiles" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\psi\\profiles"), fInfoLevelId=0x0, lpFileInformation=0x19f03c | out: lpFileInformation=0x19f03c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0227.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efbc) returned 1 [0227.312] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Psi+\\profiles", nBufferLength=0x105, lpBuffer=0x19eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Psi+\\profiles", lpFilePart=0x0) returned 0x33 [0227.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efc0) returned 1 [0227.313] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Psi+\\profiles" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\psi+\\profiles"), fInfoLevelId=0x0, lpFileInformation=0x19f03c | out: lpFileInformation=0x19f03c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0227.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efbc) returned 1 [0227.315] CoTaskMemAlloc (cb=0x20c) returned 0x5493e8 [0227.316] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x5493e8 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0227.316] CoTaskMemFree (pv=0x5493e8) [0227.316] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19eb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0227.317] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mailbird\\Store\\Store.db", nBufferLength=0x105, lpBuffer=0x19ebcc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mailbird\\Store\\Store.db", lpFilePart=0x0) returned 0x3b [0227.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f02c) returned 1 [0227.330] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mailbird\\Store\\Store.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\mailbird\\store\\store.db"), fInfoLevelId=0x0, lpFileInformation=0x19f0a8 | out: lpFileInformation=0x19f0a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0227.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f028) returned 1 [0227.383] CoTaskMemAlloc (cb=0x20c) returned 0x5493e8 [0227.383] GetEnvironmentVariableW (in: lpName="appdata", lpBuffer=0x5493e8, nSize=0x104 | out: lpBuffer="") returned 0x25 [0227.384] CoTaskMemFree (pv=0x5493e8) [0227.387] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\The Bat!", nBufferLength=0x105, lpBuffer=0x19eb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\The Bat!", lpFilePart=0x0) returned 0x2e [0227.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efdc) returned 1 [0227.387] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\The Bat!" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\the bat!"), fInfoLevelId=0x0, lpFileInformation=0x19f058 | out: lpFileInformation=0x19f058*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0227.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efd8) returned 1 [0227.401] CoTaskMemAlloc (cb=0x20c) returned 0x5493e8 [0227.401] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x5493e8, nSize=0x104 | out: lpBuffer="") returned 0x2 [0227.401] CoTaskMemFree (pv=0x5493e8) [0227.404] GetFullPathNameW (in: lpFileName="C:\\cftp\\Ftplist.txt", nBufferLength=0x105, lpBuffer=0x19eba4, lpFilePart=0x0 | out: lpBuffer="C:\\cftp\\Ftplist.txt", lpFilePart=0x0) returned 0x13 [0227.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f004) returned 1 [0227.404] GetFileAttributesExW (in: lpFileName="C:\\cftp\\Ftplist.txt" (normalized: "c:\\cftp\\ftplist.txt"), fInfoLevelId=0x0, lpFileInformation=0x19f080 | out: lpFileInformation=0x19f080*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0227.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f000) returned 1 [0227.484] CoTaskMemAlloc (cb=0x20c) returned 0x5493e8 [0227.484] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x5493e8 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0227.484] CoTaskMemFree (pv=0x5493e8) [0227.484] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19e924, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0227.486] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data", nBufferLength=0x105, lpBuffer=0x19e99c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data", lpFilePart=0x0) returned 0x3c [0227.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edf8) returned 1 [0227.486] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19ee74 | out: lpFileInformation=0x19ee74*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0227.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf4) returned 1 [0228.337] VaultEnumerateVaults () returned 0x0 [0228.380] VaultOpenVault () returned 0x0 [0228.386] VaultEnumerateItems () returned 0x0 [0228.389] VaultOpenVault () returned 0x0 [0228.390] VaultEnumerateItems () returned 0x0 [0228.412] CoTaskMemAlloc (cb=0x20c) returned 0x557588 [0228.413] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x557588 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0228.413] CoTaskMemFree (pv=0x557588) [0228.413] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19eb0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0228.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f070) returned 1 [0228.419] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\UCBrowser\\", nBufferLength=0x105, lpBuffer=0x19eb78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\UCBrowser\\", lpFilePart=0x0) returned 0x2e [0228.419] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\UCBrowser\\", nBufferLength=0x105, lpBuffer=0x19eb4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\UCBrowser\\", lpFilePart=0x0) returned 0x2e [0228.419] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\UCBrowser\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\ucbrowser\\*"), lpFindFileData=0x19ed98 | out: lpFindFileData=0x19ed98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0228.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f034) returned 1 [0228.440] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon\\profiles.ini", lpFilePart=0x0) returned 0x43 [0228.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0228.440] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\comodo\\icedragon\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0228.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0228.445] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon\\profiles.ini", lpFilePart=0x0) returned 0x43 [0228.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0228.445] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\comodo\\icedragon\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0228.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0228.476] CoTaskMemAlloc (cb=0x20c) returned 0x557588 [0228.476] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x557588 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0228.476] CoTaskMemFree (pv=0x557588) [0228.476] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19eb00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0228.478] CoTaskMemAlloc (cb=0x20c) returned 0x557588 [0228.478] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x557588 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0228.478] CoTaskMemFree (pv=0x557588) [0228.478] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19eb00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0228.480] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\eM Client", nBufferLength=0x105, lpBuffer=0x19eb94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\eM Client", lpFilePart=0x0) returned 0x2f [0228.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eff0) returned 1 [0228.480] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\eM Client" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\em client"), fInfoLevelId=0x0, lpFileInformation=0x19f06c | out: lpFileInformation=0x19f06c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0228.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efec) returned 1 [0228.526] CoTaskMemAlloc (cb=0x20c) returned 0x557588 [0228.526] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x557588 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0228.526] CoTaskMemFree (pv=0x557588) [0228.526] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0228.530] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Trillian\\users\\global\\accounts.dat", nBufferLength=0x105, lpBuffer=0x19eb8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Trillian\\users\\global\\accounts.dat", lpFilePart=0x0) returned 0x48 [0228.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efec) returned 1 [0228.530] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Trillian\\users\\global\\accounts.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\trillian\\users\\global\\accounts.dat"), fInfoLevelId=0x0, lpFileInformation=0x19f068 | out: lpFileInformation=0x19f068*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0228.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efe8) returned 1 [0228.534] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\profiles.ini", lpFilePart=0x0) returned 0x41 [0228.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0228.535] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mozilla\\icecat\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0228.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0228.539] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\profiles.ini", lpFilePart=0x0) returned 0x41 [0228.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0228.539] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mozilla\\icecat\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0228.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0228.550] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", lpFilePart=0x0) returned 0x42 [0228.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0228.550] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0228.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0228.554] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", lpFilePart=0x0) returned 0x42 [0228.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0228.555] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0228.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0228.592] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\DownloadManager\\Passwords", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f04c | out: phkResult=0x19f04c*=0x0) returned 0x2 [0228.599] CoTaskMemAlloc (cb=0x20c) returned 0x557588 [0228.599] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x557588 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0228.599] CoTaskMemFree (pv=0x557588) [0228.600] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19eb08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0228.602] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\MySQL\\Workbench\\workbench_user_data.dat", nBufferLength=0x105, lpBuffer=0x19eba4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\MySQL\\Workbench\\workbench_user_data.dat", lpFilePart=0x0) returned 0x4d [0228.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f004) returned 1 [0228.602] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\MySQL\\Workbench\\workbench_user_data.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mysql\\workbench\\workbench_user_data.dat"), fInfoLevelId=0x0, lpFileInformation=0x19f080 | out: lpFileInformation=0x19f080*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0228.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f000) returned 1 [0228.633] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\IncrediMail\\Identities", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f048 | out: phkResult=0x19f048*=0x0) returned 0x2 [0228.699] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Aerofox\\FoxmailPreview", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eef0 | out: phkResult=0x19eef0*=0x0) returned 0x2 [0228.701] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Aerofox\\Foxmail\\V3.1", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eef0 | out: phkResult=0x19eef0*=0x0) returned 0x2 [0228.702] GetFullPathNameW (in: lpFileName="\\Storage\\", nBufferLength=0x105, lpBuffer=0x19ea5c, lpFilePart=0x0 | out: lpBuffer="C:\\Storage\\", lpFilePart=0x0) returned 0xb [0228.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eeb8) returned 1 [0228.702] GetFileAttributesExW (in: lpFileName="C:\\Storage\\" (normalized: "c:\\storage"), fInfoLevelId=0x0, lpFileInformation=0x19ef34 | out: lpFileInformation=0x19ef34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0228.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eeb4) returned 1 [0228.704] GetFullPathNameW (in: lpFileName="\\mail\\", nBufferLength=0x105, lpBuffer=0x19ea5c, lpFilePart=0x0 | out: lpBuffer="C:\\mail\\", lpFilePart=0x0) returned 0x8 [0228.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eeb8) returned 1 [0228.704] GetFileAttributesExW (in: lpFileName="C:\\mail\\" (normalized: "c:\\mail"), fInfoLevelId=0x0, lpFileInformation=0x19ef34 | out: lpFileInformation=0x19ef34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0228.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eeb4) returned 1 [0228.705] CoTaskMemAlloc (cb=0x20c) returned 0x557588 [0228.705] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x557588 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0228.705] CoTaskMemFree (pv=0x557588) [0228.705] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0228.706] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\VirtualStore\\Program Files\\Foxmail\\mail\\", nBufferLength=0x105, lpBuffer=0x19ea5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\VirtualStore\\Program Files\\Foxmail\\mail\\", lpFilePart=0x0) returned 0x4c [0228.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eeb8) returned 1 [0228.707] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\VirtualStore\\Program Files\\Foxmail\\mail\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\virtualstore\\program files\\foxmail\\mail"), fInfoLevelId=0x0, lpFileInformation=0x19ef34 | out: lpFileInformation=0x19ef34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0228.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eeb4) returned 1 [0228.708] CoTaskMemAlloc (cb=0x20c) returned 0x557588 [0228.708] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x557588 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0228.708] CoTaskMemFree (pv=0x557588) [0228.708] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0228.709] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\VirtualStore\\Program Files (x86)\\Foxmail\\mail\\", nBufferLength=0x105, lpBuffer=0x19ea5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\VirtualStore\\Program Files (x86)\\Foxmail\\mail\\", lpFilePart=0x0) returned 0x52 [0228.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eeb8) returned 1 [0228.710] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\VirtualStore\\Program Files (x86)\\Foxmail\\mail\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\virtualstore\\program files (x86)\\foxmail\\mail"), fInfoLevelId=0x0, lpFileInformation=0x19ef34 | out: lpFileInformation=0x19ef34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0228.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eeb4) returned 1 [0228.790] CoTaskMemAlloc (cb=0x20c) returned 0x557588 [0228.790] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0x557588, nSize=0x104 | out: lpBuffer="") returned 0x25 [0228.790] CoTaskMemFree (pv=0x557588) [0228.792] CoTaskMemAlloc (cb=0x20c) returned 0x557588 [0228.792] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0x557588, nSize=0x104 | out: lpBuffer="") returned 0x25 [0228.792] CoTaskMemFree (pv=0x557588) [0228.856] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\", nBufferLength=0x105, lpBuffer=0x19ead4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\", lpFilePart=0x0) returned 0x52 [0228.856] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\*.xml", nBufferLength=0x105, lpBuffer=0x19eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\*.xml", lpFilePart=0x0) returned 0x57 [0228.856] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\", nBufferLength=0x105, lpBuffer=0x19eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\", lpFilePart=0x0) returned 0x52 [0228.856] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect", nBufferLength=0x105, lpBuffer=0x19eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect", lpFilePart=0x0) returned 0x51 [0228.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef98) returned 1 [0228.856] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect", nBufferLength=0x105, lpBuffer=0x19eaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect", lpFilePart=0x0) returned 0x51 [0228.856] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\", nBufferLength=0x105, lpBuffer=0x19ea74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\", lpFilePart=0x0) returned 0x52 [0228.857] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\*.xml" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\smartftp\\client 2.0\\favorites\\quick connect\\*.xml"), lpFindFileData=0x19ecc0 | out: lpFindFileData=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0228.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef5c) returned 1 [0228.870] SetErrorInfo (dwReserved=0x0, perrinfo=0x48c0f4) returned 0x0 [0228.872] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\", nBufferLength=0x105, lpBuffer=0x19eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\", lpFilePart=0x0) returned 0x52 [0228.914] CoTaskMemAlloc (cb=0x20c) returned 0x557588 [0228.914] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x557588 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0228.914] CoTaskMemFree (pv=0x557588) [0228.914] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19eb00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0228.915] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FTPGetter\\servers.xml", nBufferLength=0x105, lpBuffer=0x19eb9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FTPGetter\\servers.xml", lpFilePart=0x0) returned 0x3b [0228.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19effc) returned 1 [0228.916] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FTPGetter\\servers.xml" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\ftpgetter\\servers.xml"), fInfoLevelId=0x0, lpFileInformation=0x19f078 | out: lpFileInformation=0x19f078*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0228.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eff8) returned 1 [0228.925] CoTaskMemAlloc (cb=0x20c) returned 0x557588 [0228.925] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x557588 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0228.925] CoTaskMemFree (pv=0x557588) [0228.925] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19eaf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0228.928] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data", nBufferLength=0x105, lpBuffer=0x19eb88, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data", lpFilePart=0x0) returned 0x3f [0228.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efe4) returned 1 [0228.928] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tencent\\qqbrowser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f060 | out: lpFileInformation=0x19f060*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0228.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efe0) returned 1 [0228.929] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\Default\\EncryptedStorage", nBufferLength=0x105, lpBuffer=0x19eb90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\Default\\EncryptedStorage", lpFilePart=0x0) returned 0x58 [0228.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eff0) returned 1 [0228.931] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\Default\\EncryptedStorage" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tencent\\qqbrowser\\user data\\default\\encryptedstorage"), fInfoLevelId=0x0, lpFileInformation=0x19f06c | out: lpFileInformation=0x19f06c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0228.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efec) returned 1 [0228.943] CoTaskMemAlloc (cb=0x20c) returned 0x557588 [0228.943] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x557588 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0228.943] CoTaskMemFree (pv=0x557588) [0228.943] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0228.945] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\falkon\\profiles\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\falkon\\profiles\\profiles.ini", lpFilePart=0x0) returned 0x40 [0228.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef10) returned 1 [0228.945] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\falkon\\profiles\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\falkon\\profiles\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0228.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d5e8) returned 1 [0228.996] CoTaskMemAlloc (cb=0x20c) returned 0x557588 [0228.996] GetEnvironmentVariableW (in: lpName="appdata", lpBuffer=0x557588, nSize=0x104 | out: lpBuffer="") returned 0x25 [0228.996] CoTaskMemFree (pv=0x557588) [0228.998] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Ipswitch\\WS_FTP\\Sites\\ws_ftp.ini", nBufferLength=0x105, lpBuffer=0x19eb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Ipswitch\\WS_FTP\\Sites\\ws_ftp.ini", lpFilePart=0x0) returned 0x46 [0228.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efb4) returned 1 [0228.998] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Ipswitch\\WS_FTP\\Sites\\ws_ftp.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\ipswitch\\ws_ftp\\sites\\ws_ftp.ini"), fInfoLevelId=0x0, lpFileInformation=0x19f030 | out: lpFileInformation=0x19f030*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0228.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efb0) returned 1 [0229.009] CoTaskMemAlloc (cb=0x20c) returned 0x557588 [0229.009] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0x557588, nSize=0x104 | out: lpBuffer="") returned 0x25 [0229.009] CoTaskMemFree (pv=0x557588) [0229.011] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FileZilla\\recentservers.xml", nBufferLength=0x105, lpBuffer=0x19ea48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FileZilla\\recentservers.xml", lpFilePart=0x0) returned 0x41 [0229.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef3c) returned 1 [0229.011] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FileZilla\\recentservers.xml" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\filezilla\\recentservers.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0229.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d618) returned 1 [0229.043] CoTaskMemAlloc (cb=0x20c) returned 0x557588 [0229.043] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x557588, nSize=0x104 | out: lpBuffer="") returned 0x2 [0229.044] CoTaskMemFree (pv=0x557588) [0229.045] GetFullPathNameW (in: lpFileName="C:\\FTP Navigator\\Ftplist.txt", nBufferLength=0x105, lpBuffer=0x19ea3c, lpFilePart=0x0 | out: lpBuffer="C:\\FTP Navigator\\Ftplist.txt", lpFilePart=0x0) returned 0x1c [0229.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef30) returned 1 [0229.045] CreateFileW (lpFileName="C:\\FTP Navigator\\Ftplist.txt" (normalized: "c:\\ftp navigator\\ftplist.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0229.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0229.081] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\OpenVPN-GUI\\configs", ulOptions=0x0, samDesired=0x2001f, phkResult=0x19f06c | out: phkResult=0x19f06c*=0x0) returned 0x2 [0229.085] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\profiles.ini", lpFilePart=0x0) returned 0x3e [0229.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0229.085] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\thunderbird\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0229.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0229.091] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\profiles.ini", lpFilePart=0x0) returned 0x3e [0229.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0229.091] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\thunderbird\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0229.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0229.163] CoTaskMemAlloc (cb=0x20c) returned 0x557588 [0229.163] SHGetFolderPathW (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x557588 | out: pszPath="C:\\ProgramData") returned 0x0 [0229.165] CoTaskMemFree (pv=0x557588) [0229.166] GetFullPathNameW (in: lpFileName="C:\\ProgramData", nBufferLength=0x105, lpBuffer=0x19ea70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData", lpFilePart=0x0) returned 0xe [0229.167] CoTaskMemAlloc (cb=0x20c) returned 0x557588 [0229.167] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x557588 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0229.167] CoTaskMemFree (pv=0x557588) [0229.167] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19ea70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0229.167] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\FlashFXP\\", nBufferLength=0x105, lpBuffer=0x19eb04, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\FlashFXP\\", lpFilePart=0x0) returned 0x18 [0229.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef60) returned 1 [0229.168] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\FlashFXP\\" (normalized: "c:\\programdata\\flashfxp"), fInfoLevelId=0x0, lpFileInformation=0x19efdc | out: lpFileInformation=0x19efdc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0229.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef5c) returned 1 [0229.168] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FlashFXP\\", nBufferLength=0x105, lpBuffer=0x19eb04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FlashFXP\\", lpFilePart=0x0) returned 0x2f [0229.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef60) returned 1 [0229.168] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FlashFXP\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\flashfxp"), fInfoLevelId=0x0, lpFileInformation=0x19efdc | out: lpFileInformation=0x19efdc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0229.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef5c) returned 1 [0229.173] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\FTPWare\\COREFTP\\Sites", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f06c | out: phkResult=0x19f06c*=0x0) returned 0x2 [0229.197] CoTaskMemAlloc (cb=0x20c) returned 0x557588 [0229.197] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x557588 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0229.197] CoTaskMemFree (pv=0x557588) [0229.198] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0229.199] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Mail\\Opera Mail\\wand.dat", nBufferLength=0x105, lpBuffer=0x19eb8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Mail\\Opera Mail\\wand.dat", lpFilePart=0x0) returned 0x44 [0229.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efec) returned 1 [0229.199] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Mail\\Opera Mail\\wand.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera mail\\opera mail\\wand.dat"), fInfoLevelId=0x0, lpFileInformation=0x19f068 | out: lpFileInformation=0x19f068*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0229.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efe8) returned 1 [0229.215] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f05c | out: phkResult=0x19f05c*=0x0) returned 0x2 [0229.275] CoTaskMemAlloc (cb=0x20c) returned 0x557588 [0229.275] GetEnvironmentVariableW (in: lpName="appdata", lpBuffer=0x557588, nSize=0x104 | out: lpBuffer="") returned 0x25 [0229.276] CoTaskMemFree (pv=0x557588) [0229.280] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Pocomail\\accounts.ini", nBufferLength=0x105, lpBuffer=0x19eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Pocomail\\accounts.ini", lpFilePart=0x0) returned 0x3b [0229.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efc4) returned 1 [0229.281] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Pocomail\\accounts.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\pocomail\\accounts.ini"), fInfoLevelId=0x0, lpFileInformation=0x19f040 | out: lpFileInformation=0x19f040*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0229.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efc0) returned 1 [0229.385] CoTaskMemAlloc (cb=0x20c) returned 0x557588 [0229.385] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x557588 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0229.385] CoTaskMemFree (pv=0x557588) [0229.385] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19ea30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0229.387] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Claws-mail", nBufferLength=0x105, lpBuffer=0x19eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Claws-mail", lpFilePart=0x0) returned 0x30 [0229.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef20) returned 1 [0229.388] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Claws-mail" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\claws-mail"), fInfoLevelId=0x0, lpFileInformation=0x19ef9c | out: lpFileInformation=0x19ef9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0229.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef1c) returned 1 [0229.391] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Claws-mail\\clawsrc", nBufferLength=0x105, lpBuffer=0x19eacc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Claws-mail\\clawsrc", lpFilePart=0x0) returned 0x38 [0229.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0229.391] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Claws-mail\\clawsrc" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\claws-mail\\clawsrc"), fInfoLevelId=0x0, lpFileInformation=0x19efa8 | out: lpFileInformation=0x19efa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0229.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef28) returned 1 [0229.410] GetUserNameW (in: lpBuffer=0x19f1bc, pcbBuffer=0x224f1ac | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x224f1ac) returned 1 [0229.411] GetComputerNameW (in: lpBuffer=0x19f1bc, nSize=0x224f674 | out: lpBuffer="XC64ZB", nSize=0x224f674) returned 1 [0229.444] GetTimeZoneInformation (in: lpTimeZoneInformation=0x19f230 | out: lpTimeZoneInformation=0x19f230) returned 0x2 [0229.488] GetUserNameW (in: lpBuffer=0x19f1ac, pcbBuffer=0x2253054 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x2253054) returned 1 [0229.493] GetComputerNameW (in: lpBuffer=0x19f1ac, nSize=0x22534ec | out: lpBuffer="XC64ZB", nSize=0x22534ec) returned 1 [0229.519] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x504 [0229.519] SetEvent (hEvent=0x3c8) returned 1 [0229.519] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f32c*=0x504, lpdwindex=0x19f14c | out: lpdwindex=0x19f14c) returned 0x0 [0229.521] CoGetContextToken (in: pToken=0x19e164 | out: pToken=0x19e164) returned 0x0 [0229.521] CoGetContextToken (in: pToken=0x19e14c | out: pToken=0x19e14c) returned 0x0 [0229.521] CoGetContextToken (in: pToken=0x19e0d8 | out: pToken=0x19e0d8) returned 0x0 [0229.521] IUnknown:Release (This=0x4e4f50) returned 0x1 [0229.522] IUnknown:Release (This=0x4e4f50) returned 0x0 [0229.522] CoGetContextToken (in: pToken=0x19e0d8 | out: pToken=0x19e0d8) returned 0x0 [0229.522] IUnknown:Release (This=0x4eaea0) returned 0x1 [0229.522] IUnknown:Release (This=0x4eaea0) returned 0x0 [0229.522] IUnknown:Release (This=0x4e0028) returned 0x3 [0229.522] CoGetContextToken (in: pToken=0x19e0d8 | out: pToken=0x19e0d8) returned 0x0 [0229.522] CoGetContextToken (in: pToken=0x19e0d8 | out: pToken=0x19e0d8) returned 0x0 [0229.522] IUnknown:Release (This=0x506d00) returned 0x1 [0229.522] IUnknown:Release (This=0x506d00) returned 0x0 [0229.538] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0229.538] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0229.538] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0229.538] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0229.538] IUnknown:Release (This=0x5001b8) returned 0x0 [0229.538] IUnknown:Release (This=0x500210) returned 0x0 [0229.538] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0229.538] CoGetContextToken (in: pToken=0x19e0d8 | out: pToken=0x19e0d8) returned 0x0 [0229.539] WbemLocator:IUnknown:Release (This=0x4fb470) returned 0x2 [0229.539] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0229.539] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0229.539] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0229.539] IUnknown:Release (This=0x500108) returned 0x0 [0229.539] IUnknown:Release (This=0x5000dc) returned 0x0 [0229.539] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0229.539] IUnknown:Release (This=0x509950) returned 0x1 [0229.539] IUnknown:Release (This=0x509950) returned 0x0 [0229.546] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0229.546] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0229.546] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0229.546] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0229.546] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0229.546] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0229.546] CoGetContextToken (in: pToken=0x19e0d8 | out: pToken=0x19e0d8) returned 0x0 [0229.546] IUnknown:Release (This=0x4e8388) returned 0x1 [0229.546] WbemLocator:IUnknown:Release (This=0x4fb470) returned 0x1 [0229.546] WbemLocator:IUnknown:Release (This=0x4fb470) returned 0x0 [0229.549] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0229.549] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0229.549] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0229.549] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0229.549] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0229.549] IUnknown:Release (This=0x4e8388) returned 0x0 [0229.550] IUnknown:Release (This=0x500268) returned 0x0 [0229.550] IUnknown:Release (This=0x50023c) returned 0x0 [0229.551] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0229.551] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0229.551] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0229.552] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0229.552] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0229.552] CoGetContextToken (in: pToken=0x19e0d8 | out: pToken=0x19e0d8) returned 0x0 [0229.552] WbemLocator:IUnknown:Release (This=0x502688) returned 0x1 [0229.552] WbemLocator:IUnknown:Release (This=0x4fb920) returned 0x0 [0229.552] CoGetContextToken (in: pToken=0x19e0d8 | out: pToken=0x19e0d8) returned 0x0 [0229.552] IUnknown:Release (This=0x4e8b80) returned 0x2 [0229.552] IUnknown:Release (This=0x4e8b80) returned 0x1 [0229.552] CoGetContextToken (in: pToken=0x19e0d8 | out: pToken=0x19e0d8) returned 0x0 [0229.552] WbemLocator:IUnknown:Release (This=0x502288) returned 0x1 [0229.552] WbemLocator:IUnknown:Release (This=0x4fbec0) returned 0x0 [0229.552] CoGetContextToken (in: pToken=0x19e0d8 | out: pToken=0x19e0d8) returned 0x0 [0229.552] IUnknown:Release (This=0x4e86b8) returned 0x1 [0229.552] IUnknown:Release (This=0x4e86b8) returned 0x0 [0229.552] CoGetContextToken (in: pToken=0x19e0d8 | out: pToken=0x19e0d8) returned 0x0 [0229.553] IUnknown:Release (This=0x4e8eb0) returned 0x1 [0229.553] IUnknown:Release (This=0x4e8eb0) returned 0x0 [0229.553] CoGetContextToken (in: pToken=0x19e0d8 | out: pToken=0x19e0d8) returned 0x0 [0229.553] IUnknown:Release (This=0x5460c0) returned 0x1 [0229.553] IUnknown:Release (This=0x5460c0) returned 0x0 [0229.553] CoGetContextToken (in: pToken=0x19e0d8 | out: pToken=0x19e0d8) returned 0x0 [0229.553] IUnknown:Release (This=0x546d80) returned 0x1 [0229.553] IUnknown:Release (This=0x546d80) returned 0x0 [0229.553] CoGetContextToken (in: pToken=0x19e0d8 | out: pToken=0x19e0d8) returned 0x0 [0229.553] IUnknown:Release (This=0x546a50) returned 0x1 [0229.553] IUnknown:Release (This=0x546a50) returned 0x0 [0229.553] CoGetContextToken (in: pToken=0x19e0d8 | out: pToken=0x19e0d8) returned 0x0 [0229.553] IUnknown:Release (This=0x5470b0) returned 0x2 [0229.553] IUnknown:Release (This=0x5470b0) returned 0x1 [0229.555] CoGetContextToken (in: pToken=0x19f1f8 | out: pToken=0x19f1f8) returned 0x0 [0229.555] CoGetContextToken (in: pToken=0x19f158 | out: pToken=0x19f158) returned 0x0 [0229.555] WbemDefPath:IUnknown:QueryInterface (in: This=0x52be58, riid=0x19f228*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f224 | out: ppvObject=0x19f224*=0x52be58) returned 0x0 [0229.555] WbemDefPath:IUnknown:AddRef (This=0x52be58) returned 0x3 [0229.555] WbemDefPath:IUnknown:Release (This=0x52be58) returned 0x2 [0229.555] WbemDefPath:IWbemPath:SetText (This=0x52be58, uMode=0x4, pszPath="Win32_OperatingSystem") returned 0x0 [0229.556] WbemDefPath:IWbemPath:GetInfo (in: This=0x52be58, uRequestedInfo=0x0, puResponse=0x19f3d8 | out: puResponse=0x19f3d8*=0xc15) returned 0x0 [0229.556] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x52be58, puCount=0x19f3d0 | out: puCount=0x19f3d0*=0x0) returned 0x0 [0229.559] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0568, puCount=0x19f3a8 | out: puCount=0x19f3a8*=0x2) returned 0x0 [0229.559] WbemDefPath:IWbemPath:GetText (in: This=0x4e0568, lFlags=4, puBuffLength=0x19f3a4*=0x0, pszText=0x0 | out: puBuffLength=0x19f3a4*=0xf, pszText=0x0) returned 0x0 [0229.559] WbemDefPath:IWbemPath:GetText (in: This=0x4e0568, lFlags=4, puBuffLength=0x19f3a4*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3a4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.577] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f244*=0x50c, lpdwindex=0x19f0f4 | out: lpdwindex=0x19f0f4) returned 0x0 [0229.577] CoGetContextToken (in: pToken=0x19e10c | out: pToken=0x19e10c) returned 0x0 [0229.577] CoGetContextToken (in: pToken=0x19e0cc | out: pToken=0x19e0cc) returned 0x0 [0229.577] WbemLocator:IUnknown:Release (This=0x502088) returned 0x1 [0229.577] IUnknown:Release (This=0x5096f8) returned 0x0 [0229.594] CoGetContextToken (in: pToken=0x19e10c | out: pToken=0x19e10c) returned 0x0 [0229.594] CoGetContextToken (in: pToken=0x19e0cc | out: pToken=0x19e0cc) returned 0x0 [0229.594] WbemLocator:IUnknown:Release (This=0x502788) returned 0x1 [0229.594] IUnknown:Release (This=0x509ae0) returned 0x0 [0229.636] CoGetContextToken (in: pToken=0x19f000 | out: pToken=0x19f000) returned 0x0 [0229.636] CoGetContextToken (in: pToken=0x19efa8 | out: pToken=0x19efa8) returned 0x0 [0229.636] IUnknown:QueryInterface (in: This=0x4c0110, riid=0x6c218724*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ef88 | out: ppvObject=0x19ef88*=0x4c0120) returned 0x0 [0229.636] CObjectContext::ContextCallback () returned 0x0 [0229.638] IUnknown:Release (This=0x4c0120) returned 0x1 [0229.638] CoUnmarshalInterface (in: pStm=0x553ca8, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eff0 | out: ppv=0x19eff0*=0x502288) returned 0x0 [0229.639] CoMarshalInterface (pStm=0x553ca8, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x502288, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0229.639] WbemLocator:IUnknown:QueryInterface (in: This=0x502288, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee94 | out: ppvObject=0x19ee94*=0x502288) returned 0x0 [0229.639] WbemLocator:IUnknown:QueryInterface (in: This=0x502288, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ee50 | out: ppvObject=0x19ee50*=0x0) returned 0x80004002 [0229.639] WbemLocator:IUnknown:QueryInterface (in: This=0x502288, riid=0x6c29fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ec6c | out: ppvObject=0x19ec6c*=0x0) returned 0x80004002 [0229.640] WbemLocator:IUnknown:QueryInterface (in: This=0x502288, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19ea44 | out: ppvObject=0x19ea44*=0x0) returned 0x80004002 [0229.640] WbemLocator:IUnknown:AddRef (This=0x502288) returned 0x3 [0229.640] WbemLocator:IUnknown:QueryInterface (in: This=0x502288, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e7ac | out: ppvObject=0x19e7ac*=0x0) returned 0x80004002 [0229.640] WbemLocator:IUnknown:QueryInterface (in: This=0x502288, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e75c | out: ppvObject=0x19e75c*=0x0) returned 0x80004002 [0229.640] WbemLocator:IUnknown:QueryInterface (in: This=0x502288, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e768 | out: ppvObject=0x19e768*=0x5021e4) returned 0x0 [0229.641] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5021e4, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e770 | out: pCid=0x19e770*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0229.641] WbemLocator:IUnknown:Release (This=0x5021e4) returned 0x3 [0229.641] CoGetContextToken (in: pToken=0x19e7c8 | out: pToken=0x19e7c8) returned 0x0 [0229.641] CoGetObjectContext (in: riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x549f44 | out: ppv=0x549f44*=0x4c0058) returned 0x0 [0229.641] CoGetContextToken (in: pToken=0x19ebd0 | out: pToken=0x19ebd0) returned 0x0 [0229.641] WbemLocator:IUnknown:QueryInterface (in: This=0x502288, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec60 | out: ppvObject=0x19ec60*=0x50226c) returned 0x0 [0229.641] WbemLocator:IRpcOptions:Query (in: This=0x50226c, pPrx=0x502288, dwProperty=2, pdwValue=0x19ec88 | out: pdwValue=0x19ec88) returned 0x0 [0229.641] WbemLocator:IUnknown:Release (This=0x50226c) returned 0x3 [0229.641] WbemLocator:IUnknown:Release (This=0x502288) returned 0x2 [0229.641] WbemLocator:IUnknown:Release (This=0x502288) returned 0x1 [0229.641] CoGetContextToken (in: pToken=0x19ef40 | out: pToken=0x19ef40) returned 0x0 [0229.641] WbemLocator:IUnknown:AddRef (This=0x502288) returned 0x2 [0229.641] WbemLocator:IUnknown:QueryInterface (in: This=0x502288, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1fc | out: ppvObject=0x19f1fc*=0x502264) returned 0x0 [0229.641] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x502264, pProxy=0x502288, pAuthnSvc=0x19f24c, pAuthzSvc=0x19f248, pServerPrincName=0x19f240, pAuthnLevel=0x19f244, pImpLevel=0x19f234, pAuthInfo=0x19f238, pCapabilites=0x19f23c | out: pAuthnSvc=0x19f24c*=0xa, pAuthzSvc=0x19f248*=0x0, pServerPrincName=0x19f240, pAuthnLevel=0x19f244*=0x6, pImpLevel=0x19f234*=0x2, pAuthInfo=0x19f238, pCapabilites=0x19f23c*=0x1) returned 0x0 [0229.641] WbemLocator:IUnknown:Release (This=0x502264) returned 0x2 [0229.641] WbemLocator:IUnknown:QueryInterface (in: This=0x502288, riid=0x6c8110f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1f0 | out: ppvObject=0x19f1f0*=0x502288) returned 0x0 [0229.641] WbemLocator:IUnknown:QueryInterface (in: This=0x502288, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1ec | out: ppvObject=0x19f1ec*=0x502264) returned 0x0 [0229.642] WbemLocator:IClientSecurity:SetBlanket (This=0x502264, pProxy=0x502288, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0229.642] WbemLocator:IUnknown:Release (This=0x502264) returned 0x3 [0229.642] WbemLocator:IUnknown:Release (This=0x502288) returned 0x2 [0229.642] CoTaskMemFree (pv=0x5037c0) [0229.642] WbemLocator:IUnknown:Release (This=0x502288) returned 0x1 [0229.642] SysStringLen (param_1=0x0) returned 0x0 [0229.642] CoGetContextToken (in: pToken=0x19f1b8 | out: pToken=0x19f1b8) returned 0x0 [0229.642] CoGetContextToken (in: pToken=0x19f118 | out: pToken=0x19f118) returned 0x0 [0229.642] WbemLocator:IUnknown:QueryInterface (in: This=0x502288, riid=0x19f1e8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19f1e4 | out: ppvObject=0x19f1e4*=0x548b30) returned 0x0 [0229.644] WbemLocator:IUnknown:AddRef (This=0x548b30) returned 0x3 [0229.644] WbemLocator:IUnknown:Release (This=0x548b30) returned 0x2 [0229.644] CoGetContextToken (in: pToken=0x19f178 | out: pToken=0x19f178) returned 0x0 [0229.644] WbemLocator:IUnknown:AddRef (This=0x548b30) returned 0x3 [0229.644] WbemLocator:IUnknown:QueryInterface (in: This=0x548b30, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1fc | out: ppvObject=0x19f1fc*=0x502264) returned 0x0 [0229.644] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x502264, pProxy=0x548b30, pAuthnSvc=0x19f24c, pAuthzSvc=0x19f248, pServerPrincName=0x19f240, pAuthnLevel=0x19f244, pImpLevel=0x19f234, pAuthInfo=0x19f238, pCapabilites=0x19f23c | out: pAuthnSvc=0x19f24c*=0xa, pAuthzSvc=0x19f248*=0x0, pServerPrincName=0x19f240, pAuthnLevel=0x19f244*=0x6, pImpLevel=0x19f234*=0x2, pAuthInfo=0x19f238, pCapabilites=0x19f23c*=0x1) returned 0x0 [0229.644] WbemLocator:IUnknown:Release (This=0x502264) returned 0x3 [0229.644] WbemLocator:IUnknown:QueryInterface (in: This=0x548b30, riid=0x6c8110f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1f0 | out: ppvObject=0x19f1f0*=0x502288) returned 0x0 [0229.644] WbemLocator:IUnknown:QueryInterface (in: This=0x548b30, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1ec | out: ppvObject=0x19f1ec*=0x502264) returned 0x0 [0229.644] WbemLocator:IClientSecurity:SetBlanket (This=0x502264, pProxy=0x548b30, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0229.645] WbemLocator:IUnknown:Release (This=0x502264) returned 0x4 [0229.645] WbemLocator:IUnknown:Release (This=0x502288) returned 0x3 [0229.645] CoTaskMemFree (pv=0x503bb0) [0229.645] WbemLocator:IUnknown:Release (This=0x548b30) returned 0x2 [0229.645] SysStringLen (param_1=0x0) returned 0x0 [0229.645] CoGetContextToken (in: pToken=0x19f0f0 | out: pToken=0x19f0f0) returned 0x0 [0229.645] WbemLocator:IUnknown:AddRef (This=0x548b30) returned 0x3 [0229.645] IWbemServices:ExecQuery (in: This=0x548b30, strQueryLanguage="WQL", strQuery="select * from Win32_OperatingSystem", lFlags=16, pCtx=0x0, ppEnum=0x19f308 | out: ppEnum=0x19f308*=0x509950) returned 0x0 [0229.728] IUnknown:QueryInterface (in: This=0x509950, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f160 | out: ppvObject=0x19f160*=0x509954) returned 0x0 [0229.728] IClientSecurity:QueryBlanket (in: This=0x509954, pProxy=0x509950, pAuthnSvc=0x19f1b0, pAuthzSvc=0x19f1ac, pServerPrincName=0x19f1a4, pAuthnLevel=0x19f1a8, pImpLevel=0x19f198, pAuthInfo=0x19f19c, pCapabilites=0x19f1a0 | out: pAuthnSvc=0x19f1b0*=0xa, pAuthzSvc=0x19f1ac*=0x0, pServerPrincName=0x19f1a4, pAuthnLevel=0x19f1a8*=0x6, pImpLevel=0x19f198*=0x2, pAuthInfo=0x19f19c, pCapabilites=0x19f1a0*=0x1) returned 0x0 [0229.728] IUnknown:Release (This=0x509954) returned 0x1 [0229.728] IUnknown:QueryInterface (in: This=0x509950, riid=0x6c8110f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f154 | out: ppvObject=0x19f154*=0x501188) returned 0x0 [0229.728] IUnknown:QueryInterface (in: This=0x509950, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f150 | out: ppvObject=0x19f150*=0x509954) returned 0x0 [0229.728] IClientSecurity:SetBlanket (This=0x509954, pProxy=0x509950, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0229.762] IUnknown:Release (This=0x509954) returned 0x2 [0229.762] WbemLocator:IUnknown:Release (This=0x501188) returned 0x1 [0229.762] CoTaskMemFree (pv=0x503be0) [0229.762] IUnknown:QueryInterface (in: This=0x509950, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed4c | out: ppvObject=0x19ed4c*=0x501188) returned 0x0 [0229.763] WbemLocator:IUnknown:QueryInterface (in: This=0x501188, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ed08 | out: ppvObject=0x19ed08*=0x0) returned 0x80004002 [0229.763] WbemLocator:IUnknown:QueryInterface (in: This=0x501188, riid=0x6c29fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19eb24 | out: ppvObject=0x19eb24*=0x0) returned 0x80004002 [0229.764] IUnknown:QueryInterface (in: This=0x509950, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e8fc | out: ppvObject=0x19e8fc*=0x0) returned 0x80004002 [0229.765] WbemLocator:IUnknown:AddRef (This=0x501188) returned 0x3 [0229.765] WbemLocator:IUnknown:QueryInterface (in: This=0x501188, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e664 | out: ppvObject=0x19e664*=0x0) returned 0x80004002 [0229.765] WbemLocator:IUnknown:QueryInterface (in: This=0x501188, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e614 | out: ppvObject=0x19e614*=0x0) returned 0x80004002 [0229.765] WbemLocator:IUnknown:QueryInterface (in: This=0x501188, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e620 | out: ppvObject=0x19e620*=0x5010e4) returned 0x0 [0229.765] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5010e4, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e628 | out: pCid=0x19e628*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0229.765] WbemLocator:IUnknown:Release (This=0x5010e4) returned 0x3 [0229.765] CoGetContextToken (in: pToken=0x19e680 | out: pToken=0x19e680) returned 0x0 [0229.765] CoGetContextToken (in: pToken=0x19ea88 | out: pToken=0x19ea88) returned 0x0 [0229.765] WbemLocator:IUnknown:QueryInterface (in: This=0x501188, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eb18 | out: ppvObject=0x19eb18*=0x50116c) returned 0x0 [0229.765] WbemLocator:IRpcOptions:Query (in: This=0x50116c, pPrx=0x501188, dwProperty=2, pdwValue=0x19eb40 | out: pdwValue=0x19eb40) returned 0x80004002 [0229.765] WbemLocator:IUnknown:Release (This=0x50116c) returned 0x3 [0229.765] WbemLocator:IUnknown:Release (This=0x501188) returned 0x2 [0229.766] CoGetContextToken (in: pToken=0x19f060 | out: pToken=0x19f060) returned 0x0 [0229.766] CoGetContextToken (in: pToken=0x19efc0 | out: pToken=0x19efc0) returned 0x0 [0229.766] WbemLocator:IUnknown:QueryInterface (in: This=0x501188, riid=0x19f090*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f08c | out: ppvObject=0x19f08c*=0x509950) returned 0x0 [0229.766] IUnknown:AddRef (This=0x509950) returned 0x4 [0229.766] IUnknown:Release (This=0x509950) returned 0x3 [0229.766] IUnknown:Release (This=0x509950) returned 0x2 [0229.766] WbemLocator:IUnknown:Release (This=0x548b30) returned 0x2 [0229.766] SysStringLen (param_1=0x0) returned 0x0 [0229.766] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0568, puCount=0x19f354 | out: puCount=0x19f354*=0x2) returned 0x0 [0229.766] WbemDefPath:IWbemPath:GetText (in: This=0x4e0568, lFlags=4, puBuffLength=0x19f350*=0x0, pszText=0x0 | out: puBuffLength=0x19f350*=0xf, pszText=0x0) returned 0x0 [0229.766] WbemDefPath:IWbemPath:GetText (in: This=0x4e0568, lFlags=4, puBuffLength=0x19f350*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f350*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.766] CoGetContextToken (in: pToken=0x19f190 | out: pToken=0x19f190) returned 0x0 [0229.766] IUnknown:AddRef (This=0x509950) returned 0x3 [0229.766] IEnumWbemClassObject:Clone (in: This=0x509950, ppEnum=0x19f350 | out: ppEnum=0x19f350*=0x508f28) returned 0x0 [0229.768] IUnknown:QueryInterface (in: This=0x508f28, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f214 | out: ppvObject=0x19f214*=0x508f2c) returned 0x0 [0229.768] IClientSecurity:QueryBlanket (in: This=0x508f2c, pProxy=0x508f28, pAuthnSvc=0x19f264, pAuthzSvc=0x19f260, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c, pImpLevel=0x19f24c, pAuthInfo=0x19f250, pCapabilites=0x19f254 | out: pAuthnSvc=0x19f264*=0xa, pAuthzSvc=0x19f260*=0x0, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c*=0x6, pImpLevel=0x19f24c*=0x2, pAuthInfo=0x19f250, pCapabilites=0x19f254*=0x1) returned 0x0 [0229.768] IUnknown:Release (This=0x508f2c) returned 0x1 [0229.768] IUnknown:QueryInterface (in: This=0x508f28, riid=0x6c8110f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f208 | out: ppvObject=0x19f208*=0x502688) returned 0x0 [0229.768] IUnknown:QueryInterface (in: This=0x508f28, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x508f2c) returned 0x0 [0229.768] IClientSecurity:SetBlanket (This=0x508f2c, pProxy=0x508f28, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0229.770] IUnknown:Release (This=0x508f2c) returned 0x2 [0229.770] WbemLocator:IUnknown:Release (This=0x502688) returned 0x1 [0229.770] CoTaskMemFree (pv=0x503be0) [0229.770] IUnknown:QueryInterface (in: This=0x508f28, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19edf0 | out: ppvObject=0x19edf0*=0x502688) returned 0x0 [0229.771] WbemLocator:IUnknown:QueryInterface (in: This=0x502688, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19edac | out: ppvObject=0x19edac*=0x0) returned 0x80004002 [0229.771] WbemLocator:IUnknown:QueryInterface (in: This=0x502688, riid=0x6c29fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ebcc | out: ppvObject=0x19ebcc*=0x0) returned 0x80004002 [0229.772] IUnknown:QueryInterface (in: This=0x508f28, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e9a4 | out: ppvObject=0x19e9a4*=0x0) returned 0x80004002 [0229.773] WbemLocator:IUnknown:AddRef (This=0x502688) returned 0x3 [0229.773] WbemLocator:IUnknown:QueryInterface (in: This=0x502688, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e70c | out: ppvObject=0x19e70c*=0x0) returned 0x80004002 [0229.773] WbemLocator:IUnknown:QueryInterface (in: This=0x502688, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e6bc | out: ppvObject=0x19e6bc*=0x0) returned 0x80004002 [0229.773] WbemLocator:IUnknown:QueryInterface (in: This=0x502688, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e6c8 | out: ppvObject=0x19e6c8*=0x5025e4) returned 0x0 [0229.773] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5025e4, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e6d0 | out: pCid=0x19e6d0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0229.773] WbemLocator:IUnknown:Release (This=0x5025e4) returned 0x3 [0229.773] CoGetContextToken (in: pToken=0x19e728 | out: pToken=0x19e728) returned 0x0 [0229.773] CoGetContextToken (in: pToken=0x19eb30 | out: pToken=0x19eb30) returned 0x0 [0229.773] WbemLocator:IUnknown:QueryInterface (in: This=0x502688, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ebc0 | out: ppvObject=0x19ebc0*=0x50266c) returned 0x0 [0229.773] WbemLocator:IRpcOptions:Query (in: This=0x50266c, pPrx=0x502688, dwProperty=2, pdwValue=0x19ebe8 | out: pdwValue=0x19ebe8) returned 0x80004002 [0229.773] WbemLocator:IUnknown:Release (This=0x50266c) returned 0x3 [0229.773] WbemLocator:IUnknown:Release (This=0x502688) returned 0x2 [0229.774] CoGetContextToken (in: pToken=0x19f100 | out: pToken=0x19f100) returned 0x0 [0229.774] CoGetContextToken (in: pToken=0x19f060 | out: pToken=0x19f060) returned 0x0 [0229.774] WbemLocator:IUnknown:QueryInterface (in: This=0x502688, riid=0x19f130*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f12c | out: ppvObject=0x19f12c*=0x508f28) returned 0x0 [0229.774] IUnknown:AddRef (This=0x508f28) returned 0x4 [0229.774] IUnknown:Release (This=0x508f28) returned 0x3 [0229.774] IUnknown:Release (This=0x508f28) returned 0x2 [0229.774] IUnknown:Release (This=0x509950) returned 0x2 [0229.774] SysStringLen (param_1=0x0) returned 0x0 [0229.774] IEnumWbemClassObject:Reset (This=0x508f28) returned 0x0 [0229.775] CoTaskMemAlloc (cb=0x4) returned 0x4e9508 [0229.775] IEnumWbemClassObject:Next (in: This=0x508f28, lTimeout=-1, uCount=0x1, apObjects=0x4e9508, puReturned=0x2254ae0 | out: apObjects=0x4e9508*=0x4e8520, puReturned=0x2254ae0*=0x1) returned 0x0 [0229.789] IUnknown:QueryInterface (in: This=0x4e8520, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e9b0 | out: ppvObject=0x19e9b0*=0x4e8520) returned 0x0 [0229.789] IUnknown:QueryInterface (in: This=0x4e8520, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e96c | out: ppvObject=0x19e96c*=0x0) returned 0x80004002 [0229.789] IUnknown:QueryInterface (in: This=0x4e8520, riid=0x6c29fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e78c | out: ppvObject=0x19e78c*=0x0) returned 0x80004002 [0229.789] IUnknown:QueryInterface (in: This=0x4e8520, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e564 | out: ppvObject=0x19e564*=0x0) returned 0x80004002 [0229.790] IUnknown:AddRef (This=0x4e8520) returned 0x3 [0229.790] IUnknown:QueryInterface (in: This=0x4e8520, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2cc | out: ppvObject=0x19e2cc*=0x0) returned 0x80004002 [0229.790] IUnknown:QueryInterface (in: This=0x4e8520, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e27c | out: ppvObject=0x19e27c*=0x0) returned 0x80004002 [0229.790] IUnknown:QueryInterface (in: This=0x4e8520, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e288 | out: ppvObject=0x19e288*=0x4e8524) returned 0x0 [0229.790] IMarshal:GetUnmarshalClass (in: This=0x4e8524, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e290 | out: pCid=0x19e290*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0229.790] IUnknown:Release (This=0x4e8524) returned 0x3 [0229.790] CoGetContextToken (in: pToken=0x19e2e8 | out: pToken=0x19e2e8) returned 0x0 [0229.790] CoGetContextToken (in: pToken=0x19e6f0 | out: pToken=0x19e6f0) returned 0x0 [0229.790] IUnknown:QueryInterface (in: This=0x4e8520, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e780 | out: ppvObject=0x19e780*=0x0) returned 0x80004002 [0229.790] IUnknown:Release (This=0x4e8520) returned 0x2 [0229.790] CoGetContextToken (in: pToken=0x19ecc0 | out: pToken=0x19ecc0) returned 0x0 [0229.790] CoGetContextToken (in: pToken=0x19ec20 | out: pToken=0x19ec20) returned 0x0 [0229.790] IUnknown:QueryInterface (in: This=0x4e8520, riid=0x19ecf0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ecec | out: ppvObject=0x19ecec*=0x4e8520) returned 0x0 [0229.790] IUnknown:AddRef (This=0x4e8520) returned 0x4 [0229.790] IUnknown:Release (This=0x4e8520) returned 0x3 [0229.790] IUnknown:Release (This=0x4e8520) returned 0x2 [0229.790] CoTaskMemFree (pv=0x4e9508) [0229.790] CoGetContextToken (in: pToken=0x19f030 | out: pToken=0x19f030) returned 0x0 [0229.790] IUnknown:AddRef (This=0x4e8520) returned 0x3 [0229.790] CoTaskMemAlloc (cb=0x4) returned 0x4e9468 [0229.791] IEnumWbemClassObject:Next (in: This=0x508f28, lTimeout=-1, uCount=0x1, apObjects=0x4e9468, puReturned=0x2254ae0 | out: apObjects=0x4e9468*=0x0, puReturned=0x2254ae0*=0x0) returned 0x1 [0229.791] CoTaskMemFree (pv=0x4e9468) [0229.791] CoGetContextToken (in: pToken=0x19f1a0 | out: pToken=0x19f1a0) returned 0x0 [0229.792] IUnknown:AddRef (This=0x509950) returned 0x3 [0229.792] IEnumWbemClassObject:Clone (in: This=0x509950, ppEnum=0x19f360 | out: ppEnum=0x19f360*=0x508ff0) returned 0x0 [0229.793] IUnknown:QueryInterface (in: This=0x508ff0, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f224 | out: ppvObject=0x19f224*=0x508ff4) returned 0x0 [0229.793] IClientSecurity:QueryBlanket (in: This=0x508ff4, pProxy=0x508ff0, pAuthnSvc=0x19f274, pAuthzSvc=0x19f270, pServerPrincName=0x19f268, pAuthnLevel=0x19f26c, pImpLevel=0x19f25c, pAuthInfo=0x19f260, pCapabilites=0x19f264 | out: pAuthnSvc=0x19f274*=0xa, pAuthzSvc=0x19f270*=0x0, pServerPrincName=0x19f268, pAuthnLevel=0x19f26c*=0x6, pImpLevel=0x19f25c*=0x2, pAuthInfo=0x19f260, pCapabilites=0x19f264*=0x1) returned 0x0 [0229.793] IUnknown:Release (This=0x508ff4) returned 0x1 [0229.793] IUnknown:QueryInterface (in: This=0x508ff0, riid=0x6c8110f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f218 | out: ppvObject=0x19f218*=0x502488) returned 0x0 [0229.793] IUnknown:QueryInterface (in: This=0x508ff0, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f214 | out: ppvObject=0x19f214*=0x508ff4) returned 0x0 [0229.793] IClientSecurity:SetBlanket (This=0x508ff4, pProxy=0x508ff0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0229.795] IUnknown:Release (This=0x508ff4) returned 0x2 [0229.795] WbemLocator:IUnknown:Release (This=0x502488) returned 0x1 [0229.795] CoTaskMemFree (pv=0x503d30) [0229.796] IUnknown:QueryInterface (in: This=0x508ff0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee00 | out: ppvObject=0x19ee00*=0x502488) returned 0x0 [0229.796] WbemLocator:IUnknown:QueryInterface (in: This=0x502488, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19edbc | out: ppvObject=0x19edbc*=0x0) returned 0x80004002 [0229.796] WbemLocator:IUnknown:QueryInterface (in: This=0x502488, riid=0x6c29fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ebdc | out: ppvObject=0x19ebdc*=0x0) returned 0x80004002 [0229.797] IUnknown:QueryInterface (in: This=0x508ff0, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e9b4 | out: ppvObject=0x19e9b4*=0x0) returned 0x80004002 [0229.798] WbemLocator:IUnknown:AddRef (This=0x502488) returned 0x3 [0229.798] WbemLocator:IUnknown:QueryInterface (in: This=0x502488, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e71c | out: ppvObject=0x19e71c*=0x0) returned 0x80004002 [0229.798] WbemLocator:IUnknown:QueryInterface (in: This=0x502488, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e6cc | out: ppvObject=0x19e6cc*=0x0) returned 0x80004002 [0229.798] WbemLocator:IUnknown:QueryInterface (in: This=0x502488, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e6d8 | out: ppvObject=0x19e6d8*=0x5023e4) returned 0x0 [0229.798] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5023e4, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e6e0 | out: pCid=0x19e6e0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0229.798] WbemLocator:IUnknown:Release (This=0x5023e4) returned 0x3 [0229.798] CoGetContextToken (in: pToken=0x19e738 | out: pToken=0x19e738) returned 0x0 [0229.798] CoGetContextToken (in: pToken=0x19eb40 | out: pToken=0x19eb40) returned 0x0 [0229.798] WbemLocator:IUnknown:QueryInterface (in: This=0x502488, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ebd0 | out: ppvObject=0x19ebd0*=0x50246c) returned 0x0 [0229.798] WbemLocator:IRpcOptions:Query (in: This=0x50246c, pPrx=0x502488, dwProperty=2, pdwValue=0x19ebf8 | out: pdwValue=0x19ebf8) returned 0x80004002 [0229.798] WbemLocator:IUnknown:Release (This=0x50246c) returned 0x3 [0229.799] WbemLocator:IUnknown:Release (This=0x502488) returned 0x2 [0229.799] CoGetContextToken (in: pToken=0x19f110 | out: pToken=0x19f110) returned 0x0 [0229.799] CoGetContextToken (in: pToken=0x19f070 | out: pToken=0x19f070) returned 0x0 [0229.799] WbemLocator:IUnknown:QueryInterface (in: This=0x502488, riid=0x19f140*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f13c | out: ppvObject=0x19f13c*=0x508ff0) returned 0x0 [0229.799] IUnknown:AddRef (This=0x508ff0) returned 0x4 [0229.799] IUnknown:Release (This=0x508ff0) returned 0x3 [0229.799] IUnknown:Release (This=0x508ff0) returned 0x2 [0229.799] IUnknown:Release (This=0x509950) returned 0x2 [0229.799] SysStringLen (param_1=0x0) returned 0x0 [0229.799] IEnumWbemClassObject:Reset (This=0x508ff0) returned 0x0 [0229.800] CoTaskMemAlloc (cb=0x4) returned 0x4e93c8 [0229.800] IEnumWbemClassObject:Next (in: This=0x508ff0, lTimeout=-1, uCount=0x1, apObjects=0x4e93c8, puReturned=0x2254bc4 | out: apObjects=0x4e93c8*=0x4e8388, puReturned=0x2254bc4*=0x1) returned 0x0 [0229.808] IUnknown:QueryInterface (in: This=0x4e8388, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e9c0 | out: ppvObject=0x19e9c0*=0x4e8388) returned 0x0 [0229.808] IUnknown:QueryInterface (in: This=0x4e8388, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e97c | out: ppvObject=0x19e97c*=0x0) returned 0x80004002 [0229.808] IUnknown:QueryInterface (in: This=0x4e8388, riid=0x6c29fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e79c | out: ppvObject=0x19e79c*=0x0) returned 0x80004002 [0229.808] IUnknown:QueryInterface (in: This=0x4e8388, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e574 | out: ppvObject=0x19e574*=0x0) returned 0x80004002 [0229.808] IUnknown:AddRef (This=0x4e8388) returned 0x3 [0229.808] IUnknown:QueryInterface (in: This=0x4e8388, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2dc | out: ppvObject=0x19e2dc*=0x0) returned 0x80004002 [0229.808] IUnknown:QueryInterface (in: This=0x4e8388, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e28c | out: ppvObject=0x19e28c*=0x0) returned 0x80004002 [0229.808] IUnknown:QueryInterface (in: This=0x4e8388, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e298 | out: ppvObject=0x19e298*=0x4e838c) returned 0x0 [0229.808] IMarshal:GetUnmarshalClass (in: This=0x4e838c, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e2a0 | out: pCid=0x19e2a0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0229.809] IUnknown:Release (This=0x4e838c) returned 0x3 [0229.809] CoGetContextToken (in: pToken=0x19e2f8 | out: pToken=0x19e2f8) returned 0x0 [0229.809] CoGetContextToken (in: pToken=0x19e700 | out: pToken=0x19e700) returned 0x0 [0229.809] IUnknown:QueryInterface (in: This=0x4e8388, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e790 | out: ppvObject=0x19e790*=0x0) returned 0x80004002 [0229.809] IUnknown:Release (This=0x4e8388) returned 0x2 [0229.809] CoGetContextToken (in: pToken=0x19ecd0 | out: pToken=0x19ecd0) returned 0x0 [0229.809] CoGetContextToken (in: pToken=0x19ec30 | out: pToken=0x19ec30) returned 0x0 [0229.809] IUnknown:QueryInterface (in: This=0x4e8388, riid=0x19ed00*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ecfc | out: ppvObject=0x19ecfc*=0x4e8388) returned 0x0 [0229.809] IUnknown:AddRef (This=0x4e8388) returned 0x4 [0229.809] IUnknown:Release (This=0x4e8388) returned 0x3 [0229.809] IUnknown:Release (This=0x4e8388) returned 0x2 [0229.809] CoTaskMemFree (pv=0x4e93c8) [0229.809] CoGetContextToken (in: pToken=0x19f040 | out: pToken=0x19f040) returned 0x0 [0229.809] IUnknown:AddRef (This=0x4e8388) returned 0x3 [0229.809] IWbemClassObject:Get (in: This=0x4e8388, wszName="__GENUS", lFlags=0, pVal=0x19f350*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f3d0*=0, plFlavor=0x19f3cc*=0 | out: pVal=0x19f350*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f3d0*=3, plFlavor=0x19f3cc*=64) returned 0x0 [0229.809] IWbemClassObject:Get (in: This=0x4e8388, wszName="__PATH", lFlags=0, pVal=0x19f334*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f3b8*=0, plFlavor=0x19f3b4*=0 | out: pVal=0x19f334*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"", varVal2=0x0), pType=0x19f3b8*=8, plFlavor=0x19f3b4*=64) returned 0x0 [0229.810] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0229.810] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0229.810] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x508 [0229.810] SetEvent (hEvent=0x3c8) returned 1 [0229.810] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f30c*=0x508, lpdwindex=0x19f12c | out: lpdwindex=0x19f12c) returned 0x0 [0229.815] CoGetContextToken (in: pToken=0x19f1d8 | out: pToken=0x19f1d8) returned 0x0 [0229.815] CoGetContextToken (in: pToken=0x19f138 | out: pToken=0x19f138) returned 0x0 [0229.815] WbemDefPath:IUnknown:QueryInterface (in: This=0x52bec8, riid=0x19f208*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x52bec8) returned 0x0 [0229.815] WbemDefPath:IUnknown:AddRef (This=0x52bec8) returned 0x3 [0229.815] WbemDefPath:IUnknown:Release (This=0x52bec8) returned 0x2 [0229.815] WbemDefPath:IWbemPath:SetText (This=0x52bec8, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x0 [0229.815] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0568, puCount=0x19f38c | out: puCount=0x19f38c*=0x2) returned 0x0 [0229.815] WbemDefPath:IWbemPath:GetText (in: This=0x4e0568, lFlags=4, puBuffLength=0x19f388*=0x0, pszText=0x0 | out: puBuffLength=0x19f388*=0xf, pszText=0x0) returned 0x0 [0229.815] WbemDefPath:IWbemPath:GetText (in: This=0x4e0568, lFlags=4, puBuffLength=0x19f388*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f388*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.815] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0568, puCount=0x19f380 | out: puCount=0x19f380*=0x2) returned 0x0 [0229.815] WbemDefPath:IWbemPath:GetText (in: This=0x4e0568, lFlags=4, puBuffLength=0x19f37c*=0x0, pszText=0x0 | out: puBuffLength=0x19f37c*=0xf, pszText=0x0) returned 0x0 [0229.815] WbemDefPath:IWbemPath:GetText (in: This=0x4e0568, lFlags=4, puBuffLength=0x19f37c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f37c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.815] IWbemClassObject:Get (in: This=0x4e8388, wszName="Name", lFlags=0, pVal=0x19f37c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2255420*=0, plFlavor=0x2255424*=0 | out: pVal=0x19f37c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1", varVal2=0x0), pType=0x2255420*=8, plFlavor=0x2255424*=0) returned 0x0 [0229.815] SysStringByteLen (bstr="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x80 [0229.815] SysStringByteLen (bstr="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x80 [0229.816] IWbemClassObject:Get (in: This=0x4e8388, wszName="Name", lFlags=0, pVal=0x19f384*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2255420*=8, plFlavor=0x2255424*=0 | out: pVal=0x19f384*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1", varVal2=0x0), pType=0x2255420*=8, plFlavor=0x2255424*=0) returned 0x0 [0229.816] SysStringByteLen (bstr="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x80 [0229.816] SysStringByteLen (bstr="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x80 [0229.853] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0568, puCount=0x19f398 | out: puCount=0x19f398*=0x2) returned 0x0 [0229.853] WbemDefPath:IWbemPath:GetText (in: This=0x4e0568, lFlags=4, puBuffLength=0x19f394*=0x0, pszText=0x0 | out: puBuffLength=0x19f394*=0xf, pszText=0x0) returned 0x0 [0229.853] WbemDefPath:IWbemPath:GetText (in: This=0x4e0568, lFlags=4, puBuffLength=0x19f394*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f394*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.862] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f244*=0x45c, lpdwindex=0x19f0f4 | out: lpdwindex=0x19f0f4) returned 0x0 [0229.888] CoGetContextToken (in: pToken=0x19f000 | out: pToken=0x19f000) returned 0x0 [0229.888] CoGetContextToken (in: pToken=0x19efa8 | out: pToken=0x19efa8) returned 0x0 [0229.888] IUnknown:QueryInterface (in: This=0x4c0110, riid=0x6c218724*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ef88 | out: ppvObject=0x19ef88*=0x4c0120) returned 0x0 [0229.888] CObjectContext::ContextCallback () returned 0x0 [0229.890] IUnknown:Release (This=0x4c0120) returned 0x1 [0229.890] CoUnmarshalInterface (in: pStm=0x553b48, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eff0 | out: ppv=0x19eff0*=0x502788) returned 0x0 [0229.890] CoMarshalInterface (pStm=0x553b48, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x502788, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0229.890] WbemLocator:IUnknown:QueryInterface (in: This=0x502788, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee94 | out: ppvObject=0x19ee94*=0x502788) returned 0x0 [0229.890] WbemLocator:IUnknown:QueryInterface (in: This=0x502788, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ee50 | out: ppvObject=0x19ee50*=0x0) returned 0x80004002 [0229.891] WbemLocator:IUnknown:QueryInterface (in: This=0x502788, riid=0x6c29fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ec6c | out: ppvObject=0x19ec6c*=0x0) returned 0x80004002 [0229.891] WbemLocator:IUnknown:QueryInterface (in: This=0x502788, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19ea44 | out: ppvObject=0x19ea44*=0x0) returned 0x80004002 [0229.892] WbemLocator:IUnknown:AddRef (This=0x502788) returned 0x3 [0229.892] WbemLocator:IUnknown:QueryInterface (in: This=0x502788, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e7ac | out: ppvObject=0x19e7ac*=0x0) returned 0x80004002 [0229.892] WbemLocator:IUnknown:QueryInterface (in: This=0x502788, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e75c | out: ppvObject=0x19e75c*=0x0) returned 0x80004002 [0229.892] WbemLocator:IUnknown:QueryInterface (in: This=0x502788, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e768 | out: ppvObject=0x19e768*=0x5026e4) returned 0x0 [0229.892] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5026e4, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e770 | out: pCid=0x19e770*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0229.892] WbemLocator:IUnknown:Release (This=0x5026e4) returned 0x3 [0229.892] CoGetContextToken (in: pToken=0x19e7c8 | out: pToken=0x19e7c8) returned 0x0 [0229.892] CoGetContextToken (in: pToken=0x19ebd0 | out: pToken=0x19ebd0) returned 0x0 [0229.892] WbemLocator:IUnknown:QueryInterface (in: This=0x502788, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec60 | out: ppvObject=0x19ec60*=0x50276c) returned 0x0 [0229.892] WbemLocator:IRpcOptions:Query (in: This=0x50276c, pPrx=0x502788, dwProperty=2, pdwValue=0x19ec88 | out: pdwValue=0x19ec88) returned 0x0 [0229.893] WbemLocator:IUnknown:Release (This=0x50276c) returned 0x3 [0229.893] WbemLocator:IUnknown:Release (This=0x502788) returned 0x2 [0229.893] WbemLocator:IUnknown:Release (This=0x502788) returned 0x1 [0229.893] CoGetContextToken (in: pToken=0x19ef40 | out: pToken=0x19ef40) returned 0x0 [0229.893] WbemLocator:IUnknown:AddRef (This=0x502788) returned 0x2 [0229.893] WbemLocator:IUnknown:QueryInterface (in: This=0x502788, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1fc | out: ppvObject=0x19f1fc*=0x502764) returned 0x0 [0229.893] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x502764, pProxy=0x502788, pAuthnSvc=0x19f24c, pAuthzSvc=0x19f248, pServerPrincName=0x19f240, pAuthnLevel=0x19f244, pImpLevel=0x19f234, pAuthInfo=0x19f238, pCapabilites=0x19f23c | out: pAuthnSvc=0x19f24c*=0xa, pAuthzSvc=0x19f248*=0x0, pServerPrincName=0x19f240, pAuthnLevel=0x19f244*=0x6, pImpLevel=0x19f234*=0x2, pAuthInfo=0x19f238, pCapabilites=0x19f23c*=0x1) returned 0x0 [0229.893] WbemLocator:IUnknown:Release (This=0x502764) returned 0x2 [0229.893] WbemLocator:IUnknown:QueryInterface (in: This=0x502788, riid=0x6c8110f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1f0 | out: ppvObject=0x19f1f0*=0x502788) returned 0x0 [0229.893] WbemLocator:IUnknown:QueryInterface (in: This=0x502788, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1ec | out: ppvObject=0x19f1ec*=0x502764) returned 0x0 [0229.893] WbemLocator:IClientSecurity:SetBlanket (This=0x502764, pProxy=0x502788, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0229.893] WbemLocator:IUnknown:Release (This=0x502764) returned 0x3 [0229.893] WbemLocator:IUnknown:Release (This=0x502788) returned 0x2 [0229.893] CoTaskMemFree (pv=0x503df0) [0229.894] WbemLocator:IUnknown:Release (This=0x502788) returned 0x1 [0229.894] SysStringLen (param_1=0x0) returned 0x0 [0229.894] CoGetContextToken (in: pToken=0x19f1b8 | out: pToken=0x19f1b8) returned 0x0 [0229.894] CoGetContextToken (in: pToken=0x19f118 | out: pToken=0x19f118) returned 0x0 [0229.894] WbemLocator:IUnknown:QueryInterface (in: This=0x502788, riid=0x19f1e8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19f1e4 | out: ppvObject=0x19f1e4*=0x548d60) returned 0x0 [0229.895] WbemLocator:IUnknown:AddRef (This=0x548d60) returned 0x3 [0229.895] WbemLocator:IUnknown:Release (This=0x548d60) returned 0x2 [0229.895] CoGetContextToken (in: pToken=0x19f178 | out: pToken=0x19f178) returned 0x0 [0229.895] WbemLocator:IUnknown:AddRef (This=0x548d60) returned 0x3 [0229.895] WbemLocator:IUnknown:QueryInterface (in: This=0x548d60, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1fc | out: ppvObject=0x19f1fc*=0x502764) returned 0x0 [0229.895] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x502764, pProxy=0x548d60, pAuthnSvc=0x19f24c, pAuthzSvc=0x19f248, pServerPrincName=0x19f240, pAuthnLevel=0x19f244, pImpLevel=0x19f234, pAuthInfo=0x19f238, pCapabilites=0x19f23c | out: pAuthnSvc=0x19f24c*=0xa, pAuthzSvc=0x19f248*=0x0, pServerPrincName=0x19f240, pAuthnLevel=0x19f244*=0x6, pImpLevel=0x19f234*=0x2, pAuthInfo=0x19f238, pCapabilites=0x19f23c*=0x1) returned 0x0 [0229.895] WbemLocator:IUnknown:Release (This=0x502764) returned 0x3 [0229.895] WbemLocator:IUnknown:QueryInterface (in: This=0x548d60, riid=0x6c8110f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1f0 | out: ppvObject=0x19f1f0*=0x502788) returned 0x0 [0229.895] WbemLocator:IUnknown:QueryInterface (in: This=0x548d60, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1ec | out: ppvObject=0x19f1ec*=0x502764) returned 0x0 [0229.895] WbemLocator:IClientSecurity:SetBlanket (This=0x502764, pProxy=0x548d60, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0229.895] WbemLocator:IUnknown:Release (This=0x502764) returned 0x4 [0229.895] WbemLocator:IUnknown:Release (This=0x502788) returned 0x3 [0229.896] CoTaskMemFree (pv=0x503d60) [0229.896] WbemLocator:IUnknown:Release (This=0x548d60) returned 0x2 [0229.896] SysStringLen (param_1=0x0) returned 0x0 [0229.896] CoGetContextToken (in: pToken=0x19f0f8 | out: pToken=0x19f0f8) returned 0x0 [0229.896] WbemLocator:IUnknown:AddRef (This=0x548d60) returned 0x3 [0229.896] IWbemServices:ExecQuery (in: This=0x548d60, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_Processor", lFlags=16, pCtx=0x0, ppEnum=0x19f308 | out: ppEnum=0x19f308*=0x5090b8) returned 0x0 [0229.960] IUnknown:QueryInterface (in: This=0x5090b8, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f16c | out: ppvObject=0x19f16c*=0x5090bc) returned 0x0 [0229.960] IClientSecurity:QueryBlanket (in: This=0x5090bc, pProxy=0x5090b8, pAuthnSvc=0x19f1bc, pAuthzSvc=0x19f1b8, pServerPrincName=0x19f1b0, pAuthnLevel=0x19f1b4, pImpLevel=0x19f1a4, pAuthInfo=0x19f1a8, pCapabilites=0x19f1ac | out: pAuthnSvc=0x19f1bc*=0xa, pAuthzSvc=0x19f1b8*=0x0, pServerPrincName=0x19f1b0, pAuthnLevel=0x19f1b4*=0x6, pImpLevel=0x19f1a4*=0x2, pAuthInfo=0x19f1a8, pCapabilites=0x19f1ac*=0x1) returned 0x0 [0229.961] IUnknown:Release (This=0x5090bc) returned 0x1 [0229.961] IUnknown:QueryInterface (in: This=0x5090b8, riid=0x6c8110f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f160 | out: ppvObject=0x19f160*=0x501688) returned 0x0 [0229.961] IUnknown:QueryInterface (in: This=0x5090b8, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f15c | out: ppvObject=0x19f15c*=0x5090bc) returned 0x0 [0229.961] IClientSecurity:SetBlanket (This=0x5090bc, pProxy=0x5090b8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0229.963] IUnknown:Release (This=0x5090bc) returned 0x2 [0229.963] WbemLocator:IUnknown:Release (This=0x501688) returned 0x1 [0229.963] CoTaskMemFree (pv=0x503d90) [0229.963] IUnknown:QueryInterface (in: This=0x5090b8, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed58 | out: ppvObject=0x19ed58*=0x501688) returned 0x0 [0229.963] WbemLocator:IUnknown:QueryInterface (in: This=0x501688, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ed14 | out: ppvObject=0x19ed14*=0x0) returned 0x80004002 [0229.963] WbemLocator:IUnknown:QueryInterface (in: This=0x501688, riid=0x6c29fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19eb34 | out: ppvObject=0x19eb34*=0x0) returned 0x80004002 [0229.964] IUnknown:QueryInterface (in: This=0x5090b8, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e90c | out: ppvObject=0x19e90c*=0x0) returned 0x80004002 [0229.964] WbemLocator:IUnknown:AddRef (This=0x501688) returned 0x3 [0229.964] WbemLocator:IUnknown:QueryInterface (in: This=0x501688, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e674 | out: ppvObject=0x19e674*=0x0) returned 0x80004002 [0229.964] WbemLocator:IUnknown:QueryInterface (in: This=0x501688, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e624 | out: ppvObject=0x19e624*=0x0) returned 0x80004002 [0229.964] WbemLocator:IUnknown:QueryInterface (in: This=0x501688, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e630 | out: ppvObject=0x19e630*=0x5015e4) returned 0x0 [0229.965] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5015e4, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e638 | out: pCid=0x19e638*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0229.965] WbemLocator:IUnknown:Release (This=0x5015e4) returned 0x3 [0229.965] CoGetContextToken (in: pToken=0x19e690 | out: pToken=0x19e690) returned 0x0 [0229.965] CoGetContextToken (in: pToken=0x19ea98 | out: pToken=0x19ea98) returned 0x0 [0229.965] WbemLocator:IUnknown:QueryInterface (in: This=0x501688, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eb28 | out: ppvObject=0x19eb28*=0x50166c) returned 0x0 [0229.965] WbemLocator:IRpcOptions:Query (in: This=0x50166c, pPrx=0x501688, dwProperty=2, pdwValue=0x19eb50 | out: pdwValue=0x19eb50) returned 0x80004002 [0229.965] WbemLocator:IUnknown:Release (This=0x50166c) returned 0x3 [0229.965] WbemLocator:IUnknown:Release (This=0x501688) returned 0x2 [0229.965] CoGetContextToken (in: pToken=0x19f068 | out: pToken=0x19f068) returned 0x0 [0229.965] CoGetContextToken (in: pToken=0x19efc8 | out: pToken=0x19efc8) returned 0x0 [0229.965] WbemLocator:IUnknown:QueryInterface (in: This=0x501688, riid=0x19f098*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f094 | out: ppvObject=0x19f094*=0x5090b8) returned 0x0 [0229.965] IUnknown:AddRef (This=0x5090b8) returned 0x4 [0229.965] IUnknown:Release (This=0x5090b8) returned 0x3 [0229.965] IUnknown:Release (This=0x5090b8) returned 0x2 [0229.965] WbemLocator:IUnknown:Release (This=0x548d60) returned 0x2 [0229.965] SysStringLen (param_1=0x0) returned 0x0 [0229.965] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0568, puCount=0x19f354 | out: puCount=0x19f354*=0x2) returned 0x0 [0229.965] WbemDefPath:IWbemPath:GetText (in: This=0x4e0568, lFlags=4, puBuffLength=0x19f350*=0x0, pszText=0x0 | out: puBuffLength=0x19f350*=0xf, pszText=0x0) returned 0x0 [0229.965] WbemDefPath:IWbemPath:GetText (in: This=0x4e0568, lFlags=4, puBuffLength=0x19f350*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f350*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.966] CoGetContextToken (in: pToken=0x19f1a0 | out: pToken=0x19f1a0) returned 0x0 [0229.966] IUnknown:AddRef (This=0x5090b8) returned 0x3 [0229.966] IEnumWbemClassObject:Clone (in: This=0x5090b8, ppEnum=0x19f360 | out: ppEnum=0x19f360*=0x509568) returned 0x0 [0229.967] IUnknown:QueryInterface (in: This=0x509568, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f224 | out: ppvObject=0x19f224*=0x50956c) returned 0x0 [0229.967] IClientSecurity:QueryBlanket (in: This=0x50956c, pProxy=0x509568, pAuthnSvc=0x19f274, pAuthzSvc=0x19f270, pServerPrincName=0x19f268, pAuthnLevel=0x19f26c, pImpLevel=0x19f25c, pAuthInfo=0x19f260, pCapabilites=0x19f264 | out: pAuthnSvc=0x19f274*=0xa, pAuthzSvc=0x19f270*=0x0, pServerPrincName=0x19f268, pAuthnLevel=0x19f26c*=0x6, pImpLevel=0x19f25c*=0x2, pAuthInfo=0x19f260, pCapabilites=0x19f264*=0x1) returned 0x0 [0229.967] IUnknown:Release (This=0x50956c) returned 0x1 [0229.967] IUnknown:QueryInterface (in: This=0x509568, riid=0x6c8110f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f218 | out: ppvObject=0x19f218*=0x501388) returned 0x0 [0229.967] IUnknown:QueryInterface (in: This=0x509568, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f214 | out: ppvObject=0x19f214*=0x50956c) returned 0x0 [0229.967] IClientSecurity:SetBlanket (This=0x50956c, pProxy=0x509568, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0229.969] IUnknown:Release (This=0x50956c) returned 0x2 [0229.969] WbemLocator:IUnknown:Release (This=0x501388) returned 0x1 [0229.969] CoTaskMemFree (pv=0x503d30) [0229.969] IUnknown:QueryInterface (in: This=0x509568, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee00 | out: ppvObject=0x19ee00*=0x501388) returned 0x0 [0229.969] WbemLocator:IUnknown:QueryInterface (in: This=0x501388, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19edbc | out: ppvObject=0x19edbc*=0x0) returned 0x80004002 [0229.969] WbemLocator:IUnknown:QueryInterface (in: This=0x501388, riid=0x6c29fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ebdc | out: ppvObject=0x19ebdc*=0x0) returned 0x80004002 [0229.970] IUnknown:QueryInterface (in: This=0x509568, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e9b4 | out: ppvObject=0x19e9b4*=0x0) returned 0x80004002 [0229.970] WbemLocator:IUnknown:AddRef (This=0x501388) returned 0x3 [0229.970] WbemLocator:IUnknown:QueryInterface (in: This=0x501388, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e71c | out: ppvObject=0x19e71c*=0x0) returned 0x80004002 [0229.970] WbemLocator:IUnknown:QueryInterface (in: This=0x501388, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e6cc | out: ppvObject=0x19e6cc*=0x0) returned 0x80004002 [0229.970] WbemLocator:IUnknown:QueryInterface (in: This=0x501388, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e6d8 | out: ppvObject=0x19e6d8*=0x5012e4) returned 0x0 [0229.971] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5012e4, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e6e0 | out: pCid=0x19e6e0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0229.971] WbemLocator:IUnknown:Release (This=0x5012e4) returned 0x3 [0229.971] CoGetContextToken (in: pToken=0x19e738 | out: pToken=0x19e738) returned 0x0 [0229.971] CoGetContextToken (in: pToken=0x19eb40 | out: pToken=0x19eb40) returned 0x0 [0229.971] WbemLocator:IUnknown:QueryInterface (in: This=0x501388, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ebd0 | out: ppvObject=0x19ebd0*=0x50136c) returned 0x0 [0229.971] WbemLocator:IRpcOptions:Query (in: This=0x50136c, pPrx=0x501388, dwProperty=2, pdwValue=0x19ebf8 | out: pdwValue=0x19ebf8) returned 0x80004002 [0229.971] WbemLocator:IUnknown:Release (This=0x50136c) returned 0x3 [0229.971] WbemLocator:IUnknown:Release (This=0x501388) returned 0x2 [0229.971] CoGetContextToken (in: pToken=0x19f110 | out: pToken=0x19f110) returned 0x0 [0229.971] CoGetContextToken (in: pToken=0x19f070 | out: pToken=0x19f070) returned 0x0 [0229.971] WbemLocator:IUnknown:QueryInterface (in: This=0x501388, riid=0x19f140*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f13c | out: ppvObject=0x19f13c*=0x509568) returned 0x0 [0229.971] IUnknown:AddRef (This=0x509568) returned 0x4 [0229.971] IUnknown:Release (This=0x509568) returned 0x3 [0229.971] IUnknown:Release (This=0x509568) returned 0x2 [0229.971] IUnknown:Release (This=0x5090b8) returned 0x2 [0229.971] SysStringLen (param_1=0x0) returned 0x0 [0229.971] IEnumWbemClassObject:Reset (This=0x509568) returned 0x0 [0230.011] CoTaskMemAlloc (cb=0x4) returned 0x517a80 [0230.011] IEnumWbemClassObject:Next (in: This=0x509568, lTimeout=-1, uCount=0x1, apObjects=0x517a80, puReturned=0x2256138 | out: apObjects=0x517a80*=0x4e89e8, puReturned=0x2256138*=0x1) returned 0x0 [0231.095] IUnknown:QueryInterface (in: This=0x4e89e8, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e9c0 | out: ppvObject=0x19e9c0*=0x4e89e8) returned 0x0 [0231.095] IUnknown:QueryInterface (in: This=0x4e89e8, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e97c | out: ppvObject=0x19e97c*=0x0) returned 0x80004002 [0231.095] IUnknown:QueryInterface (in: This=0x4e89e8, riid=0x6c29fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e79c | out: ppvObject=0x19e79c*=0x0) returned 0x80004002 [0231.095] IUnknown:QueryInterface (in: This=0x4e89e8, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e574 | out: ppvObject=0x19e574*=0x0) returned 0x80004002 [0231.095] IUnknown:AddRef (This=0x4e89e8) returned 0x3 [0231.095] IUnknown:QueryInterface (in: This=0x4e89e8, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2dc | out: ppvObject=0x19e2dc*=0x0) returned 0x80004002 [0231.095] IUnknown:QueryInterface (in: This=0x4e89e8, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e28c | out: ppvObject=0x19e28c*=0x0) returned 0x80004002 [0231.095] IUnknown:QueryInterface (in: This=0x4e89e8, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e298 | out: ppvObject=0x19e298*=0x4e89ec) returned 0x0 [0231.096] IMarshal:GetUnmarshalClass (in: This=0x4e89ec, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e2a0 | out: pCid=0x19e2a0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0231.096] IUnknown:Release (This=0x4e89ec) returned 0x3 [0231.096] CoGetContextToken (in: pToken=0x19e2f8 | out: pToken=0x19e2f8) returned 0x0 [0231.096] CoGetContextToken (in: pToken=0x19e700 | out: pToken=0x19e700) returned 0x0 [0231.096] IUnknown:QueryInterface (in: This=0x4e89e8, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e790 | out: ppvObject=0x19e790*=0x0) returned 0x80004002 [0231.096] IUnknown:Release (This=0x4e89e8) returned 0x2 [0231.096] CoGetContextToken (in: pToken=0x19ecd0 | out: pToken=0x19ecd0) returned 0x0 [0231.096] CoGetContextToken (in: pToken=0x19ec30 | out: pToken=0x19ec30) returned 0x0 [0231.096] IUnknown:QueryInterface (in: This=0x4e89e8, riid=0x19ed00*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ecfc | out: ppvObject=0x19ecfc*=0x4e89e8) returned 0x0 [0231.096] IUnknown:AddRef (This=0x4e89e8) returned 0x4 [0231.096] IUnknown:Release (This=0x4e89e8) returned 0x3 [0231.096] IUnknown:Release (This=0x4e89e8) returned 0x2 [0231.096] CoTaskMemFree (pv=0x517a80) [0231.096] CoGetContextToken (in: pToken=0x19f040 | out: pToken=0x19f040) returned 0x0 [0231.096] IUnknown:AddRef (This=0x4e89e8) returned 0x3 [0231.096] IWbemClassObject:Get (in: This=0x4e89e8, wszName="__GENUS", lFlags=0, pVal=0x19f350*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f3d0*=0, plFlavor=0x19f3cc*=0 | out: pVal=0x19f350*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f3d0*=3, plFlavor=0x19f3cc*=64) returned 0x0 [0231.097] IWbemClassObject:Get (in: This=0x4e89e8, wszName="__PATH", lFlags=0, pVal=0x19f334*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f3b8*=0, plFlavor=0x19f3b4*=0 | out: pVal=0x19f334*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"", varVal2=0x0), pType=0x19f3b8*=8, plFlavor=0x19f3b4*=64) returned 0x0 [0231.097] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x66 [0231.097] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x66 [0231.097] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x458 [0231.097] SetEvent (hEvent=0x3c8) returned 1 [0231.097] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f30c*=0x458, lpdwindex=0x19f12c | out: lpdwindex=0x19f12c) returned 0x0 [0231.100] CoGetContextToken (in: pToken=0x19f1d8 | out: pToken=0x19f1d8) returned 0x0 [0231.100] CoGetContextToken (in: pToken=0x19f138 | out: pToken=0x19f138) returned 0x0 [0231.100] WbemDefPath:IUnknown:QueryInterface (in: This=0x52c408, riid=0x19f208*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x52c408) returned 0x0 [0231.101] WbemDefPath:IUnknown:AddRef (This=0x52c408) returned 0x3 [0231.101] WbemDefPath:IUnknown:Release (This=0x52c408) returned 0x2 [0231.101] WbemDefPath:IWbemPath:SetText (This=0x52c408, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x0 [0231.101] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0568, puCount=0x19f38c | out: puCount=0x19f38c*=0x2) returned 0x0 [0231.101] WbemDefPath:IWbemPath:GetText (in: This=0x4e0568, lFlags=4, puBuffLength=0x19f388*=0x0, pszText=0x0 | out: puBuffLength=0x19f388*=0xf, pszText=0x0) returned 0x0 [0231.101] WbemDefPath:IWbemPath:GetText (in: This=0x4e0568, lFlags=4, puBuffLength=0x19f388*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f388*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0231.104] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0568, puCount=0x19f35c | out: puCount=0x19f35c*=0x2) returned 0x0 [0231.104] WbemDefPath:IWbemPath:GetText (in: This=0x4e0568, lFlags=4, puBuffLength=0x19f358*=0x0, pszText=0x0 | out: puBuffLength=0x19f358*=0xf, pszText=0x0) returned 0x0 [0231.104] WbemDefPath:IWbemPath:GetText (in: This=0x4e0568, lFlags=4, puBuffLength=0x19f358*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f358*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0231.104] IWbemClassObject:Get (in: This=0x4e89e8, wszName="Name", lFlags=0, pVal=0x19f358*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22569a0*=0, plFlavor=0x22569a4*=0 | out: pVal=0x19f358*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", varVal2=0x0), pType=0x22569a0*=8, plFlavor=0x22569a4*=0) returned 0x0 [0231.104] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0231.104] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0231.104] IWbemClassObject:Get (in: This=0x4e89e8, wszName="Name", lFlags=0, pVal=0x19f360*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22569a0*=8, plFlavor=0x22569a4*=0 | out: pVal=0x19f360*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", varVal2=0x0), pType=0x22569a0*=8, plFlavor=0x22569a4*=0) returned 0x0 [0231.104] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0231.104] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0231.104] CoTaskMemAlloc (cb=0x4) returned 0x517a80 [0231.104] IEnumWbemClassObject:Next (in: This=0x509568, lTimeout=-1, uCount=0x1, apObjects=0x517a80, puReturned=0x2256138 | out: apObjects=0x517a80*=0x0, puReturned=0x2256138*=0x0) returned 0x1 [0231.106] CoTaskMemFree (pv=0x517a80) [0231.106] CoGetContextToken (in: pToken=0x19f288 | out: pToken=0x19f288) returned 0x0 [0231.106] WbemLocator:IUnknown:Release (This=0x501388) returned 0x1 [0231.106] IUnknown:Release (This=0x509568) returned 0x0 [0231.113] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0568, puCount=0x19f398 | out: puCount=0x19f398*=0x2) returned 0x0 [0231.113] WbemDefPath:IWbemPath:GetText (in: This=0x4e0568, lFlags=4, puBuffLength=0x19f394*=0x0, pszText=0x0 | out: puBuffLength=0x19f394*=0xf, pszText=0x0) returned 0x0 [0231.113] WbemDefPath:IWbemPath:GetText (in: This=0x4e0568, lFlags=4, puBuffLength=0x19f394*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f394*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0231.143] GlobalMemoryStatusEx (in: lpBuffer=0x2256bdc | out: lpBuffer=0x2256bdc) returned 1 [0231.301] GetCurrentProcess () returned 0xffffffff [0231.301] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ef64 | out: TokenHandle=0x19ef64*=0x454) returned 1 [0231.307] GetCurrentProcess () returned 0xffffffff [0231.307] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ef78 | out: TokenHandle=0x19ef78*=0x464) returned 1 [0231.523] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x19f2dc | out: pFixedInfo=0x0, pOutBufLen=0x19f2dc) returned 0x6f [0232.489] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x5656b0 [0232.489] GetNetworkParams (in: pFixedInfo=0x5656b0, pOutBufLen=0x19f2dc | out: pFixedInfo=0x5656b0, pOutBufLen=0x19f2dc) returned 0x0 [0232.502] LocalFree (hMem=0x5656b0) returned 0x0 [0232.512] IdnToAscii (in: dwFlags=0x0, lpUnicodeCharStr="xc64ZB", cchUnicodeChar=6, lpASCIICharStr=0x0, cchASCIIChar=0 | out: lpASCIICharStr=0x0) returned 6 [0232.512] IdnToAscii (in: dwFlags=0x0, lpUnicodeCharStr="xc64ZB", cchUnicodeChar=6, lpASCIICharStr=0x2258bcc, cchASCIIChar=6 | out: lpASCIICharStr="xc64ZB") returned 6 [0232.530] SystemFunction041 (in: Memory=0x4e81ac, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x4e81ac) returned 0x0 [0232.532] SysStringLen (param_1="bigboy247ctSet") returned 0x10 [0232.532] SystemFunction040 (in: Memory=0x4e7b8c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x4e7b8c) returned 0x0 [0232.555] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x19f2bc | out: UnbiasedTime=0x19f2bc) returned 1 [0232.555] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x19f2ac | out: UnbiasedTime=0x19f2ac) returned 1 [0232.559] GetCurrentProcess () returned 0xffffffff [0232.559] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eeb0 | out: TokenHandle=0x19eeb0*=0x468) returned 1 [0232.560] GetCurrentProcess () returned 0xffffffff [0232.560] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eec4 | out: TokenHandle=0x19eec4*=0x484) returned 1 [0232.562] SetEvent (hEvent=0x248) returned 1 [0232.582] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19f014 | out: lpWSAData=0x19f014) returned 0 [0232.592] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x534 [0233.416] setsockopt (s=0x534, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0233.416] closesocket (s=0x534) returned 0 [0233.417] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x534 [0233.419] setsockopt (s=0x534, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0233.419] closesocket (s=0x534) returned 0 [0233.423] GetCurrentProcess () returned 0xffffffff [0233.423] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19edc8 | out: TokenHandle=0x19edc8*=0x534) returned 1 [0233.432] GetCurrentProcess () returned 0xffffffff [0233.433] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eddc | out: TokenHandle=0x19eddc*=0x538) returned 1 [0233.467] CreateSemaphoreA (lpSemaphoreAttributes=0x0, lInitialCount=0, lMaximumCount=1048576, lpName=0x0) returned 0x53c [0233.468] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x540 [0233.469] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x544 [0233.470] SetEvent (hEvent=0x248) returned 1 [0233.470] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x186a0, cHandles=0x3, pHandles=0x19f140*=0x53c, lpdwindex=0x19effc | out: lpdwindex=0x19effc) returned 0x0 [0233.471] ReleaseMutex (hMutex=0x544) returned 1 [0233.472] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x548 [0233.473] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x54c [0233.475] GetAddrInfoW (in: pNodeName="mail.hardroot.biz", pServiceName=0x0, pHints=0x19f108*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x19f0b0 | out: ppResult=0x19f0b0*=0x552d50*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="mail.hardroot.biz", ai_addr=0x4f01a8*(sa_family=2, sin_port=0x0, sin_addr="192.185.57.117"), ai_next=0x0)) returned 0 [0233.874] FreeAddrInfoW (pAddrInfo=0x552d50*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="mail.hardroot.biz", ai_addr=0x4f01a8*(sa_family=2, sin_port=0x0, sin_addr="192.185.57.117"), ai_next=0x0)) [0233.881] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x550 [0233.882] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x55c [0233.882] ioctlsocket (in: s=0x550, cmd=-2147195266, argp=0x19f0e0 | out: argp=0x19f0e0) returned 0 [0233.882] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x560 [0233.883] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x564 [0233.883] ioctlsocket (in: s=0x560, cmd=-2147195266, argp=0x19f0e0 | out: argp=0x19f0e0) returned 0 [0233.883] WSAIoctl (in: s=0x550, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19f0c8, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19f0c8, lpOverlapped=0x0) returned -1 [0233.885] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19edf8, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0233.886] WSAEventSelect (s=0x550, hEventObject=0x55c, lNetworkEvents=512) returned 0 [0233.886] WSAIoctl (in: s=0x560, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19f0c8, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19f0c8, lpOverlapped=0x0) returned -1 [0233.886] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19edf8, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0233.886] WSAEventSelect (s=0x560, hEventObject=0x564, lNetworkEvents=512) returned 0 [0233.886] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x19f0c4*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x19f0c4*=0xa80) returned 0x6f [0233.892] LocalAlloc (uFlags=0x0, uBytes=0xa80) returned 0x54c568 [0233.892] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x54c568, SizePointer=0x19f0c4*=0xa80 | out: AdapterAddresses=0x54c568*(Alignment=0x700000178, Length=0x178, IfIndex=0x7, Next=0x54c818, AdapterName="{E96D977E-F067-4CE9-924D-F6E0A04729E4}", FirstUnicastAddress=0x54c78c, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #2", FriendlyName="Ethernet 2", PhysicalAddress=([0]=0xc8, [1]=0xd5, [2]=0xfe, [3]=0xbf, [4]=0x58, [5]=0xb6, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x1c5, DdnsEnabled=0x1c5, RegisterAdapterSuffix=0x1c5, Dhcpv4Enabled=0x1c5, ReceiveOnly=0x1c5, NoMulticast=0x1c5, Ipv6OtherStatefulConfig=0x1c5, NetbiosOverTcpipEnabled=0x1c5, Ipv4Enabled=0x1c5, Ipv6Enabled=0x1c5, Ipv6ManagedAddressConfigurationSupported=0x1c5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x7, ZoneIndices=([0]=0x7, [1]=0x7, [2]=0x7, [3]=0x7, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6008002000000, Dhcpv4Server.lpSockaddr=0x54c6e0*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11eb6c9dc20d55b0, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x28, [5]=0xb6, [6]=0x28, [7]=0x5e, [8]=0x0, [9]=0xf, [10]=0xf3, [11]=0xe1, [12]=0x61, [13]=0x38, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x6000ff3, FirstDnsSuffix=0x0), SizePointer=0x19f0c4*=0xa80) returned 0x0 [0233.902] LocalFree (hMem=0x54c568) returned 0x0 [0233.905] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f0d4 | out: phkResult=0x19f0d4*=0x568) returned 0x0 [0233.905] RegQueryValueExW (in: hKey=0x568, lpValueName="HWRPortReuseOnSocketBind", lpReserved=0x0, lpType=0x19f0f0, lpData=0x0, lpcbData=0x19f0ec*=0x0 | out: lpType=0x19f0f0*=0x0, lpData=0x0, lpcbData=0x19f0ec*=0x0) returned 0x2 [0233.905] RegCloseKey (hKey=0x568) returned 0x0 [0233.906] WSAConnect (in: s=0x548, name=0x2260df0*(sa_family=2, sin_port=0x24b, sin_addr="192.185.57.117"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0234.044] closesocket (s=0x54c) returned 0 [0234.045] setsockopt (s=0x548, level=6, optname=1, optval="\x01", optlen=4) returned 0 [0234.048] recv (in: s=0x548, buf=0x2260ee4, len=256, flags=0 | out: buf=0x2260ee4*) returned 184 [0234.185] send (s=0x548, buf=0x225a710*, len=13, flags=0) returned 13 [0234.186] recv (in: s=0x548, buf=0x2260ee4, len=256, flags=0 | out: buf=0x2260ee4*) returned 208 [0234.329] send (s=0x548, buf=0x225a710*, len=10, flags=0) returned 10 [0234.329] recv (in: s=0x548, buf=0x2260ee4, len=256, flags=0 | out: buf=0x2260ee4*) returned 18 [0234.600] EnumerateSecurityPackagesW (in: pcPackages=0x19f150, ppPackageInfo=0x19f0e4 | out: pcPackages=0x19f150, ppPackageInfo=0x19f0e4) returned 0x0 [0234.718] FreeContextBuffer (in: pvContextBuffer=0x54c568 | out: pvContextBuffer=0x54c568) returned 0x0 [0234.729] GetCurrentProcess () returned 0xffffffff [0234.729] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ef30 | out: TokenHandle=0x19ef30*=0x568) returned 1 [0234.730] AcquireCredentialsHandleW (in: pPrincipal=0x0, pPackage=0x2262404, fCredentialUse=0x2, pvLogonId=0x0, pAuthData=0x19ef84, pGetKeyFn=0x0, pvGetKeyArgument=0x0, phCredential=0x22638fc, ptsExpiry=0x19ef08 | out: phCredential=0x22638fc, ptsExpiry=0x19ef08) returned 0x0 [0235.241] InitializeSecurityContextW (in: phCredential=0x19ef48, phContext=0x0, pTargetName=0x2258d0c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x0, Reserved2=0x0, phNewContext=0x2263b00, pOutput=0x2263a98, pfContextAttr=0x22623d8, ptsExpiry=0x19ef40 | out: phNewContext=0x2263b00, pOutput=0x2263a98, pfContextAttr=0x22623d8, ptsExpiry=0x19ef40) returned 0x90312 [0235.244] FreeContextBuffer (in: pvContextBuffer=0x551d00 | out: pvContextBuffer=0x551d00) returned 0x0 [0235.256] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74580000 [0235.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="GetCurrentPackageId", cchWideChar=19, lpMultiByteStr=0x19ef90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentPackageIdÝ`ÏwjX©,Ý «\x15lhö\x19", lpUsedDefaultChar=0x0) returned 19 [0235.257] GetProcAddress (hModule=0x74580000, lpProcName="GetCurrentPackageId") returned 0x774dded0 [0235.257] GetCurrentPackageId () returned 0x3d54 [0235.259] send (s=0x548, buf=0x2263b14*, len=185, flags=0) returned 185 [0235.260] recv (in: s=0x548, buf=0x2263b14, len=5, flags=0 | out: buf=0x2263b14*) returned 5 [0235.405] recv (in: s=0x548, buf=0x2263b19, len=93, flags=0 | out: buf=0x2263b19*) returned 93 [0235.406] InitializeSecurityContextW (in: phCredential=0x19eeac, phContext=0x19ef38, pTargetName=0x2258d0c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2263ec0, Reserved2=0x0, phNewContext=0x2263b00, pOutput=0x2263ed4, pfContextAttr=0x22623d8, ptsExpiry=0x19eea4 | out: phNewContext=0x2263b00, pOutput=0x2263ed4, pfContextAttr=0x22623d8, ptsExpiry=0x19eea4) returned 0x90312 [0235.407] recv (in: s=0x548, buf=0x2263f64, len=5, flags=0 | out: buf=0x2263f64*) returned 5 [0235.407] recv (in: s=0x548, buf=0x2263f7d, len=2650, flags=0 | out: buf=0x2263f7d*) returned 2650 [0235.408] InitializeSecurityContextW (in: phCredential=0x19ee14, phContext=0x19eea0, pTargetName=0x2258d0c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2264a48, Reserved2=0x0, phNewContext=0x2263b00, pOutput=0x2264a5c, pfContextAttr=0x22623d8, ptsExpiry=0x19ee0c | out: phNewContext=0x2263b00, pOutput=0x2264a5c, pfContextAttr=0x22623d8, ptsExpiry=0x19ee0c) returned 0x90312 [0235.413] recv (in: s=0x548, buf=0x2264aec, len=5, flags=0 | out: buf=0x2264aec*) returned 5 [0235.413] recv (in: s=0x548, buf=0x2264b05, len=333, flags=0 | out: buf=0x2264b05*) returned 333 [0235.414] InitializeSecurityContextW (in: phCredential=0x19ed7c, phContext=0x19ee08, pTargetName=0x2258d0c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2264cc4, Reserved2=0x0, phNewContext=0x2263b00, pOutput=0x2264cd8, pfContextAttr=0x22623d8, ptsExpiry=0x19ed74 | out: phNewContext=0x2263b00, pOutput=0x2264cd8, pfContextAttr=0x22623d8, ptsExpiry=0x19ed74) returned 0x90312 [0235.414] recv (in: s=0x548, buf=0x2264d68, len=5, flags=0 | out: buf=0x2264d68*) returned 5 [0235.414] recv (in: s=0x548, buf=0x2264d81, len=4, flags=0 | out: buf=0x2264d81*) returned 4 [0235.415] InitializeSecurityContextW (in: phCredential=0x19ece4, phContext=0x19ed70, pTargetName=0x2258d0c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2264df8, Reserved2=0x0, phNewContext=0x2263b00, pOutput=0x2264e0c, pfContextAttr=0x22623d8, ptsExpiry=0x19ecdc | out: phNewContext=0x2263b00, pOutput=0x2264e0c, pfContextAttr=0x22623d8, ptsExpiry=0x19ecdc) returned 0x90312 [0235.447] FreeContextBuffer (in: pvContextBuffer=0x535d10 | out: pvContextBuffer=0x535d10) returned 0x0 [0235.447] send (s=0x548, buf=0x2264e88*, len=126, flags=0) returned 126 [0235.448] recv (in: s=0x548, buf=0x2264e88, len=5, flags=0 | out: buf=0x2264e88*) returned 5 [0235.582] recv (in: s=0x548, buf=0x2264e8d, len=1, flags=0 | out: buf=0x2264e8d*) returned 1 [0235.582] InitializeSecurityContextW (in: phCredential=0x19ec4c, phContext=0x19ecd8, pTargetName=0x2258d0c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2264f8c, Reserved2=0x0, phNewContext=0x2263b00, pOutput=0x2264fa0, pfContextAttr=0x22623d8, ptsExpiry=0x19ec44 | out: phNewContext=0x2263b00, pOutput=0x2264fa0, pfContextAttr=0x22623d8, ptsExpiry=0x19ec44) returned 0x90312 [0235.583] recv (in: s=0x548, buf=0x2265030, len=5, flags=0 | out: buf=0x2265030*) returned 5 [0235.583] recv (in: s=0x548, buf=0x2265049, len=40, flags=0 | out: buf=0x2265049*) returned 40 [0235.583] InitializeSecurityContextW (in: phCredential=0x19ebb4, phContext=0x19ec40, pTargetName=0x2258d0c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x22650e4, Reserved2=0x0, phNewContext=0x2263b00, pOutput=0x22650f8, pfContextAttr=0x22623d8, ptsExpiry=0x19ebac | out: phNewContext=0x2263b00, pOutput=0x22650f8, pfContextAttr=0x22623d8, ptsExpiry=0x19ebac) returned 0x0 [0236.239] QueryContextAttributesW (in: phContext=0x2263b00, ulAttribute=0x4, pBuffer=0x22651a4 | out: pBuffer=0x22651a4) returned 0x0 [0236.239] QueryContextAttributesW (in: phContext=0x2263b00, ulAttribute=0x5a, pBuffer=0x22651fc | out: pBuffer=0x22651fc) returned 0x0 [0236.241] QueryContextAttributesW (in: phContext=0x2263b00, ulAttribute=0x53, pBuffer=0x22654b0 | out: pBuffer=0x22654b0) returned 0x0 [0236.246] CertDuplicateCertificateContext (pCertContext=0x548ee0) returned 0x548ee0 [0236.247] CertDuplicateStore (hCertStore=0x522790) returned 0x522790 [0236.247] CertEnumCertificatesInStore (hCertStore=0x522790, pPrevCertContext=0x0) returned 0x4fb2d0 [0236.248] CertDuplicateCertificateContext (pCertContext=0x4fb2d0) returned 0x4fb2d0 [0236.248] CertEnumCertificatesInStore (hCertStore=0x522790, pPrevCertContext=0x4fb2d0) returned 0x548ee0 [0236.248] CertDuplicateCertificateContext (pCertContext=0x548ee0) returned 0x548ee0 [0236.248] CertEnumCertificatesInStore (hCertStore=0x522790, pPrevCertContext=0x548ee0) returned 0x0 [0236.248] CertCloseStore (hCertStore=0x522790, dwFlags=0x0) returned 1 [0236.248] CertFreeCertificateContext (pCertContext=0x548ee0) returned 1 [0236.260] CertOpenStore (lpszStoreProvider=0x2, dwEncodingType=0x10001, hCryptProv=0x0, dwFlags=0x2204, pvPara=0x0) returned 0x522808 [0236.415] CertAddCRLLinkToStore (in: hCertStore=0x522808, pCrlContext=0x4fb2d0, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0236.418] CertAddCRLLinkToStore (in: hCertStore=0x522808, pCrlContext=0x548ee0, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0236.422] CertGetCertificateChain (in: hChainEngine=0x0, pCertContext=0x548ee0, pTime=0x19ebc0, hAdditionalStore=0x522808, pChainPara=0x19eb00, dwFlags=0x0, pvReserved=0x0, ppChainContext=0x19eaf4 | out: ppChainContext=0x19eaf4) returned 1 [0236.436] CertDuplicateCertificateChain (pChainContext=0x559ea8) returned 0x559ea8 [0236.437] CertDuplicateCertificateContext (pCertContext=0x548ee0) returned 0x548ee0 [0236.437] CertDuplicateCertificateContext (pCertContext=0x4fb410) returned 0x4fb410 [0236.437] CertDuplicateCertificateContext (pCertContext=0x4fb460) returned 0x4fb460 [0236.437] CertFreeCertificateChain (pChainContext=0x559ea8) [0236.438] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x1, pChainContext=0x559ea8, pPolicyPara=0x19eca0, pPolicyStatus=0x19ec8c | out: pPolicyStatus=0x19ec8c) returned 1 [0236.438] SetLastError (dwErrCode=0x0) [0236.441] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x4, pChainContext=0x559ea8, pPolicyPara=0x19ed0c, pPolicyStatus=0x19ecb4 | out: pPolicyStatus=0x19ecb4) returned 1 [0236.446] CertFreeCertificateChain (pChainContext=0x559ea8) [0236.446] CertFreeCertificateContext (pCertContext=0x548ee0) returned 1 [0236.451] EtwEventRegister (in: ProviderId=0x2267a6c, EnableCallback=0x47206ae, CallbackContext=0x0, RegHandle=0x2267a48 | out: RegHandle=0x2267a48) returned 0x0 [0236.452] EtwEventSetInformation (RegHandle=0x4e5940, InformationClass=0x5a, EventInformation=0x2, InformationLength=0x2267a08) returned 0x0 [0236.461] CoTaskMemAlloc (cb=0x20c) returned 0x5491720 [0236.461] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x5491720, nSize=0x104 | out: lpBuffer="") returned 0x0 [0236.461] CoTaskMemFree (pv=0x5491720) [0236.462] CoTaskMemAlloc (cb=0x20c) returned 0x5491720 [0236.462] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x5491720, nSize=0x104 | out: lpBuffer="") returned 0x0 [0236.462] CoTaskMemFree (pv=0x5491720) [0236.462] CoTaskMemAlloc (cb=0x20c) returned 0x5491720 [0236.462] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x5491720, nSize=0x104 | out: lpBuffer="") returned 0x0 [0236.462] CoTaskMemFree (pv=0x5491720) [0236.462] CoTaskMemAlloc (cb=0x20c) returned 0x5491720 [0236.462] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x5491720, nSize=0x104 | out: lpBuffer="") returned 0x0 [0236.462] CoTaskMemFree (pv=0x5491720) [0236.465] EncryptMessage (in: phContext=0x2263b00, fQOP=0x0, pMessage=0x226e1a8, MessageSeqNo=0x0 | out: pMessage=0x226e1a8) returned 0x0 [0236.466] send (s=0x548, buf=0x226cc80*, len=42, flags=0) returned 42 [0236.467] recv (in: s=0x548, buf=0x227a5d0, len=5, flags=0 | out: buf=0x227a5d0*) returned 5 [0236.605] recv (in: s=0x548, buf=0x227a5d5, len=218, flags=0 | out: buf=0x227a5d5*) returned 218 [0236.605] DecryptMessage (in: phContext=0x2263b00, pMessage=0x227e690, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x227e690, pfQOP=0x0) returned 0x0 [0236.610] EncryptMessage (in: phContext=0x2263b00, fQOP=0x0, pMessage=0x227f1a8, MessageSeqNo=0x0 | out: pMessage=0x227f1a8) returned 0x0 [0236.610] send (s=0x548, buf=0x226cc80*, len=66, flags=0) returned 66 [0236.611] recv (in: s=0x548, buf=0x227a5d0, len=5, flags=0 | out: buf=0x227a5d0*) returned 5 [0236.745] recv (in: s=0x548, buf=0x227a5d5, len=42, flags=0 | out: buf=0x227a5d5*) returned 42 [0236.745] DecryptMessage (in: phContext=0x2263b00, pMessage=0x227f328, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x227f328, pfQOP=0x0) returned 0x0 [0236.747] SysStringLen (param_1="窺斡↪⏲䈐ហꋨ䄑覸⌣ꑄ❭朢\⧞≔) returned 0x10 [0236.747] SystemFunction041 (in: Memory=0x4e7b8c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x4e7b8c) returned 0x0 [0236.747] SysStringLen (param_1="bigboy247ctSet") returned 0x10 [0236.747] SystemFunction040 (in: Memory=0x4e7b8c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x4e7b8c) returned 0x0 [0236.747] SysStringLen (param_1="bigboy247") returned 0x9 [0236.747] SysStringLen (param_1="bigboy247") returned 0x9 [0236.747] EncryptMessage (in: phContext=0x2263b00, fQOP=0x0, pMessage=0x227f638, MessageSeqNo=0x0 | out: pMessage=0x227f638) returned 0x0 [0236.747] send (s=0x548, buf=0x226cc80*, len=43, flags=0) returned 43 [0236.748] recv (in: s=0x548, buf=0x227a5d0, len=5, flags=0 | out: buf=0x227a5d0*) returned 5 [0236.898] recv (in: s=0x548, buf=0x227a5d5, len=54, flags=0 | out: buf=0x227a5d5*) returned 54 [0236.899] DecryptMessage (in: phContext=0x2263b00, pMessage=0x227f7b8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x227f7b8, pfQOP=0x0) returned 0x0 [0236.901] EncryptMessage (in: phContext=0x2263b00, fQOP=0x0, pMessage=0x227fc90, MessageSeqNo=0x0 | out: pMessage=0x227fc90) returned 0x0 [0236.901] send (s=0x548, buf=0x226cc80*, len=60, flags=0) returned 60 [0236.902] recv (in: s=0x548, buf=0x227a5d0, len=5, flags=0 | out: buf=0x227a5d0*) returned 5 [0237.042] recv (in: s=0x548, buf=0x227a5d5, len=32, flags=0 | out: buf=0x227a5d5*) returned 32 [0237.042] DecryptMessage (in: phContext=0x2263b00, pMessage=0x227fe10, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x227fe10, pfQOP=0x0) returned 0x0 [0237.042] EncryptMessage (in: phContext=0x2263b00, fQOP=0x0, pMessage=0x2280080, MessageSeqNo=0x0 | out: pMessage=0x2280080) returned 0x0 [0237.043] send (s=0x548, buf=0x226cc80*, len=57, flags=0) returned 57 [0237.043] recv (in: s=0x548, buf=0x227a5d0, len=5, flags=0 | out: buf=0x227a5d0*) returned 5 [0237.183] recv (in: s=0x548, buf=0x227a5d5, len=38, flags=0 | out: buf=0x227a5d5*) returned 38 [0237.183] DecryptMessage (in: phContext=0x2263b00, pMessage=0x2280200, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2280200, pfQOP=0x0) returned 0x0 [0237.184] EncryptMessage (in: phContext=0x2263b00, fQOP=0x0, pMessage=0x2280398, MessageSeqNo=0x0 | out: pMessage=0x2280398) returned 0x0 [0237.184] send (s=0x548, buf=0x226cc80*, len=35, flags=0) returned 35 [0237.185] recv (in: s=0x548, buf=0x227a5d0, len=5, flags=0 | out: buf=0x227a5d0*) returned 5 [0237.316] recv (in: s=0x548, buf=0x227a5d5, len=80, flags=0 | out: buf=0x227a5d5*) returned 80 [0237.316] DecryptMessage (in: phContext=0x2263b00, pMessage=0x2280518, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2280518, pfQOP=0x0) returned 0x0 [0237.353] EncryptMessage (in: phContext=0x2263b00, fQOP=0x0, pMessage=0x2286a1c, MessageSeqNo=0x0 | out: pMessage=0x2286a1c) returned 0x0 [0237.353] send (s=0x548, buf=0x226cc80*, len=251, flags=0) returned 251 [0237.355] EncryptMessage (in: phContext=0x2263b00, fQOP=0x0, pMessage=0x2287620, MessageSeqNo=0x0 | out: pMessage=0x2287620) returned 0x0 [0237.355] send (s=0x548, buf=0x226cc80*, len=365, flags=0) returned 365 [0237.358] EncryptMessage (in: phContext=0x2263b00, fQOP=0x0, pMessage=0x2287740, MessageSeqNo=0x0 | out: pMessage=0x2287740) returned 0x0 [0237.358] send (s=0x548, buf=0x226cc80*, len=31, flags=0) returned 31 [0237.358] EncryptMessage (in: phContext=0x2263b00, fQOP=0x0, pMessage=0x2287860, MessageSeqNo=0x0 | out: pMessage=0x2287860) returned 0x0 [0237.359] send (s=0x548, buf=0x226cc80*, len=34, flags=0) returned 34 [0237.359] recv (in: s=0x548, buf=0x227a5d0, len=5, flags=0 | out: buf=0x227a5d0*) returned 5 [0237.491] recv (in: s=0x548, buf=0x227a5d5, len=52, flags=0 | out: buf=0x227a5d5*) returned 52 [0237.491] DecryptMessage (in: phContext=0x2263b00, pMessage=0x22879e0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x22879e0, pfQOP=0x0) returned 0x0 [0237.497] ReleaseSemaphore (in: hSemaphore=0x53c, lReleaseCount=1, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0237.502] GetCurrentProcess () returned 0xffffffff [0237.502] GetCurrentThread () returned 0xfffffffe [0237.502] GetCurrentProcess () returned 0xffffffff [0237.502] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x19f4c8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x19f4c8*=0x64c) returned 1 [0237.507] GetCurrentThreadId () returned 0x46c [0237.512] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc20e [0237.513] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc20d [0237.517] GetSystemMetrics (nIndex=75) returned 1 [0237.525] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0237.532] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x68470000 [0237.717] GetModuleHandleW (lpModuleName="user32.dll") returned 0x75640000 [0237.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x19f234, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcW\x97iX©,Ý «\x15lhö\x19", lpUsedDefaultChar=0x0) returned 14 [0237.717] GetProcAddress (hModule=0x75640000, lpProcName="DefWindowProcW") returned 0x778baee0 [0237.718] GetStockObject (i=5) returned 0x1900015 [0237.720] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0237.724] CoTaskMemAlloc (cb=0x5c) returned 0x50f360 [0237.724] RegisterClassW (lpWndClass=0x19f224) returned 0xc150 [0237.725] CoTaskMemFree (pv=0x50f360) [0237.725] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0237.726] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.3c47a4f_r10_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x90200 [0237.728] SetWindowLongW (hWnd=0x90200, nIndex=-4, dwNewLong=2005642976) returned 74584182 [0237.729] GetWindowLongW (hWnd=0x90200, nIndex=-4) returned 2005642976 [0237.731] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ea84 | out: phkResult=0x19ea84*=0x654) returned 0x0 [0237.731] RegQueryValueExW (in: hKey=0x654, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x19eaa4, lpData=0x0, lpcbData=0x19eaa0*=0x0 | out: lpType=0x19eaa4*=0x0, lpData=0x0, lpcbData=0x19eaa0*=0x0) returned 0x2 [0237.731] RegQueryValueExW (in: hKey=0x654, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x19eaa4, lpData=0x0, lpcbData=0x19eaa0*=0x0 | out: lpType=0x19eaa4*=0x0, lpData=0x0, lpcbData=0x19eaa0*=0x0) returned 0x2 [0237.731] RegCloseKey (hKey=0x654) returned 0x0 [0237.732] SetWindowLongW (hWnd=0x90200, nIndex=-4, dwNewLong=74584222) returned 2005642976 [0237.733] GetWindowLongW (hWnd=0x90200, nIndex=-4) returned 74584222 [0237.733] GetWindowLongW (hWnd=0x90200, nIndex=-16) returned 113311744 [0237.733] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc1f3 [0237.734] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x90200, Msg=0x24, wParam=0x0, lParam=0x19ed9c) returned 0x0 [0237.734] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc1f5 [0237.734] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x90200, Msg=0x81, wParam=0x0, lParam=0x19ed90) returned 0x1 [0237.735] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x90200, Msg=0x83, wParam=0x0, lParam=0x19ed7c) returned 0x0 [0237.742] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x90200, Msg=0x1, wParam=0x0, lParam=0x19ed90) returned 0x0 [0237.742] GetClientRect (in: hWnd=0x90200, lpRect=0x19eabc | out: lpRect=0x19eabc) returned 1 [0237.742] GetWindowRect (in: hWnd=0x90200, lpRect=0x19eabc | out: lpRect=0x19eabc) returned 1 [0237.745] GetParent (hWnd=0x90200) returned 0x0 [0237.746] OleInitialize (pvReserved=0x0) returned 0x0 [0237.747] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x19f444 | out: lplpMessageFilter=0x19f444*=0x0) returned 0x0 [0237.748] PeekMessageW (in: lpMsg=0x19f418, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19f418) returned 0 [0237.750] PeekMessageW (in: lpMsg=0x19f418, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19f418) returned 0 [0237.750] WaitMessage () Thread: id = 11 os_tid = 0xfcc Thread: id = 13 os_tid = 0x81c Thread: id = 14 os_tid = 0xc3c [0186.315] CoGetContextToken (in: pToken=0x429fc3c | out: pToken=0x429fc3c) returned 0x800401f0 [0186.315] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0186.315] RoInitialize () returned 0x1 [0186.316] RoUninitialize () returned 0x0 [0225.848] CoGetContextToken (in: pToken=0x429fc30 | out: pToken=0x429fc30) returned 0x0 [0225.848] CoGetContextToken (in: pToken=0x429fbb8 | out: pToken=0x429fbb8) returned 0x0 [0225.848] WbemDefPath:IUnknown:Release (This=0x4e0108) returned 0x1 [0225.848] WbemDefPath:IUnknown:Release (This=0x4e0108) returned 0x0 [0225.848] CoGetContextToken (in: pToken=0x429fbb8 | out: pToken=0x429fbb8) returned 0x0 [0225.848] WbemDefPath:IUnknown:Release (This=0x4e0338) returned 0x1 [0225.848] WbemDefPath:IUnknown:Release (This=0x4e0338) returned 0x0 [0225.848] CoGetContextToken (in: pToken=0x429fbb8 | out: pToken=0x429fbb8) returned 0x0 [0225.848] WbemDefPath:IUnknown:Release (This=0x52c558) returned 0x1 [0225.848] WbemDefPath:IUnknown:Release (This=0x52c558) returned 0x0 [0225.848] CoGetContextToken (in: pToken=0x429fbb8 | out: pToken=0x429fbb8) returned 0x0 [0225.848] WbemDefPath:IUnknown:Release (This=0x52cb78) returned 0x1 [0225.848] WbemDefPath:IUnknown:Release (This=0x52cb78) returned 0x0 [0225.849] CoGetContextToken (in: pToken=0x429fbb8 | out: pToken=0x429fbb8) returned 0x0 [0225.849] WbemDefPath:IUnknown:Release (This=0x52ca98) returned 0x1 [0225.849] WbemDefPath:IUnknown:Release (This=0x52ca98) returned 0x0 [0225.849] CoGetContextToken (in: pToken=0x429fbb8 | out: pToken=0x429fbb8) returned 0x0 [0225.849] WbemDefPath:IUnknown:Release (This=0x52c328) returned 0x1 [0225.849] WbemDefPath:IUnknown:Release (This=0x52c328) returned 0x0 [0225.849] CoGetContextToken (in: pToken=0x429fbb8 | out: pToken=0x429fbb8) returned 0x0 [0225.849] WbemDefPath:IUnknown:Release (This=0x52bde8) returned 0x1 [0225.849] WbemDefPath:IUnknown:Release (This=0x52bde8) returned 0x0 [0225.849] CoGetContextToken (in: pToken=0x429fc30 | out: pToken=0x429fc30) returned 0x0 [0225.849] CoGetContextToken (in: pToken=0x429fbb8 | out: pToken=0x429fbb8) returned 0x0 [0225.849] WbemLocator:IUnknown:Release (This=0x5178c0) returned 0x1 [0225.849] WbemLocator:IUnknown:Release (This=0x5178c0) returned 0x0 [0225.849] CoGetContextToken (in: pToken=0x429fbb8 | out: pToken=0x429fbb8) returned 0x0 [0225.849] WbemLocator:IUnknown:Release (This=0x517860) returned 0x1 [0225.849] WbemLocator:IUnknown:Release (This=0x517860) returned 0x0 [0225.849] CoGetContextToken (in: pToken=0x429fc30 | out: pToken=0x429fc30) returned 0x0 [0225.849] IUnknown:QueryInterface (in: This=0x4c0058, riid=0x6c218724*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x429fbd8 | out: ppvObject=0x429fbd8*=0x4c0068) returned 0x0 [0225.850] CObjectContext::ContextCallback () returned 0x0 [0229.554] IUnknown:Release (This=0x4c0068) returned 0x1 [0229.554] CoGetContextToken (in: pToken=0x429fa50 | out: pToken=0x429fa50) returned 0x0 [0229.554] IUnknown:QueryInterface (in: This=0x4c0058, riid=0x6c218724*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x429f9f8 | out: ppvObject=0x429f9f8*=0x4c0068) returned 0x0 [0229.554] CObjectContext::ContextCallback () returned 0x0 [0229.591] IUnknown:Release (This=0x4c0068) returned 0x1 [0229.592] IUnknown:Release (This=0x4e8b80) returned 0x0 [0229.592] IUnknown:Release (This=0x521088) returned 0x0 [0229.592] IUnknown:Release (This=0x5470b0) returned 0x0 [0229.593] CoGetContextToken (in: pToken=0x429fa50 | out: pToken=0x429fa50) returned 0x0 [0229.593] IUnknown:QueryInterface (in: This=0x4c0058, riid=0x6c218724*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x429f9f8 | out: ppvObject=0x429f9f8*=0x4c0068) returned 0x0 [0229.593] CObjectContext::ContextCallback () returned 0x0 [0229.602] IUnknown:Release (This=0x4c0068) returned 0x1 [0229.602] IUnknown:Release (This=0x4c0058) returned 0x0 [0229.602] IUnknown:Release (This=0x530bd0) returned 0x0 [0229.604] CloseHandle (hObject=0x480) returned 1 [0229.604] CloseHandle (hObject=0x47c) returned 1 [0229.605] CloseHandle (hObject=0x470) returned 1 [0229.605] CloseHandle (hObject=0x46c) returned 1 [0229.605] CloseHandle (hObject=0x278) returned 1 [0229.606] CloseHandle (hObject=0x274) returned 1 [0229.606] RegCloseKey (hKey=0x4d4) returned 0x0 [0229.606] CloseHandle (hObject=0x270) returned 1 [0229.606] CloseHandle (hObject=0x468) returned 1 [0229.606] CloseHandle (hObject=0x26c) returned 1 [0229.606] CloseHandle (hObject=0x268) returned 1 [0229.607] CloseHandle (hObject=0x264) returned 1 [0229.607] CloseHandle (hObject=0x450) returned 1 [0229.607] CloseHandle (hObject=0x260) returned 1 [0229.607] CloseHandle (hObject=0x44c) returned 1 [0229.607] CloseHandle (hObject=0x448) returned 1 [0229.607] CloseHandle (hObject=0x25c) returned 1 [0229.608] CloseHandle (hObject=0x488) returned 1 [0229.608] CloseHandle (hObject=0x444) returned 1 [0229.608] CloseHandle (hObject=0x3f4) returned 1 [0229.609] CloseHandle (hObject=0x3f0) returned 1 [0229.609] CloseHandle (hObject=0x3b8) returned 1 [0229.609] CloseHandle (hObject=0x484) returned 1 Thread: id = 15 os_tid = 0x1358 Thread: id = 16 os_tid = 0x954 Thread: id = 17 os_tid = 0xfa0 Thread: id = 131 os_tid = 0x7ac [0206.440] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0206.440] RoInitialize () returned 0x1 [0206.440] RoUninitialize () returned 0x0 [0206.469] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x4e0f5b4 | out: lpiid=0x4e0f5b4) returned 0x0 [0206.471] CoGetClassObject (in: rclsid=0x50698c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c2154e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x517900) returned 0x0 [0206.472] WbemDefPath:IUnknown:QueryInterface (in: This=0x517900, riid=0x6c1c95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0206.472] WbemDefPath:IClassFactory:CreateInstance (in: This=0x517900, pUnkOuter=0x0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x4e0108) returned 0x0 [0206.472] WbemDefPath:IUnknown:Release (This=0x517900) returned 0x0 [0206.472] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0108, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x4e0108) returned 0x0 [0206.472] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0108, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0206.473] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0108, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0206.473] WbemDefPath:IUnknown:AddRef (This=0x4e0108) returned 0x3 [0206.473] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0108, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0206.473] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0108, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0206.473] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0108, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x5141c8) returned 0x0 [0206.473] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5141c8, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0206.473] WbemDefPath:IUnknown:Release (This=0x5141c8) returned 0x3 [0206.473] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0206.475] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0206.475] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0108, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0206.475] WbemDefPath:IUnknown:Release (This=0x4e0108) returned 0x2 [0206.475] WbemDefPath:IUnknown:Release (This=0x4e0108) returned 0x1 [0206.475] SetEvent (hEvent=0x3b8) returned 1 [0206.492] CoGetClassObject (in: rclsid=0x50698c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c2154e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x517790) returned 0x0 [0206.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x517790, riid=0x6c1c95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0206.493] WbemDefPath:IClassFactory:CreateInstance (in: This=0x517790, pUnkOuter=0x0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x4e0568) returned 0x0 [0206.493] WbemDefPath:IUnknown:Release (This=0x517790) returned 0x0 [0206.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0568, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x4e0568) returned 0x0 [0206.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0568, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0206.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0568, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0206.493] WbemDefPath:IUnknown:AddRef (This=0x4e0568) returned 0x3 [0206.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0568, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0206.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0568, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0206.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0568, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x513fb8) returned 0x0 [0206.493] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x513fb8, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0206.493] WbemDefPath:IUnknown:Release (This=0x513fb8) returned 0x3 [0206.493] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0206.494] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0206.494] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0568, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0206.494] WbemDefPath:IUnknown:Release (This=0x4e0568) returned 0x2 [0206.494] WbemDefPath:IUnknown:Release (This=0x4e0568) returned 0x1 [0206.494] SetEvent (hEvent=0x3f0) returned 1 [0206.497] CoGetClassObject (in: rclsid=0x50698c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c2154e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x5178c0) returned 0x0 [0206.497] WbemDefPath:IUnknown:QueryInterface (in: This=0x5178c0, riid=0x6c1c95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0206.497] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5178c0, pUnkOuter=0x0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x4e0728) returned 0x0 [0206.497] WbemDefPath:IUnknown:Release (This=0x5178c0) returned 0x0 [0206.497] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0728, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x4e0728) returned 0x0 [0206.497] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0728, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0206.497] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0728, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0206.497] WbemDefPath:IUnknown:AddRef (This=0x4e0728) returned 0x3 [0206.497] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0728, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0206.497] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0728, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0206.497] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0728, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x5140c0) returned 0x0 [0206.497] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5140c0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0206.498] WbemDefPath:IUnknown:Release (This=0x5140c0) returned 0x3 [0206.498] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0206.498] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0206.498] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0728, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0206.498] WbemDefPath:IUnknown:Release (This=0x4e0728) returned 0x2 [0206.498] WbemDefPath:IUnknown:Release (This=0x4e0728) returned 0x1 [0206.498] SetEvent (hEvent=0x3f4) returned 1 [0207.855] CoGetClassObject (in: rclsid=0x50698c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c2154e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x517940) returned 0x0 [0207.855] WbemDefPath:IUnknown:QueryInterface (in: This=0x517940, riid=0x6c1c95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0207.855] WbemDefPath:IClassFactory:CreateInstance (in: This=0x517940, pUnkOuter=0x0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x4e01e8) returned 0x0 [0207.856] WbemDefPath:IUnknown:Release (This=0x517940) returned 0x0 [0207.856] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e01e8, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x4e01e8) returned 0x0 [0207.856] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e01e8, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0207.856] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e01e8, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0207.856] WbemDefPath:IUnknown:AddRef (This=0x4e01e8) returned 0x3 [0207.856] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e01e8, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0207.856] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e01e8, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0207.856] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e01e8, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x5145a0) returned 0x0 [0207.856] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5145a0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0207.856] WbemDefPath:IUnknown:Release (This=0x5145a0) returned 0x3 [0207.857] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0207.857] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0207.857] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e01e8, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0207.857] WbemDefPath:IUnknown:Release (This=0x4e01e8) returned 0x2 [0207.857] WbemDefPath:IUnknown:Release (This=0x4e01e8) returned 0x1 [0207.857] SetEvent (hEvent=0x444) returned 1 [0219.970] CoGetClassObject (in: rclsid=0x50698c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c2154e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x517860) returned 0x0 [0219.972] WbemDefPath:IUnknown:QueryInterface (in: This=0x517860, riid=0x6c1c95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0219.972] WbemDefPath:IClassFactory:CreateInstance (in: This=0x517860, pUnkOuter=0x0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x4e0648) returned 0x0 [0219.972] WbemDefPath:IUnknown:Release (This=0x517860) returned 0x0 [0219.972] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0648, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x4e0648) returned 0x0 [0219.972] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0648, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0219.973] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0648, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0219.973] WbemDefPath:IUnknown:AddRef (This=0x4e0648) returned 0x3 [0219.973] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0648, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0219.973] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0648, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0219.973] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0648, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x514660) returned 0x0 [0219.973] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x514660, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.973] WbemDefPath:IUnknown:Release (This=0x514660) returned 0x3 [0219.973] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0219.973] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0219.973] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0648, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0219.973] WbemDefPath:IUnknown:Release (This=0x4e0648) returned 0x2 [0219.973] WbemDefPath:IUnknown:Release (This=0x4e0648) returned 0x1 [0219.973] SetEvent (hEvent=0x448) returned 1 [0220.048] CoGetClassObject (in: rclsid=0x50698c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c2154e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x517900) returned 0x0 [0220.049] WbemDefPath:IUnknown:QueryInterface (in: This=0x517900, riid=0x6c1c95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0220.049] WbemDefPath:IClassFactory:CreateInstance (in: This=0x517900, pUnkOuter=0x0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x4e0338) returned 0x0 [0220.050] WbemDefPath:IUnknown:Release (This=0x517900) returned 0x0 [0220.050] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0338, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x4e0338) returned 0x0 [0220.050] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0338, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0220.050] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0338, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0220.050] WbemDefPath:IUnknown:AddRef (This=0x4e0338) returned 0x3 [0220.050] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0338, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0220.050] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0338, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0220.050] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0338, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x4effe0) returned 0x0 [0220.050] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x4effe0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0220.050] WbemDefPath:IUnknown:Release (This=0x4effe0) returned 0x3 [0220.050] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0220.050] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0220.050] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0338, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0220.050] WbemDefPath:IUnknown:Release (This=0x4e0338) returned 0x2 [0220.050] WbemDefPath:IUnknown:Release (This=0x4e0338) returned 0x1 [0220.050] SetEvent (hEvent=0x44c) returned 1 [0220.053] CoGetClassObject (in: rclsid=0x50698c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c2154e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x5177a0) returned 0x0 [0220.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x5177a0, riid=0x6c1c95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0220.054] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5177a0, pUnkOuter=0x0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x4e0418) returned 0x0 [0220.054] WbemDefPath:IUnknown:Release (This=0x5177a0) returned 0x0 [0220.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0418, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x4e0418) returned 0x0 [0220.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0418, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0220.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0418, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0220.054] WbemDefPath:IUnknown:AddRef (This=0x4e0418) returned 0x3 [0220.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0418, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0220.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0418, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0220.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0418, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x4f0190) returned 0x0 [0220.054] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x4f0190, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0220.054] WbemDefPath:IUnknown:Release (This=0x4f0190) returned 0x3 [0220.054] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0220.055] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0220.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e0418, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0220.055] WbemDefPath:IUnknown:Release (This=0x4e0418) returned 0x2 [0220.055] WbemDefPath:IUnknown:Release (This=0x4e0418) returned 0x1 [0220.055] SetEvent (hEvent=0x450) returned 1 [0220.154] CoGetClassObject (in: rclsid=0x50698c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c2154e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x517930) returned 0x0 [0220.155] WbemDefPath:IUnknown:QueryInterface (in: This=0x517930, riid=0x6c1c95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0220.155] WbemDefPath:IClassFactory:CreateInstance (in: This=0x517930, pUnkOuter=0x0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x4e04f8) returned 0x0 [0220.155] WbemDefPath:IUnknown:Release (This=0x517930) returned 0x0 [0220.155] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e04f8, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x4e04f8) returned 0x0 [0220.155] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e04f8, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0220.155] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e04f8, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0220.155] WbemDefPath:IUnknown:AddRef (This=0x4e04f8) returned 0x3 [0220.155] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e04f8, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0220.155] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e04f8, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0220.155] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e04f8, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x4f0028) returned 0x0 [0220.155] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x4f0028, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0220.155] WbemDefPath:IUnknown:Release (This=0x4f0028) returned 0x3 [0220.155] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0220.156] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0220.156] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e04f8, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0220.156] WbemDefPath:IUnknown:Release (This=0x4e04f8) returned 0x2 [0220.156] WbemDefPath:IUnknown:Release (This=0x4e04f8) returned 0x1 [0220.156] SetEvent (hEvent=0x468) returned 1 [0220.603] CoGetClassObject (in: rclsid=0x50698c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c2154e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x517a20) returned 0x0 [0220.604] WbemDefPath:IUnknown:QueryInterface (in: This=0x517a20, riid=0x6c1c95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0220.604] WbemDefPath:IClassFactory:CreateInstance (in: This=0x517a20, pUnkOuter=0x0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x52c558) returned 0x0 [0220.604] WbemDefPath:IUnknown:Release (This=0x517a20) returned 0x0 [0220.604] WbemDefPath:IUnknown:QueryInterface (in: This=0x52c558, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x52c558) returned 0x0 [0220.604] WbemDefPath:IUnknown:QueryInterface (in: This=0x52c558, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0220.604] WbemDefPath:IUnknown:QueryInterface (in: This=0x52c558, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0220.605] WbemDefPath:IUnknown:AddRef (This=0x52c558) returned 0x3 [0220.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x52c558, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0220.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x52c558, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0220.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x52c558, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x4efda0) returned 0x0 [0220.605] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x4efda0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0220.605] WbemDefPath:IUnknown:Release (This=0x4efda0) returned 0x3 [0220.605] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0220.605] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0220.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x52c558, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0220.605] WbemDefPath:IUnknown:Release (This=0x52c558) returned 0x2 [0220.605] WbemDefPath:IUnknown:Release (This=0x52c558) returned 0x1 [0220.605] SetEvent (hEvent=0x46c) returned 1 [0220.660] CoGetClassObject (in: rclsid=0x50698c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c2154e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x517980) returned 0x0 [0220.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x517980, riid=0x6c1c95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0220.661] WbemDefPath:IClassFactory:CreateInstance (in: This=0x517980, pUnkOuter=0x0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x52cb78) returned 0x0 [0220.661] WbemDefPath:IUnknown:Release (This=0x517980) returned 0x0 [0220.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x52cb78, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x52cb78) returned 0x0 [0220.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x52cb78, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0220.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x52cb78, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0220.661] WbemDefPath:IUnknown:AddRef (This=0x52cb78) returned 0x3 [0220.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x52cb78, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0220.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x52cb78, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0220.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x52cb78, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x4efc98) returned 0x0 [0220.661] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x4efc98, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0220.661] WbemDefPath:IUnknown:Release (This=0x4efc98) returned 0x3 [0220.661] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0220.661] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0220.662] WbemDefPath:IUnknown:QueryInterface (in: This=0x52cb78, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0220.662] WbemDefPath:IUnknown:Release (This=0x52cb78) returned 0x2 [0220.662] WbemDefPath:IUnknown:Release (This=0x52cb78) returned 0x1 [0220.662] SetEvent (hEvent=0x470) returned 1 [0220.669] CoGetClassObject (in: rclsid=0x50698c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c2154e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x517ac0) returned 0x0 [0220.670] WbemDefPath:IUnknown:QueryInterface (in: This=0x517ac0, riid=0x6c1c95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0220.670] WbemDefPath:IClassFactory:CreateInstance (in: This=0x517ac0, pUnkOuter=0x0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x52ca98) returned 0x0 [0220.670] WbemDefPath:IUnknown:Release (This=0x517ac0) returned 0x0 [0220.670] WbemDefPath:IUnknown:QueryInterface (in: This=0x52ca98, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x52ca98) returned 0x0 [0220.670] WbemDefPath:IUnknown:QueryInterface (in: This=0x52ca98, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0220.670] WbemDefPath:IUnknown:QueryInterface (in: This=0x52ca98, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0220.670] WbemDefPath:IUnknown:AddRef (This=0x52ca98) returned 0x3 [0220.670] WbemDefPath:IUnknown:QueryInterface (in: This=0x52ca98, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0220.670] WbemDefPath:IUnknown:QueryInterface (in: This=0x52ca98, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0220.670] WbemDefPath:IUnknown:QueryInterface (in: This=0x52ca98, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x52d748) returned 0x0 [0220.670] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x52d748, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0220.671] WbemDefPath:IUnknown:Release (This=0x52d748) returned 0x3 [0220.671] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0220.671] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0220.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x52ca98, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0220.671] WbemDefPath:IUnknown:Release (This=0x52ca98) returned 0x2 [0220.671] WbemDefPath:IUnknown:Release (This=0x52ca98) returned 0x1 [0220.671] SetEvent (hEvent=0x47c) returned 1 [0220.679] CoGetClassObject (in: rclsid=0x50698c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c2154e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x517a10) returned 0x0 [0220.679] WbemDefPath:IUnknown:QueryInterface (in: This=0x517a10, riid=0x6c1c95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0220.679] WbemDefPath:IClassFactory:CreateInstance (in: This=0x517a10, pUnkOuter=0x0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x52c328) returned 0x0 [0220.679] WbemDefPath:IUnknown:Release (This=0x517a10) returned 0x0 [0220.679] WbemDefPath:IUnknown:QueryInterface (in: This=0x52c328, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x52c328) returned 0x0 [0220.679] WbemDefPath:IUnknown:QueryInterface (in: This=0x52c328, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0220.679] WbemDefPath:IUnknown:QueryInterface (in: This=0x52c328, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0220.680] WbemDefPath:IUnknown:AddRef (This=0x52c328) returned 0x3 [0220.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x52c328, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0220.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x52c328, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0220.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x52c328, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x52d040) returned 0x0 [0220.680] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x52d040, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0220.680] WbemDefPath:IUnknown:Release (This=0x52d040) returned 0x3 [0220.680] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0220.680] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0220.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x52c328, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0220.680] WbemDefPath:IUnknown:Release (This=0x52c328) returned 0x2 [0220.680] WbemDefPath:IUnknown:Release (This=0x52c328) returned 0x1 [0220.680] SetEvent (hEvent=0x480) returned 1 [0220.689] CoGetClassObject (in: rclsid=0x50698c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c2154e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x517980) returned 0x0 [0220.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x517980, riid=0x6c1c95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0220.689] WbemDefPath:IClassFactory:CreateInstance (in: This=0x517980, pUnkOuter=0x0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x52bde8) returned 0x0 [0220.689] WbemDefPath:IUnknown:Release (This=0x517980) returned 0x0 [0220.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x52bde8, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x52bde8) returned 0x0 [0220.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x52bde8, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0220.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x52bde8, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0220.690] WbemDefPath:IUnknown:AddRef (This=0x52bde8) returned 0x3 [0220.690] WbemDefPath:IUnknown:QueryInterface (in: This=0x52bde8, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0220.690] WbemDefPath:IUnknown:QueryInterface (in: This=0x52bde8, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0220.690] WbemDefPath:IUnknown:QueryInterface (in: This=0x52bde8, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x52d100) returned 0x0 [0220.690] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x52d100, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0220.690] WbemDefPath:IUnknown:Release (This=0x52d100) returned 0x3 [0220.690] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0220.690] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0220.690] WbemDefPath:IUnknown:QueryInterface (in: This=0x52bde8, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0220.690] WbemDefPath:IUnknown:Release (This=0x52bde8) returned 0x2 [0220.690] WbemDefPath:IUnknown:Release (This=0x52bde8) returned 0x1 [0220.690] SetEvent (hEvent=0x484) returned 1 [0220.705] CoGetClassObject (in: rclsid=0x50698c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c2154e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x517970) returned 0x0 [0220.705] WbemDefPath:IUnknown:QueryInterface (in: This=0x517970, riid=0x6c1c95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0220.705] WbemDefPath:IClassFactory:CreateInstance (in: This=0x517970, pUnkOuter=0x0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x52cb08) returned 0x0 [0220.705] WbemDefPath:IUnknown:Release (This=0x517970) returned 0x0 [0220.705] WbemDefPath:IUnknown:QueryInterface (in: This=0x52cb08, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x52cb08) returned 0x0 [0220.705] WbemDefPath:IUnknown:QueryInterface (in: This=0x52cb08, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0220.705] WbemDefPath:IUnknown:QueryInterface (in: This=0x52cb08, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0220.705] WbemDefPath:IUnknown:AddRef (This=0x52cb08) returned 0x3 [0220.705] WbemDefPath:IUnknown:QueryInterface (in: This=0x52cb08, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0220.705] WbemDefPath:IUnknown:QueryInterface (in: This=0x52cb08, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0220.705] WbemDefPath:IUnknown:QueryInterface (in: This=0x52cb08, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x52d598) returned 0x0 [0220.706] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x52d598, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0220.706] WbemDefPath:IUnknown:Release (This=0x52d598) returned 0x3 [0220.706] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0220.706] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0220.706] WbemDefPath:IUnknown:QueryInterface (in: This=0x52cb08, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0220.706] WbemDefPath:IUnknown:Release (This=0x52cb08) returned 0x2 [0220.706] WbemDefPath:IUnknown:Release (This=0x52cb08) returned 0x1 [0220.706] SetEvent (hEvent=0x488) returned 1 [0229.525] CoGetClassObject (in: rclsid=0x50698c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c2154e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x4e9718) returned 0x0 [0229.526] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e9718, riid=0x6c1c95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0229.526] WbemDefPath:IClassFactory:CreateInstance (in: This=0x4e9718, pUnkOuter=0x0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x52be58) returned 0x0 [0229.526] WbemDefPath:IUnknown:Release (This=0x4e9718) returned 0x0 [0229.526] WbemDefPath:IUnknown:QueryInterface (in: This=0x52be58, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x52be58) returned 0x0 [0229.526] WbemDefPath:IUnknown:QueryInterface (in: This=0x52be58, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0229.526] WbemDefPath:IUnknown:QueryInterface (in: This=0x52be58, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0229.526] WbemDefPath:IUnknown:AddRef (This=0x52be58) returned 0x3 [0229.526] WbemDefPath:IUnknown:QueryInterface (in: This=0x52be58, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0229.526] WbemDefPath:IUnknown:QueryInterface (in: This=0x52be58, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0229.527] WbemDefPath:IUnknown:QueryInterface (in: This=0x52be58, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x549eb0) returned 0x0 [0229.527] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x549eb0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0229.527] WbemDefPath:IUnknown:Release (This=0x549eb0) returned 0x3 [0229.527] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0229.527] CoGetContextToken (in: pToken=0x4e0e9f8 | out: pToken=0x4e0e9f8) returned 0x0 [0229.527] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0229.527] WbemDefPath:IUnknown:QueryInterface (in: This=0x52be58, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0229.527] WbemDefPath:IUnknown:Release (This=0x52be58) returned 0x2 [0229.527] WbemDefPath:IUnknown:Release (This=0x52be58) returned 0x1 [0229.527] SetEvent (hEvent=0x504) returned 1 [0229.813] CoGetClassObject (in: rclsid=0x50698c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c2154e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x4e93c8) returned 0x0 [0229.814] WbemDefPath:IUnknown:QueryInterface (in: This=0x4e93c8, riid=0x6c1c95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0229.814] WbemDefPath:IClassFactory:CreateInstance (in: This=0x4e93c8, pUnkOuter=0x0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x52bec8) returned 0x0 [0229.814] WbemDefPath:IUnknown:Release (This=0x4e93c8) returned 0x0 [0229.814] WbemDefPath:IUnknown:QueryInterface (in: This=0x52bec8, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x52bec8) returned 0x0 [0229.814] WbemDefPath:IUnknown:QueryInterface (in: This=0x52bec8, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0229.814] WbemDefPath:IUnknown:QueryInterface (in: This=0x52bec8, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0229.814] WbemDefPath:IUnknown:AddRef (This=0x52bec8) returned 0x3 [0229.814] WbemDefPath:IUnknown:QueryInterface (in: This=0x52bec8, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0229.814] WbemDefPath:IUnknown:QueryInterface (in: This=0x52bec8, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0229.814] WbemDefPath:IUnknown:QueryInterface (in: This=0x52bec8, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x54a138) returned 0x0 [0229.814] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x54a138, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0229.814] WbemDefPath:IUnknown:Release (This=0x54a138) returned 0x3 [0229.814] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0229.814] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0229.814] WbemDefPath:IUnknown:QueryInterface (in: This=0x52bec8, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0229.814] WbemDefPath:IUnknown:Release (This=0x52bec8) returned 0x2 [0229.814] WbemDefPath:IUnknown:Release (This=0x52bec8) returned 0x1 [0229.814] SetEvent (hEvent=0x508) returned 1 [0231.099] CoGetClassObject (in: rclsid=0x50698c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c2154e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x517a80) returned 0x0 [0231.099] WbemDefPath:IUnknown:QueryInterface (in: This=0x517a80, riid=0x6c1c95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0231.099] WbemDefPath:IClassFactory:CreateInstance (in: This=0x517a80, pUnkOuter=0x0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x52c408) returned 0x0 [0231.099] WbemDefPath:IUnknown:Release (This=0x517a80) returned 0x0 [0231.099] WbemDefPath:IUnknown:QueryInterface (in: This=0x52c408, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x52c408) returned 0x0 [0231.099] WbemDefPath:IUnknown:QueryInterface (in: This=0x52c408, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0231.099] WbemDefPath:IUnknown:QueryInterface (in: This=0x52c408, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0231.100] WbemDefPath:IUnknown:AddRef (This=0x52c408) returned 0x3 [0231.100] WbemDefPath:IUnknown:QueryInterface (in: This=0x52c408, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0231.100] WbemDefPath:IUnknown:QueryInterface (in: This=0x52c408, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0231.100] WbemDefPath:IUnknown:QueryInterface (in: This=0x52c408, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x52d058) returned 0x0 [0231.100] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x52d058, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0231.100] WbemDefPath:IUnknown:Release (This=0x52d058) returned 0x3 [0231.100] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0231.100] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0231.100] WbemDefPath:IUnknown:QueryInterface (in: This=0x52c408, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0231.100] WbemDefPath:IUnknown:Release (This=0x52c408) returned 0x2 [0231.100] WbemDefPath:IUnknown:Release (This=0x52c408) returned 0x1 [0231.100] SetEvent (hEvent=0x458) returned 1 Thread: id = 132 os_tid = 0x774 [0206.507] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0206.507] RoInitialize () returned 0x1 [0206.507] RoUninitialize () returned 0x0 [0206.508] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x4f4f7fc | out: lpiid=0x4f4f7fc) returned 0x0 [0206.509] CoGetClassObject (in: rclsid=0x50692c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c2154e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4f4f510 | out: ppv=0x4f4f510*=0x5143d8) returned 0x0 [0206.509] WbemLocator:IUnknown:QueryInterface (in: This=0x5143d8, riid=0x6c1c95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4f4f728 | out: ppvObject=0x4f4f728*=0x0) returned 0x80004002 [0206.510] WbemLocator:IClassFactory:CreateInstance (in: This=0x5143d8, pUnkOuter=0x0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f4f73c | out: ppvObject=0x4f4f73c*=0x5178c0) returned 0x0 [0206.510] WbemLocator:IUnknown:Release (This=0x5143d8) returned 0x0 [0206.510] WbemLocator:IUnknown:QueryInterface (in: This=0x5178c0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f4f35c | out: ppvObject=0x4f4f35c*=0x5178c0) returned 0x0 [0206.510] WbemLocator:IUnknown:QueryInterface (in: This=0x5178c0, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4f4f318 | out: ppvObject=0x4f4f318*=0x0) returned 0x80004002 [0206.510] WbemLocator:IUnknown:QueryInterface (in: This=0x5178c0, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4f4ef0c | out: ppvObject=0x4f4ef0c*=0x0) returned 0x80004002 [0206.510] WbemLocator:IUnknown:AddRef (This=0x5178c0) returned 0x3 [0206.510] WbemLocator:IUnknown:QueryInterface (in: This=0x5178c0, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4f4ec74 | out: ppvObject=0x4f4ec74*=0x0) returned 0x80004002 [0206.510] WbemLocator:IUnknown:QueryInterface (in: This=0x5178c0, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4f4ec24 | out: ppvObject=0x4f4ec24*=0x0) returned 0x80004002 [0206.510] WbemLocator:IUnknown:QueryInterface (in: This=0x5178c0, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f4ec30 | out: ppvObject=0x4f4ec30*=0x0) returned 0x80004002 [0206.510] CoGetContextToken (in: pToken=0x4f4ec90 | out: pToken=0x4f4ec90) returned 0x0 [0206.510] CoGetObjectContext (in: riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x51431c | out: ppv=0x51431c*=0x4c0110) returned 0x0 [0206.513] CoGetContextToken (in: pToken=0x4f4f098 | out: pToken=0x4f4f098) returned 0x0 [0206.513] WbemLocator:IUnknown:QueryInterface (in: This=0x5178c0, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f4f128 | out: ppvObject=0x4f4f128*=0x0) returned 0x80004002 [0206.513] WbemLocator:IUnknown:Release (This=0x5178c0) returned 0x2 [0206.513] WbemLocator:IUnknown:Release (This=0x5178c0) returned 0x1 [0206.514] CoGetContextToken (in: pToken=0x4f4f708 | out: pToken=0x4f4f708) returned 0x0 [0206.514] CoGetContextToken (in: pToken=0x4f4f668 | out: pToken=0x4f4f668) returned 0x0 [0206.514] WbemLocator:IUnknown:QueryInterface (in: This=0x5178c0, riid=0x4f4f738*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x4f4f734 | out: ppvObject=0x4f4f734*=0x5178c0) returned 0x0 [0206.514] WbemLocator:IUnknown:AddRef (This=0x5178c0) returned 0x3 [0206.514] WbemLocator:IUnknown:Release (This=0x5178c0) returned 0x2 [0206.517] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0728, puCount=0x4f4f8cc | out: puCount=0x4f4f8cc*=0x2) returned 0x0 [0206.517] WbemDefPath:IWbemPath:GetText (in: This=0x4e0728, lFlags=8, puBuffLength=0x4f4f8c8*=0x0, pszText=0x0 | out: puBuffLength=0x4f4f8c8*=0xf, pszText=0x0) returned 0x0 [0206.517] WbemDefPath:IWbemPath:GetText (in: This=0x4e0728, lFlags=8, puBuffLength=0x4f4f8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x4f4f8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0206.530] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x4f4eb4c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0206.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", cchWideChar=63, lpMultiByteStr=0x4f4f050, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll\x02ò\x18ihX©,Ý «\x15lHóô\x04ЫQ", lpUsedDefaultChar=0x0) returned 63 [0206.532] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll") returned 0x6c810000 [0206.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResetSecurity", cchWideChar=13, lpMultiByteStr=0x4f4f084, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResetSecurity\x1aihX©,Ý «\x15lHóô\x04ЫQ", lpUsedDefaultChar=0x0) returned 13 [0206.716] GetProcAddress (hModule=0x6c810000, lpProcName="ResetSecurity") returned 0x6c8126fe [0206.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetSecurity", cchWideChar=11, lpMultiByteStr=0x4f4f084, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetSecurity\x02D\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 11 [0206.728] GetProcAddress (hModule=0x6c810000, lpProcName="SetSecurity") returned 0x6c812740 [0206.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServices", cchWideChar=18, lpMultiByteStr=0x4f4f080, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 18 [0206.739] GetProcAddress (hModule=0x6c810000, lpProcName="BlessIWbemServices") returned 0x6c811e89 [0206.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServicesObject", cchWideChar=24, lpMultiByteStr=0x4f4f078, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesObjectD\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 24 [0206.773] GetProcAddress (hModule=0x6c810000, lpProcName="BlessIWbemServicesObject") returned 0x6c811edb [0206.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyHandle", cchWideChar=17, lpMultiByteStr=0x4f4f080, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyHandle\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 17 [0206.808] GetProcAddress (hModule=0x6c810000, lpProcName="GetPropertyHandle") returned 0x6c8123d4 [0206.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WritePropertyValue", cchWideChar=18, lpMultiByteStr=0x4f4f080, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WritePropertyValueihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 18 [0206.826] GetProcAddress (hModule=0x6c810000, lpProcName="WritePropertyValue") returned 0x6c812837 [0206.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x4f4f08c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 5 [0206.840] GetProcAddress (hModule=0x6c810000, lpProcName="Clone") returned 0x6c811f2d [0206.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VerifyClientKey", cchWideChar=15, lpMultiByteStr=0x4f4f080, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VerifyClientKey\x02D\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 15 [0206.853] GetProcAddress (hModule=0x6c810000, lpProcName="VerifyClientKey") returned 0x6c8127d4 [0206.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetQualifierSet", cchWideChar=15, lpMultiByteStr=0x4f4f080, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetQualifierSet\x02D\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 15 [0206.860] GetProcAddress (hModule=0x6c810000, lpProcName="GetQualifierSet") returned 0x6c812435 [0206.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Get", cchWideChar=3, lpMultiByteStr=0x4f4f08c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Get\x02D\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 3 [0206.862] GetProcAddress (hModule=0x6c810000, lpProcName="Get") returned 0x6c8122f4 [0206.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Put", cchWideChar=3, lpMultiByteStr=0x4f4f08c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Put\x02D\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 3 [0206.924] GetProcAddress (hModule=0x6c810000, lpProcName="Put") returned 0x6c8124de [0206.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Delete", cchWideChar=6, lpMultiByteStr=0x4f4f08c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DeleteihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 6 [0206.947] GetProcAddress (hModule=0x6c810000, lpProcName="Delete") returned 0x6c812151 [0206.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetNames", cchWideChar=8, lpMultiByteStr=0x4f4f088, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetNamesD\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 8 [0206.961] GetProcAddress (hModule=0x6c810000, lpProcName="GetNames") returned 0x6c8123a2 [0206.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginEnumeration", cchWideChar=16, lpMultiByteStr=0x4f4f080, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginEnumerationD\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 16 [0206.998] GetProcAddress (hModule=0x6c810000, lpProcName="BeginEnumeration") returned 0x6c811e63 [0207.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Next", cchWideChar=4, lpMultiByteStr=0x4f4f08c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextD\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 4 [0207.009] GetProcAddress (hModule=0x6c810000, lpProcName="Next") returned 0x6c8124a3 [0207.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndEnumeration", cchWideChar=14, lpMultiByteStr=0x4f4f084, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndEnumerationihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 14 [0207.050] GetProcAddress (hModule=0x6c810000, lpProcName="EndEnumeration") returned 0x6c8121e2 [0207.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyQualifierSet", cchWideChar=23, lpMultiByteStr=0x4f4f078, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyQualifierSet\x02D\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 23 [0207.058] GetProcAddress (hModule=0x6c810000, lpProcName="GetPropertyQualifierSet") returned 0x6c81241f [0207.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x4f4f08c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 5 [0207.073] GetProcAddress (hModule=0x6c810000, lpProcName="Clone") returned 0x6c811f2d [0207.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetObjectText", cchWideChar=13, lpMultiByteStr=0x4f4f084, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetObjectText\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 13 [0207.074] GetProcAddress (hModule=0x6c810000, lpProcName="GetObjectText") returned 0x6c8123be [0207.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnDerivedClass", cchWideChar=17, lpMultiByteStr=0x4f4f080, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnDerivedClass\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 17 [0207.094] GetProcAddress (hModule=0x6c810000, lpProcName="SpawnDerivedClass") returned 0x6c812786 [0207.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnInstance", cchWideChar=13, lpMultiByteStr=0x4f4f084, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnInstance\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 13 [0207.111] GetProcAddress (hModule=0x6c810000, lpProcName="SpawnInstance") returned 0x6c81279c [0207.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CompareTo", cchWideChar=9, lpMultiByteStr=0x4f4f088, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CompareTo\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 9 [0207.113] GetProcAddress (hModule=0x6c810000, lpProcName="CompareTo") returned 0x6c811fad [0207.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyOrigin", cchWideChar=17, lpMultiByteStr=0x4f4f080, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyOrigin\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 17 [0207.126] GetProcAddress (hModule=0x6c810000, lpProcName="GetPropertyOrigin") returned 0x6c812409 [0207.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="InheritsFrom", cchWideChar=12, lpMultiByteStr=0x4f4f084, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InheritsFromD\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 12 [0207.146] GetProcAddress (hModule=0x6c810000, lpProcName="InheritsFrom") returned 0x6c812448 [0207.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethod", cchWideChar=9, lpMultiByteStr=0x4f4f088, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethod\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 9 [0207.148] GetProcAddress (hModule=0x6c810000, lpProcName="GetMethod") returned 0x6c81235a [0207.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutMethod", cchWideChar=9, lpMultiByteStr=0x4f4f088, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutMethod\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 9 [0207.166] GetProcAddress (hModule=0x6c810000, lpProcName="PutMethod") returned 0x6c8125fa [0207.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DeleteMethod", cchWideChar=12, lpMultiByteStr=0x4f4f084, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DeleteMethodD\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 12 [0207.189] GetProcAddress (hModule=0x6c810000, lpProcName="DeleteMethod") returned 0x6c812164 [0207.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginMethodEnumeration", cchWideChar=22, lpMultiByteStr=0x4f4f07c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginMethodEnumerationihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 22 [0207.191] GetProcAddress (hModule=0x6c810000, lpProcName="BeginMethodEnumeration") returned 0x6c811e76 [0207.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NextMethod", cchWideChar=10, lpMultiByteStr=0x4f4f088, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMethodihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 10 [0207.211] GetProcAddress (hModule=0x6c810000, lpProcName="NextMethod") returned 0x6c8124c2 [0207.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndMethodEnumeration", cchWideChar=20, lpMultiByteStr=0x4f4f07c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndMethodEnumerationD\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 20 [0207.240] GetProcAddress (hModule=0x6c810000, lpProcName="EndMethodEnumeration") returned 0x6c8121f2 [0207.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodQualifierSet", cchWideChar=21, lpMultiByteStr=0x4f4f07c, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodQualifierSet\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 21 [0207.242] GetProcAddress (hModule=0x6c810000, lpProcName="GetMethodQualifierSet") returned 0x6c81238c [0207.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodOrigin", cchWideChar=15, lpMultiByteStr=0x4f4f080, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodOrigin\x02D\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 15 [0207.244] GetProcAddress (hModule=0x6c810000, lpProcName="GetMethodOrigin") returned 0x6c812376 [0207.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Get", cchWideChar=16, lpMultiByteStr=0x4f4f080, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_GetD\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 16 [0207.308] GetProcAddress (hModule=0x6c810000, lpProcName="QualifierSet_Get") returned 0x6c81264c [0207.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Put", cchWideChar=16, lpMultiByteStr=0x4f4f080, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_PutD\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 16 [0207.330] GetProcAddress (hModule=0x6c810000, lpProcName="QualifierSet_Put") returned 0x6c81269a [0207.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Delete", cchWideChar=19, lpMultiByteStr=0x4f4f07c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Delete\x02D\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 19 [0207.360] GetProcAddress (hModule=0x6c810000, lpProcName="QualifierSet_Delete") returned 0x6c812629 [0207.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_GetNames", cchWideChar=21, lpMultiByteStr=0x4f4f07c, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_GetNames\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 21 [0207.362] GetProcAddress (hModule=0x6c810000, lpProcName="QualifierSet_GetNames") returned 0x6c812668 [0207.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_BeginEnumeration", cchWideChar=29, lpMultiByteStr=0x4f4f074, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_BeginEnumeration\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 29 [0207.380] GetProcAddress (hModule=0x6c810000, lpProcName="QualifierSet_BeginEnumeration") returned 0x6c812616 [0207.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Next", cchWideChar=17, lpMultiByteStr=0x4f4f080, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Next\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 17 [0207.381] GetProcAddress (hModule=0x6c810000, lpProcName="QualifierSet_Next") returned 0x6c81267e [0207.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_EndEnumeration", cchWideChar=27, lpMultiByteStr=0x4f4f074, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_EndEnumeration\x02D\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 27 [0207.400] GetProcAddress (hModule=0x6c810000, lpProcName="QualifierSet_EndEnumeration") returned 0x6c81263c [0207.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentApartmentType", cchWideChar=23, lpMultiByteStr=0x4f4f078, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentApartmentType\x02D\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 23 [0207.401] GetProcAddress (hModule=0x6c810000, lpProcName="GetCurrentApartmentType") returned 0x6c812435 [0207.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetDemultiplexedStub", cchWideChar=20, lpMultiByteStr=0x4f4f07c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetDemultiplexedStubD\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 20 [0207.413] GetProcAddress (hModule=0x6c810000, lpProcName="GetDemultiplexedStub") returned 0x6c812313 [0207.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateInstanceEnumWmi", cchWideChar=21, lpMultiByteStr=0x4f4f07c, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateInstanceEnumWmi\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 21 [0207.430] GetProcAddress (hModule=0x6c810000, lpProcName="CreateInstanceEnumWmi") returned 0x6c8120db [0207.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateClassEnumWmi", cchWideChar=18, lpMultiByteStr=0x4f4f080, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateClassEnumWmiihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 18 [0207.466] GetProcAddress (hModule=0x6c810000, lpProcName="CreateClassEnumWmi") returned 0x6c812065 [0207.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecQueryWmi", cchWideChar=12, lpMultiByteStr=0x4f4f084, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecQueryWmiD\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 12 [0207.467] GetProcAddress (hModule=0x6c810000, lpProcName="ExecQueryWmi") returned 0x6c81227b [0207.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecNotificationQueryWmi", cchWideChar=24, lpMultiByteStr=0x4f4f078, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecNotificationQueryWmiD\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 24 [0207.510] GetProcAddress (hModule=0x6c810000, lpProcName="ExecNotificationQueryWmi") returned 0x6c812202 [0207.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutInstanceWmi", cchWideChar=14, lpMultiByteStr=0x4f4f084, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutInstanceWmiihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 14 [0207.512] GetProcAddress (hModule=0x6c810000, lpProcName="PutInstanceWmi") returned 0x6c81257a [0207.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutClassWmi", cchWideChar=11, lpMultiByteStr=0x4f4f084, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutClassWmi\x02D\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 11 [0207.551] GetProcAddress (hModule=0x6c810000, lpProcName="PutClassWmi") returned 0x6c8124fa [0207.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloneEnumWbemClassObject", cchWideChar=24, lpMultiByteStr=0x4f4f078, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloneEnumWbemClassObjectD\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 24 [0207.554] GetProcAddress (hModule=0x6c810000, lpProcName="CloneEnumWbemClassObject") returned 0x6c811f40 [0207.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ConnectServerWmi", cchWideChar=16, lpMultiByteStr=0x4f4f080, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ConnectServerWmiD\x1aihX©,Ý «\x15lHóô\x04", lpUsedDefaultChar=0x0) returned 16 [0207.586] GetProcAddress (hModule=0x6c810000, lpProcName="ConnectServerWmi") returned 0x6c811fc3 [0207.653] CoCreateInstance (in: rclsid=0x6c811284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6c8112e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x4f4f7a4 | out: ppv=0x4f4f7a4*=0x517950) returned 0x0 [0207.654] WbemLocator:IWbemLocator:ConnectServer (in: This=0x517950, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x4f4f838 | out: ppNamespace=0x4f4f838*=0x4fb1f0) returned 0x0 [0207.700] WbemLocator:IUnknown:QueryInterface (in: This=0x4fb1f0, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f4f6d4 | out: ppvObject=0x4f4f6d4*=0x502864) returned 0x0 [0207.700] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x502864, pProxy=0x4fb1f0, pAuthnSvc=0x4f4f724, pAuthzSvc=0x4f4f720, pServerPrincName=0x4f4f718, pAuthnLevel=0x4f4f71c, pImpLevel=0x4f4f70c, pAuthInfo=0x4f4f710, pCapabilites=0x4f4f714 | out: pAuthnSvc=0x4f4f724*=0xa, pAuthzSvc=0x4f4f720*=0x0, pServerPrincName=0x4f4f718, pAuthnLevel=0x4f4f71c*=0x6, pImpLevel=0x4f4f70c*=0x2, pAuthInfo=0x4f4f710, pCapabilites=0x4f4f714*=0x1) returned 0x0 [0207.700] WbemLocator:IUnknown:Release (This=0x502864) returned 0x1 [0207.700] WbemLocator:IUnknown:QueryInterface (in: This=0x4fb1f0, riid=0x6c8110f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f4f6c8 | out: ppvObject=0x4f4f6c8*=0x502888) returned 0x0 [0207.700] WbemLocator:IUnknown:QueryInterface (in: This=0x4fb1f0, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f4f6c4 | out: ppvObject=0x4f4f6c4*=0x502864) returned 0x0 [0207.700] WbemLocator:IClientSecurity:SetBlanket (This=0x502864, pProxy=0x4fb1f0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0207.701] WbemLocator:IUnknown:Release (This=0x502864) returned 0x2 [0207.701] WbemLocator:IUnknown:Release (This=0x502888) returned 0x1 [0207.701] CoTaskMemFree (pv=0x503880) [0207.701] WbemLocator:IUnknown:Release (This=0x517950) returned 0x0 [0207.701] WbemLocator:IUnknown:QueryInterface (in: This=0x4fb1f0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f4f2c4 | out: ppvObject=0x4f4f2c4*=0x502888) returned 0x0 [0207.701] WbemLocator:IUnknown:QueryInterface (in: This=0x502888, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4f4f280 | out: ppvObject=0x4f4f280*=0x0) returned 0x80004002 [0207.702] WbemLocator:IUnknown:QueryInterface (in: This=0x502888, riid=0x6c29fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4f4f09c | out: ppvObject=0x4f4f09c*=0x0) returned 0x80004002 [0207.703] WbemLocator:IUnknown:QueryInterface (in: This=0x4fb1f0, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4f4ee74 | out: ppvObject=0x4f4ee74*=0x0) returned 0x80004002 [0207.703] WbemLocator:IUnknown:AddRef (This=0x502888) returned 0x3 [0207.704] WbemLocator:IUnknown:QueryInterface (in: This=0x502888, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4f4ebdc | out: ppvObject=0x4f4ebdc*=0x0) returned 0x80004002 [0207.704] WbemLocator:IUnknown:QueryInterface (in: This=0x502888, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4f4eb8c | out: ppvObject=0x4f4eb8c*=0x0) returned 0x80004002 [0207.704] WbemLocator:IUnknown:QueryInterface (in: This=0x502888, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f4eb98 | out: ppvObject=0x4f4eb98*=0x5027e4) returned 0x0 [0207.704] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5027e4, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4f4eba0 | out: pCid=0x4f4eba0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0207.704] WbemLocator:IUnknown:Release (This=0x5027e4) returned 0x3 [0207.704] CoGetContextToken (in: pToken=0x4f4ebf8 | out: pToken=0x4f4ebf8) returned 0x0 [0207.705] CoGetContextToken (in: pToken=0x4f4f000 | out: pToken=0x4f4f000) returned 0x0 [0207.705] WbemLocator:IUnknown:QueryInterface (in: This=0x502888, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f4f090 | out: ppvObject=0x4f4f090*=0x50286c) returned 0x0 [0207.706] WbemLocator:IRpcOptions:Query (in: This=0x50286c, pPrx=0x502888, dwProperty=2, pdwValue=0x4f4f0b8 | out: pdwValue=0x4f4f0b8) returned 0x80004002 [0207.706] WbemLocator:IUnknown:Release (This=0x50286c) returned 0x3 [0207.706] WbemLocator:IUnknown:Release (This=0x502888) returned 0x2 [0207.706] CoGetContextToken (in: pToken=0x4f4f5d8 | out: pToken=0x4f4f5d8) returned 0x0 [0207.706] CoGetContextToken (in: pToken=0x4f4f538 | out: pToken=0x4f4f538) returned 0x0 [0207.706] WbemLocator:IUnknown:QueryInterface (in: This=0x502888, riid=0x4f4f608*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x4f4f604 | out: ppvObject=0x4f4f604*=0x4fb1f0) returned 0x0 [0207.706] WbemLocator:IUnknown:AddRef (This=0x4fb1f0) returned 0x4 [0207.706] WbemLocator:IUnknown:Release (This=0x4fb1f0) returned 0x3 [0207.706] WbemLocator:IUnknown:Release (This=0x4fb1f0) returned 0x2 [0207.716] SysStringLen (param_1=0x0) returned 0x0 [0207.717] CoUninitialize () Thread: id = 133 os_tid = 0x132c [0207.742] CoGetContextToken (in: pToken=0x4f4f26c | out: pToken=0x4f4f26c) returned 0x0 [0207.742] CoGetContextToken (in: pToken=0x4f4f25c | out: pToken=0x4f4f25c) returned 0x0 [0207.743] CoGetMarshalSizeMax (in: pulSize=0x4f4f218, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x502888, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x4f4f218) returned 0x0 [0207.745] CoMarshalInterface (pStm=0x4f5660, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x502888, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0220.108] CoGetContextToken (in: pToken=0x4f4f26c | out: pToken=0x4f4f26c) returned 0x0 [0220.109] CoGetContextToken (in: pToken=0x4f4f25c | out: pToken=0x4f4f25c) returned 0x0 [0220.109] CoGetMarshalSizeMax (in: pulSize=0x4f4f218, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x502f88, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x4f4f218) returned 0x0 [0220.109] CoMarshalInterface (pStm=0x4f55a0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x502f88, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0229.637] CoGetContextToken (in: pToken=0x4f4f26c | out: pToken=0x4f4f26c) returned 0x0 [0229.637] CoGetContextToken (in: pToken=0x4f4f25c | out: pToken=0x4f4f25c) returned 0x0 [0229.637] CoGetMarshalSizeMax (in: pulSize=0x4f4f218, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x502088, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x4f4f218) returned 0x0 [0229.637] CoMarshalInterface (pStm=0x553ca8, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x502088, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0229.888] CoGetContextToken (in: pToken=0x4f4f26c | out: pToken=0x4f4f26c) returned 0x0 [0229.888] CoGetContextToken (in: pToken=0x4f4f25c | out: pToken=0x4f4f25c) returned 0x0 [0229.888] CoGetMarshalSizeMax (in: pulSize=0x4f4f218, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x501488, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x4f4f218) returned 0x0 [0229.889] CoMarshalInterface (pStm=0x553b48, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x501488, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0289.260] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x4f4fc6c | out: pperrinfo=0x4f4fc6c*=0x0) returned 0x1 Thread: id = 135 os_tid = 0xed8 [0220.066] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0220.066] RoInitialize () returned 0x1 [0220.066] RoUninitialize () returned 0x0 [0220.067] CoGetClassObject (in: rclsid=0x50692c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c2154e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x508f490 | out: ppv=0x508f490*=0x4f00e8) returned 0x0 [0220.068] WbemLocator:IUnknown:QueryInterface (in: This=0x4f00e8, riid=0x6c1c95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x508f6a8 | out: ppvObject=0x508f6a8*=0x0) returned 0x80004002 [0220.068] WbemLocator:IClassFactory:CreateInstance (in: This=0x4f00e8, pUnkOuter=0x0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508f6bc | out: ppvObject=0x508f6bc*=0x517860) returned 0x0 [0220.068] WbemLocator:IUnknown:Release (This=0x4f00e8) returned 0x0 [0220.068] WbemLocator:IUnknown:QueryInterface (in: This=0x517860, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508f2dc | out: ppvObject=0x508f2dc*=0x517860) returned 0x0 [0220.068] WbemLocator:IUnknown:QueryInterface (in: This=0x517860, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x508f298 | out: ppvObject=0x508f298*=0x0) returned 0x80004002 [0220.068] WbemLocator:IUnknown:QueryInterface (in: This=0x517860, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x508ee8c | out: ppvObject=0x508ee8c*=0x0) returned 0x80004002 [0220.068] WbemLocator:IUnknown:AddRef (This=0x517860) returned 0x3 [0220.068] WbemLocator:IUnknown:QueryInterface (in: This=0x517860, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x508ebf4 | out: ppvObject=0x508ebf4*=0x0) returned 0x80004002 [0220.068] WbemLocator:IUnknown:QueryInterface (in: This=0x517860, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x508eba4 | out: ppvObject=0x508eba4*=0x0) returned 0x80004002 [0220.069] WbemLocator:IUnknown:QueryInterface (in: This=0x517860, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508ebb0 | out: ppvObject=0x508ebb0*=0x0) returned 0x80004002 [0220.069] CoGetContextToken (in: pToken=0x508ec10 | out: pToken=0x508ec10) returned 0x0 [0220.070] CoGetContextToken (in: pToken=0x508f018 | out: pToken=0x508f018) returned 0x0 [0220.070] WbemLocator:IUnknown:QueryInterface (in: This=0x517860, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508f0a8 | out: ppvObject=0x508f0a8*=0x0) returned 0x80004002 [0220.070] WbemLocator:IUnknown:Release (This=0x517860) returned 0x2 [0220.070] WbemLocator:IUnknown:Release (This=0x517860) returned 0x1 [0220.071] CoGetContextToken (in: pToken=0x508f688 | out: pToken=0x508f688) returned 0x0 [0220.071] CoGetContextToken (in: pToken=0x508f5e8 | out: pToken=0x508f5e8) returned 0x0 [0220.071] WbemLocator:IUnknown:QueryInterface (in: This=0x517860, riid=0x508f6b8*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x508f6b4 | out: ppvObject=0x508f6b4*=0x517860) returned 0x0 [0220.071] WbemLocator:IUnknown:AddRef (This=0x517860) returned 0x3 [0220.071] WbemLocator:IUnknown:Release (This=0x517860) returned 0x2 [0220.071] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0418, puCount=0x508f84c | out: puCount=0x508f84c*=0x2) returned 0x0 [0220.071] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=8, puBuffLength=0x508f848*=0x0, pszText=0x0 | out: puBuffLength=0x508f848*=0xf, pszText=0x0) returned 0x0 [0220.071] WbemDefPath:IWbemPath:GetText (in: This=0x4e0418, lFlags=8, puBuffLength=0x508f848*=0xf, pszText="00000000000000" | out: puBuffLength=0x508f848*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0220.071] CoCreateInstance (in: rclsid=0x6c811284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6c8112e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x508f724 | out: ppv=0x508f724*=0x517790) returned 0x0 [0220.071] WbemLocator:IWbemLocator:ConnectServer (in: This=0x517790, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x508f7b8 | out: ppNamespace=0x508f7b8*=0x4fba60) returned 0x0 [0220.095] WbemLocator:IUnknown:QueryInterface (in: This=0x4fba60, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508f654 | out: ppvObject=0x508f654*=0x502f64) returned 0x0 [0220.095] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x502f64, pProxy=0x4fba60, pAuthnSvc=0x508f6a4, pAuthzSvc=0x508f6a0, pServerPrincName=0x508f698, pAuthnLevel=0x508f69c, pImpLevel=0x508f68c, pAuthInfo=0x508f690, pCapabilites=0x508f694 | out: pAuthnSvc=0x508f6a4*=0xa, pAuthzSvc=0x508f6a0*=0x0, pServerPrincName=0x508f698, pAuthnLevel=0x508f69c*=0x6, pImpLevel=0x508f68c*=0x2, pAuthInfo=0x508f690, pCapabilites=0x508f694*=0x1) returned 0x0 [0220.095] WbemLocator:IUnknown:Release (This=0x502f64) returned 0x1 [0220.095] WbemLocator:IUnknown:QueryInterface (in: This=0x4fba60, riid=0x6c8110f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508f648 | out: ppvObject=0x508f648*=0x502f88) returned 0x0 [0220.095] WbemLocator:IUnknown:QueryInterface (in: This=0x4fba60, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508f644 | out: ppvObject=0x508f644*=0x502f64) returned 0x0 [0220.095] WbemLocator:IClientSecurity:SetBlanket (This=0x502f64, pProxy=0x4fba60, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0220.096] WbemLocator:IUnknown:Release (This=0x502f64) returned 0x2 [0220.096] WbemLocator:IUnknown:Release (This=0x502f88) returned 0x1 [0220.096] CoTaskMemFree (pv=0x503850) [0220.096] WbemLocator:IUnknown:Release (This=0x517790) returned 0x0 [0220.096] WbemLocator:IUnknown:QueryInterface (in: This=0x4fba60, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508f244 | out: ppvObject=0x508f244*=0x502f88) returned 0x0 [0220.096] WbemLocator:IUnknown:QueryInterface (in: This=0x502f88, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x508f200 | out: ppvObject=0x508f200*=0x0) returned 0x80004002 [0220.097] WbemLocator:IUnknown:QueryInterface (in: This=0x502f88, riid=0x6c29fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x508f01c | out: ppvObject=0x508f01c*=0x0) returned 0x80004002 [0220.099] WbemLocator:IUnknown:QueryInterface (in: This=0x4fba60, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x508edf4 | out: ppvObject=0x508edf4*=0x0) returned 0x80004002 [0220.100] WbemLocator:IUnknown:AddRef (This=0x502f88) returned 0x3 [0220.100] WbemLocator:IUnknown:QueryInterface (in: This=0x502f88, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x508eb5c | out: ppvObject=0x508eb5c*=0x0) returned 0x80004002 [0220.100] WbemLocator:IUnknown:QueryInterface (in: This=0x502f88, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x508eb0c | out: ppvObject=0x508eb0c*=0x0) returned 0x80004002 [0220.100] WbemLocator:IUnknown:QueryInterface (in: This=0x502f88, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508eb18 | out: ppvObject=0x508eb18*=0x502ee4) returned 0x0 [0220.100] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x502ee4, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x508eb20 | out: pCid=0x508eb20*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0220.100] WbemLocator:IUnknown:Release (This=0x502ee4) returned 0x3 [0220.100] CoGetContextToken (in: pToken=0x508eb78 | out: pToken=0x508eb78) returned 0x0 [0220.100] CoGetContextToken (in: pToken=0x508ef80 | out: pToken=0x508ef80) returned 0x0 [0220.100] WbemLocator:IUnknown:QueryInterface (in: This=0x502f88, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508f010 | out: ppvObject=0x508f010*=0x502f6c) returned 0x0 [0220.100] WbemLocator:IRpcOptions:Query (in: This=0x502f6c, pPrx=0x502f88, dwProperty=2, pdwValue=0x508f038 | out: pdwValue=0x508f038) returned 0x80004002 [0220.100] WbemLocator:IUnknown:Release (This=0x502f6c) returned 0x3 [0220.100] WbemLocator:IUnknown:Release (This=0x502f88) returned 0x2 [0220.100] CoGetContextToken (in: pToken=0x508f558 | out: pToken=0x508f558) returned 0x0 [0220.100] CoGetContextToken (in: pToken=0x508f4b8 | out: pToken=0x508f4b8) returned 0x0 [0220.100] WbemLocator:IUnknown:QueryInterface (in: This=0x502f88, riid=0x508f588*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x508f584 | out: ppvObject=0x508f584*=0x4fba60) returned 0x0 [0220.101] WbemLocator:IUnknown:AddRef (This=0x4fba60) returned 0x4 [0220.101] WbemLocator:IUnknown:Release (This=0x4fba60) returned 0x3 [0220.101] WbemLocator:IUnknown:Release (This=0x4fba60) returned 0x2 [0220.101] SysStringLen (param_1=0x0) returned 0x0 [0220.101] CoUninitialize () Thread: id = 140 os_tid = 0xc88 [0220.834] CoGetContextToken (in: pToken=0x4fcfebc | out: pToken=0x4fcfebc) returned 0x0 [0220.834] IUnknown:QueryInterface (in: This=0x4c0110, riid=0x6c1e4564*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4fcfee0 | out: ppvObject=0x4fcfee0*=0x4c011c) returned 0x0 [0220.864] IComThreadingInfo:GetCurrentThreadType (in: This=0x4c011c, pThreadType=0x4fcff0c | out: pThreadType=0x4fcff0c*=0) returned 0x0 [0220.864] IUnknown:Release (This=0x4c011c) returned 0x1 [0220.864] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0220.864] RoInitialize () returned 0x1 [0220.864] RoUninitialize () returned 0x0 Thread: id = 141 os_tid = 0x138c [0221.052] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0221.053] CoGetContextToken (in: pToken=0x512fbc4 | out: pToken=0x512fbc4) returned 0x0 [0221.054] IUnknown:QueryInterface (in: This=0x4c0110, riid=0x6c1e4564*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512fbe8 | out: ppvObject=0x512fbe8*=0x4c011c) returned 0x0 [0221.054] IComThreadingInfo:GetCurrentThreadType (in: This=0x4c011c, pThreadType=0x512fc14 | out: pThreadType=0x512fc14*=0) returned 0x0 [0221.054] IUnknown:Release (This=0x4c011c) returned 0x1 [0221.054] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0221.054] CoUninitialize () [0221.054] RoInitialize () returned 0x1 [0221.054] RoUninitialize () returned 0x0 [0221.055] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x512f8d4 | out: UnbiasedTime=0x512f8d4) returned 1 [0221.055] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x512f8c4 | out: UnbiasedTime=0x512f8c4) returned 1 [0242.768] CoUninitialize () Thread: id = 142 os_tid = 0xfc4 Thread: id = 143 os_tid = 0x1360 [0229.566] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0229.566] RoInitialize () returned 0x1 [0229.566] RoUninitialize () returned 0x0 [0229.567] CoGetClassObject (in: rclsid=0x50692c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c2154e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x532f390 | out: ppv=0x532f390*=0x549e38) returned 0x0 [0229.567] WbemLocator:IUnknown:QueryInterface (in: This=0x549e38, riid=0x6c1c95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x532f5a8 | out: ppvObject=0x532f5a8*=0x0) returned 0x80004002 [0229.567] WbemLocator:IClassFactory:CreateInstance (in: This=0x549e38, pUnkOuter=0x0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x532f5bc | out: ppvObject=0x532f5bc*=0x4e9718) returned 0x0 [0229.568] WbemLocator:IUnknown:Release (This=0x549e38) returned 0x0 [0229.568] WbemLocator:IUnknown:QueryInterface (in: This=0x4e9718, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x532f1dc | out: ppvObject=0x532f1dc*=0x4e9718) returned 0x0 [0229.568] WbemLocator:IUnknown:QueryInterface (in: This=0x4e9718, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x532f198 | out: ppvObject=0x532f198*=0x0) returned 0x80004002 [0229.568] WbemLocator:IUnknown:QueryInterface (in: This=0x4e9718, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x532ed8c | out: ppvObject=0x532ed8c*=0x0) returned 0x80004002 [0229.568] WbemLocator:IUnknown:AddRef (This=0x4e9718) returned 0x3 [0229.568] WbemLocator:IUnknown:QueryInterface (in: This=0x4e9718, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x532eaf4 | out: ppvObject=0x532eaf4*=0x0) returned 0x80004002 [0229.568] WbemLocator:IUnknown:QueryInterface (in: This=0x4e9718, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x532eaa4 | out: ppvObject=0x532eaa4*=0x0) returned 0x80004002 [0229.568] WbemLocator:IUnknown:QueryInterface (in: This=0x4e9718, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x532eab0 | out: ppvObject=0x532eab0*=0x0) returned 0x80004002 [0229.568] CoGetContextToken (in: pToken=0x532eb10 | out: pToken=0x532eb10) returned 0x0 [0229.573] CoGetContextToken (in: pToken=0x532ef18 | out: pToken=0x532ef18) returned 0x0 [0229.573] WbemLocator:IUnknown:QueryInterface (in: This=0x4e9718, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x532efa8 | out: ppvObject=0x532efa8*=0x0) returned 0x80004002 [0229.573] WbemLocator:IUnknown:Release (This=0x4e9718) returned 0x2 [0229.573] WbemLocator:IUnknown:Release (This=0x4e9718) returned 0x1 [0229.573] CoGetContextToken (in: pToken=0x532f588 | out: pToken=0x532f588) returned 0x0 [0229.573] CoGetContextToken (in: pToken=0x532f4e8 | out: pToken=0x532f4e8) returned 0x0 [0229.573] WbemLocator:IUnknown:QueryInterface (in: This=0x4e9718, riid=0x532f5b8*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x532f5b4 | out: ppvObject=0x532f5b4*=0x4e9718) returned 0x0 [0229.573] WbemLocator:IUnknown:AddRef (This=0x4e9718) returned 0x3 [0229.573] WbemLocator:IUnknown:Release (This=0x4e9718) returned 0x2 [0229.574] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0568, puCount=0x532f74c | out: puCount=0x532f74c*=0x2) returned 0x0 [0229.574] WbemDefPath:IWbemPath:GetText (in: This=0x4e0568, lFlags=8, puBuffLength=0x532f748*=0x0, pszText=0x0 | out: puBuffLength=0x532f748*=0xf, pszText=0x0) returned 0x0 [0229.574] WbemDefPath:IWbemPath:GetText (in: This=0x4e0568, lFlags=8, puBuffLength=0x532f748*=0xf, pszText="00000000000000" | out: puBuffLength=0x532f748*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.574] CoCreateInstance (in: rclsid=0x6c811284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6c8112e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x532f624 | out: ppv=0x532f624*=0x4e96b8) returned 0x0 [0229.574] WbemLocator:IWbemLocator:ConnectServer (in: This=0x4e96b8, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x532f6b8 | out: ppNamespace=0x532f6b8*=0x5484f0) returned 0x0 [0229.628] WbemLocator:IUnknown:QueryInterface (in: This=0x5484f0, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x532f554 | out: ppvObject=0x532f554*=0x502064) returned 0x0 [0229.628] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x502064, pProxy=0x5484f0, pAuthnSvc=0x532f5a4, pAuthzSvc=0x532f5a0, pServerPrincName=0x532f598, pAuthnLevel=0x532f59c, pImpLevel=0x532f58c, pAuthInfo=0x532f590, pCapabilites=0x532f594 | out: pAuthnSvc=0x532f5a4*=0xa, pAuthzSvc=0x532f5a0*=0x0, pServerPrincName=0x532f598, pAuthnLevel=0x532f59c*=0x6, pImpLevel=0x532f58c*=0x2, pAuthInfo=0x532f590, pCapabilites=0x532f594*=0x1) returned 0x0 [0229.628] WbemLocator:IUnknown:Release (This=0x502064) returned 0x1 [0229.629] WbemLocator:IUnknown:QueryInterface (in: This=0x5484f0, riid=0x6c8110f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x532f548 | out: ppvObject=0x532f548*=0x502088) returned 0x0 [0229.629] WbemLocator:IUnknown:QueryInterface (in: This=0x5484f0, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x532f544 | out: ppvObject=0x532f544*=0x502064) returned 0x0 [0229.629] WbemLocator:IClientSecurity:SetBlanket (This=0x502064, pProxy=0x5484f0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0229.629] WbemLocator:IUnknown:Release (This=0x502064) returned 0x2 [0229.629] WbemLocator:IUnknown:Release (This=0x502088) returned 0x1 [0229.629] CoTaskMemFree (pv=0x503be0) [0229.629] WbemLocator:IUnknown:Release (This=0x4e96b8) returned 0x0 [0229.629] WbemLocator:IUnknown:QueryInterface (in: This=0x5484f0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x532f144 | out: ppvObject=0x532f144*=0x502088) returned 0x0 [0229.629] WbemLocator:IUnknown:QueryInterface (in: This=0x502088, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x532f100 | out: ppvObject=0x532f100*=0x0) returned 0x80004002 [0229.630] WbemLocator:IUnknown:QueryInterface (in: This=0x502088, riid=0x6c29fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x532ef1c | out: ppvObject=0x532ef1c*=0x0) returned 0x80004002 [0229.630] WbemLocator:IUnknown:QueryInterface (in: This=0x5484f0, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x532ecf4 | out: ppvObject=0x532ecf4*=0x0) returned 0x80004002 [0229.630] WbemLocator:IUnknown:AddRef (This=0x502088) returned 0x3 [0229.630] WbemLocator:IUnknown:QueryInterface (in: This=0x502088, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x532ea5c | out: ppvObject=0x532ea5c*=0x0) returned 0x80004002 [0229.630] WbemLocator:IUnknown:QueryInterface (in: This=0x502088, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x532ea0c | out: ppvObject=0x532ea0c*=0x0) returned 0x80004002 [0229.630] WbemLocator:IUnknown:QueryInterface (in: This=0x502088, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x532ea18 | out: ppvObject=0x532ea18*=0x501fe4) returned 0x0 [0229.631] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x501fe4, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x532ea20 | out: pCid=0x532ea20*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0229.631] WbemLocator:IUnknown:Release (This=0x501fe4) returned 0x3 [0229.631] CoGetContextToken (in: pToken=0x532ea78 | out: pToken=0x532ea78) returned 0x0 [0229.631] CoGetContextToken (in: pToken=0x532ee80 | out: pToken=0x532ee80) returned 0x0 [0229.631] WbemLocator:IUnknown:QueryInterface (in: This=0x502088, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x532ef10 | out: ppvObject=0x532ef10*=0x50206c) returned 0x0 [0229.631] WbemLocator:IRpcOptions:Query (in: This=0x50206c, pPrx=0x502088, dwProperty=2, pdwValue=0x532ef38 | out: pdwValue=0x532ef38) returned 0x80004002 [0229.631] WbemLocator:IUnknown:Release (This=0x50206c) returned 0x3 [0229.631] WbemLocator:IUnknown:Release (This=0x502088) returned 0x2 [0229.631] CoGetContextToken (in: pToken=0x532f458 | out: pToken=0x532f458) returned 0x0 [0229.631] CoGetContextToken (in: pToken=0x532f3b8 | out: pToken=0x532f3b8) returned 0x0 [0229.631] WbemLocator:IUnknown:QueryInterface (in: This=0x502088, riid=0x532f488*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x532f484 | out: ppvObject=0x532f484*=0x5484f0) returned 0x0 [0229.631] WbemLocator:IUnknown:AddRef (This=0x5484f0) returned 0x4 [0229.631] WbemLocator:IUnknown:Release (This=0x5484f0) returned 0x3 [0229.631] WbemLocator:IUnknown:Release (This=0x5484f0) returned 0x2 [0229.631] SysStringLen (param_1=0x0) returned 0x0 [0229.631] CoUninitialize () Thread: id = 144 os_tid = 0x604 [0229.858] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0229.858] RoInitialize () returned 0x1 [0229.858] RoUninitialize () returned 0x0 [0229.859] CoGetClassObject (in: rclsid=0x50692c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c2154e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x532f310 | out: ppv=0x532f310*=0x54a0c0) returned 0x0 [0229.860] WbemLocator:IUnknown:QueryInterface (in: This=0x54a0c0, riid=0x6c1c95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x532f528 | out: ppvObject=0x532f528*=0x0) returned 0x80004002 [0229.860] WbemLocator:IClassFactory:CreateInstance (in: This=0x54a0c0, pUnkOuter=0x0, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x532f53c | out: ppvObject=0x532f53c*=0x4e93c8) returned 0x0 [0229.860] WbemLocator:IUnknown:Release (This=0x54a0c0) returned 0x0 [0229.860] WbemLocator:IUnknown:QueryInterface (in: This=0x4e93c8, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x532f15c | out: ppvObject=0x532f15c*=0x4e93c8) returned 0x0 [0229.860] WbemLocator:IUnknown:QueryInterface (in: This=0x4e93c8, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x532f118 | out: ppvObject=0x532f118*=0x0) returned 0x80004002 [0229.860] WbemLocator:IUnknown:QueryInterface (in: This=0x4e93c8, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x532ed0c | out: ppvObject=0x532ed0c*=0x0) returned 0x80004002 [0229.860] WbemLocator:IUnknown:AddRef (This=0x4e93c8) returned 0x3 [0229.860] WbemLocator:IUnknown:QueryInterface (in: This=0x4e93c8, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x532ea74 | out: ppvObject=0x532ea74*=0x0) returned 0x80004002 [0229.860] WbemLocator:IUnknown:QueryInterface (in: This=0x4e93c8, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x532ea24 | out: ppvObject=0x532ea24*=0x0) returned 0x80004002 [0229.860] WbemLocator:IUnknown:QueryInterface (in: This=0x4e93c8, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x532ea30 | out: ppvObject=0x532ea30*=0x0) returned 0x80004002 [0229.860] CoGetContextToken (in: pToken=0x532ea90 | out: pToken=0x532ea90) returned 0x0 [0229.861] CoGetContextToken (in: pToken=0x532ee98 | out: pToken=0x532ee98) returned 0x0 [0229.861] WbemLocator:IUnknown:QueryInterface (in: This=0x4e93c8, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x532ef28 | out: ppvObject=0x532ef28*=0x0) returned 0x80004002 [0229.861] WbemLocator:IUnknown:Release (This=0x4e93c8) returned 0x2 [0229.861] WbemLocator:IUnknown:Release (This=0x4e93c8) returned 0x1 [0229.861] CoGetContextToken (in: pToken=0x532f508 | out: pToken=0x532f508) returned 0x0 [0229.861] CoGetContextToken (in: pToken=0x532f468 | out: pToken=0x532f468) returned 0x0 [0229.861] WbemLocator:IUnknown:QueryInterface (in: This=0x4e93c8, riid=0x532f538*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x532f534 | out: ppvObject=0x532f534*=0x4e93c8) returned 0x0 [0229.861] WbemLocator:IUnknown:AddRef (This=0x4e93c8) returned 0x3 [0229.861] WbemLocator:IUnknown:Release (This=0x4e93c8) returned 0x2 [0229.861] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4e0568, puCount=0x532f6cc | out: puCount=0x532f6cc*=0x2) returned 0x0 [0229.861] WbemDefPath:IWbemPath:GetText (in: This=0x4e0568, lFlags=8, puBuffLength=0x532f6c8*=0x0, pszText=0x0 | out: puBuffLength=0x532f6c8*=0xf, pszText=0x0) returned 0x0 [0229.861] WbemDefPath:IWbemPath:GetText (in: This=0x4e0568, lFlags=8, puBuffLength=0x532f6c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x532f6c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.861] CoCreateInstance (in: rclsid=0x6c811284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6c8112e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x532f5a4 | out: ppv=0x532f5a4*=0x4e93d8) returned 0x0 [0229.861] WbemLocator:IWbemLocator:ConnectServer (in: This=0x4e93d8, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x532f638 | out: ppNamespace=0x532f638*=0x548b80) returned 0x0 [0229.882] WbemLocator:IUnknown:QueryInterface (in: This=0x548b80, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x532f4d4 | out: ppvObject=0x532f4d4*=0x501464) returned 0x0 [0229.882] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x501464, pProxy=0x548b80, pAuthnSvc=0x532f524, pAuthzSvc=0x532f520, pServerPrincName=0x532f518, pAuthnLevel=0x532f51c, pImpLevel=0x532f50c, pAuthInfo=0x532f510, pCapabilites=0x532f514 | out: pAuthnSvc=0x532f524*=0xa, pAuthzSvc=0x532f520*=0x0, pServerPrincName=0x532f518, pAuthnLevel=0x532f51c*=0x6, pImpLevel=0x532f50c*=0x2, pAuthInfo=0x532f510, pCapabilites=0x532f514*=0x1) returned 0x0 [0229.882] WbemLocator:IUnknown:Release (This=0x501464) returned 0x1 [0229.882] WbemLocator:IUnknown:QueryInterface (in: This=0x548b80, riid=0x6c8110f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x532f4c8 | out: ppvObject=0x532f4c8*=0x501488) returned 0x0 [0229.882] WbemLocator:IUnknown:QueryInterface (in: This=0x548b80, riid=0x6c811104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x532f4c4 | out: ppvObject=0x532f4c4*=0x501464) returned 0x0 [0229.882] WbemLocator:IClientSecurity:SetBlanket (This=0x501464, pProxy=0x548b80, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0229.882] WbemLocator:IUnknown:Release (This=0x501464) returned 0x2 [0229.882] WbemLocator:IUnknown:Release (This=0x501488) returned 0x1 [0229.882] CoTaskMemFree (pv=0x503d60) [0229.882] WbemLocator:IUnknown:Release (This=0x4e93d8) returned 0x0 [0229.882] WbemLocator:IUnknown:QueryInterface (in: This=0x548b80, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x532f0c4 | out: ppvObject=0x532f0c4*=0x501488) returned 0x0 [0229.882] WbemLocator:IUnknown:QueryInterface (in: This=0x501488, riid=0x6c29fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x532f080 | out: ppvObject=0x532f080*=0x0) returned 0x80004002 [0229.883] WbemLocator:IUnknown:QueryInterface (in: This=0x501488, riid=0x6c29fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x532ee9c | out: ppvObject=0x532ee9c*=0x0) returned 0x80004002 [0229.883] WbemLocator:IUnknown:QueryInterface (in: This=0x548b80, riid=0x6c2a056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x532ec74 | out: ppvObject=0x532ec74*=0x0) returned 0x80004002 [0229.884] WbemLocator:IUnknown:AddRef (This=0x501488) returned 0x3 [0229.884] WbemLocator:IUnknown:QueryInterface (in: This=0x501488, riid=0x6c2a0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x532e9dc | out: ppvObject=0x532e9dc*=0x0) returned 0x80004002 [0229.884] WbemLocator:IUnknown:QueryInterface (in: This=0x501488, riid=0x6c2a015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x532e98c | out: ppvObject=0x532e98c*=0x0) returned 0x80004002 [0229.884] WbemLocator:IUnknown:QueryInterface (in: This=0x501488, riid=0x6c1740e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x532e998 | out: ppvObject=0x532e998*=0x5013e4) returned 0x0 [0229.884] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5013e4, riid=0x6c166c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x532e9a0 | out: pCid=0x532e9a0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0229.884] WbemLocator:IUnknown:Release (This=0x5013e4) returned 0x3 [0229.884] CoGetContextToken (in: pToken=0x532e9f8 | out: pToken=0x532e9f8) returned 0x0 [0229.884] CoGetContextToken (in: pToken=0x532ee00 | out: pToken=0x532ee00) returned 0x0 [0229.884] WbemLocator:IUnknown:QueryInterface (in: This=0x501488, riid=0x6c2a0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x532ee90 | out: ppvObject=0x532ee90*=0x50146c) returned 0x0 [0229.884] WbemLocator:IRpcOptions:Query (in: This=0x50146c, pPrx=0x501488, dwProperty=2, pdwValue=0x532eeb8 | out: pdwValue=0x532eeb8) returned 0x80004002 [0229.884] WbemLocator:IUnknown:Release (This=0x50146c) returned 0x3 [0229.884] WbemLocator:IUnknown:Release (This=0x501488) returned 0x2 [0229.884] CoGetContextToken (in: pToken=0x532f3d8 | out: pToken=0x532f3d8) returned 0x0 [0229.885] CoGetContextToken (in: pToken=0x532f338 | out: pToken=0x532f338) returned 0x0 [0229.885] WbemLocator:IUnknown:QueryInterface (in: This=0x501488, riid=0x532f408*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x532f404 | out: ppvObject=0x532f404*=0x548b80) returned 0x0 [0229.885] WbemLocator:IUnknown:AddRef (This=0x548b80) returned 0x4 [0229.885] WbemLocator:IUnknown:Release (This=0x548b80) returned 0x3 [0229.885] WbemLocator:IUnknown:Release (This=0x548b80) returned 0x2 [0229.885] SysStringLen (param_1=0x0) returned 0x0 [0229.885] CoUninitialize () Thread: id = 145 os_tid = 0x35c [0232.568] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0232.568] RoInitialize () returned 0x1 [0232.569] RoUninitialize () returned 0x0 [0232.570] ResetEvent (hEvent=0x248) returned 1 [0283.509] ReleaseSemaphore (in: hSemaphore=0x53c, lReleaseCount=1, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0283.510] ReleaseSemaphore (in: hSemaphore=0x53c, lReleaseCount=1, lpPreviousCount=0x0 | out: lpPreviousCount=0x0) returned 1 [0283.510] SetEvent (hEvent=0x248) returned 1 Thread: id = 146 os_tid = 0x3ac Thread: id = 148 os_tid = 0xf9c [0250.905] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0250.906] CoGetContextToken (in: pToken=0x512f9c4 | out: pToken=0x512f9c4) returned 0x0 [0250.907] IUnknown:QueryInterface (in: This=0x4c0110, riid=0x6c1e4564*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x512f9e8 | out: ppvObject=0x512f9e8*=0x4c011c) returned 0x0 [0250.907] IComThreadingInfo:GetCurrentThreadType (in: This=0x4c011c, pThreadType=0x512fa14 | out: pThreadType=0x512fa14*=0) returned 0x0 [0250.907] IUnknown:Release (This=0x4c011c) returned 0x1 [0250.907] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0250.907] CoUninitialize () [0250.907] RoInitialize () returned 0x1 [0250.907] RoUninitialize () returned 0x0 [0250.908] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x512f6d4 | out: UnbiasedTime=0x512f6d4) returned 1 [0250.909] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x512f6c4 | out: UnbiasedTime=0x512f6c4) returned 1 [0250.912] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x512f5c8 | out: lpSystemTimeAsFileTime=0x512f5c8*(dwLowDateTime=0xfec03d37, dwHighDateTime=0x1d86049)) [0251.011] GetLastInputInfo (in: plii=0x217a178 | out: plii=0x217a178*(cbSize=0x8, dwTime=0x1d93f9c)) returned 1 [0271.107] CoUninitialize () Thread: id = 149 os_tid = 0x10ec Thread: id = 150 os_tid = 0x10f0 [0251.016] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0251.017] CoGetContextToken (in: pToken=0x582f944 | out: pToken=0x582f944) returned 0x0 [0251.017] IUnknown:QueryInterface (in: This=0x4c0110, riid=0x6c1e4564*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x582f968 | out: ppvObject=0x582f968*=0x4c011c) returned 0x0 [0251.017] IComThreadingInfo:GetCurrentThreadType (in: This=0x4c011c, pThreadType=0x582f994 | out: pThreadType=0x582f994*=0) returned 0x0 [0251.017] IUnknown:Release (This=0x4c011c) returned 0x1 [0251.017] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0251.017] CoUninitialize () [0251.017] RoInitialize () returned 0x1 [0251.017] RoUninitialize () returned 0x0 [0271.059] CoUninitialize () Thread: id = 151 os_tid = 0x126c [0280.943] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0280.945] CoGetContextToken (in: pToken=0x75f8c4 | out: pToken=0x75f8c4) returned 0x0 [0280.945] IUnknown:QueryInterface (in: This=0x4c0110, riid=0x6c1e4564*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x75f8e8 | out: ppvObject=0x75f8e8*=0x4c011c) returned 0x0 [0280.945] IComThreadingInfo:GetCurrentThreadType (in: This=0x4c011c, pThreadType=0x75f914 | out: pThreadType=0x75f914*=0) returned 0x0 [0280.946] IUnknown:Release (This=0x4c011c) returned 0x1 [0280.946] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0280.946] CoUninitialize () [0280.946] RoInitialize () returned 0x1 [0280.946] RoUninitialize () returned 0x0 [0280.947] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x75f5d4 | out: UnbiasedTime=0x75f5d4) returned 1 [0280.947] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x75f5c4 | out: UnbiasedTime=0x75f5c4) returned 1 [0280.948] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x75f4c8 | out: lpSystemTimeAsFileTime=0x75f4c8*(dwLowDateTime=0x10a7577d, dwHighDateTime=0x1d8604a)) [0280.949] GetLastInputInfo (in: plii=0x217a178 | out: plii=0x217a178*(cbSize=0x8, dwTime=0x1d9b2b9)) returned 1 [0300.966] CoUninitialize () Thread: id = 152 os_tid = 0x1270 Thread: id = 153 os_tid = 0x1284 [0280.955] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0280.956] CoGetContextToken (in: pToken=0x57af844 | out: pToken=0x57af844) returned 0x0 [0280.956] IUnknown:QueryInterface (in: This=0x4c0110, riid=0x6c1e4564*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x57af868 | out: ppvObject=0x57af868*=0x4c011c) returned 0x0 [0280.956] IComThreadingInfo:GetCurrentThreadType (in: This=0x4c011c, pThreadType=0x57af894 | out: pThreadType=0x57af894*=0) returned 0x0 [0280.956] IUnknown:Release (This=0x4c011c) returned 0x1 [0280.956] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0280.956] CoUninitialize () [0280.956] RoInitialize () returned 0x1 [0280.956] RoUninitialize () returned 0x0 [0301.028] CoUninitialize () Thread: id = 154 os_tid = 0x12dc [0310.967] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0310.968] CoGetContextToken (in: pToken=0x75f7c4 | out: pToken=0x75f7c4) returned 0x0 [0310.968] IUnknown:QueryInterface (in: This=0x4c0110, riid=0x6c1e4564*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x75f7e8 | out: ppvObject=0x75f7e8*=0x4c011c) returned 0x0 [0310.969] IComThreadingInfo:GetCurrentThreadType (in: This=0x4c011c, pThreadType=0x75f814 | out: pThreadType=0x75f814*=0) returned 0x0 [0310.969] IUnknown:Release (This=0x4c011c) returned 0x1 [0310.969] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0310.969] CoUninitialize () [0310.969] RoInitialize () returned 0x1 [0310.969] RoUninitialize () returned 0x0 [0310.970] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x75f4d4 | out: UnbiasedTime=0x75f4d4) returned 1 [0310.970] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x75f4c4 | out: UnbiasedTime=0x75f4c4) returned 1 [0310.971] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x75f3c8 | out: lpSystemTimeAsFileTime=0x75f3c8*(dwLowDateTime=0x228c87e8, dwHighDateTime=0x1d8604a)) [0310.972] GetLastInputInfo (in: plii=0x217a178 | out: plii=0x217a178*(cbSize=0x8, dwTime=0x1da29fc)) returned 1 Thread: id = 155 os_tid = 0x12f0 Process: id = "3" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x7534a000" os_pid = "0x364" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x214" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000ac37" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 767 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 768 start_va = 0x20000 end_va = 0x21fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 769 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 770 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 771 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 772 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 773 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 774 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 775 start_va = 0x110000 end_va = 0x116fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 776 start_va = 0x120000 end_va = 0x120fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 777 start_va = 0x140000 end_va = 0x140fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usocore.dll.mui" filename = "\\Windows\\System32\\en-US\\usocore.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\usocore.dll.mui") Region: id = 778 start_va = 0x150000 end_va = 0x151fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 779 start_va = 0x160000 end_va = 0x161fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 780 start_va = 0x170000 end_va = 0x176fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 781 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 782 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 783 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 784 start_va = 0x1b0000 end_va = 0x1b6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 785 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 786 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 787 start_va = 0x1f0000 end_va = 0x1f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 788 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 789 start_va = 0x400000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 790 start_va = 0x500000 end_va = 0x5bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 791 start_va = 0x5c0000 end_va = 0x747fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 792 start_va = 0x750000 end_va = 0x750fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000750000" filename = "" Region: id = 793 start_va = 0x760000 end_va = 0x760fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000760000" filename = "" Region: id = 794 start_va = 0x770000 end_va = 0x773fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 795 start_va = 0x780000 end_va = 0x783fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 796 start_va = 0x790000 end_va = 0x796fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 797 start_va = 0x7a0000 end_va = 0x7e4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000005.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db") Region: id = 798 start_va = 0x800000 end_va = 0x8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 799 start_va = 0x900000 end_va = 0xa80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000900000" filename = "" Region: id = 800 start_va = 0xa90000 end_va = 0xb4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a90000" filename = "" Region: id = 801 start_va = 0xb50000 end_va = 0xf4afff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b50000" filename = "" Region: id = 802 start_va = 0xf50000 end_va = 0xfcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f50000" filename = "" Region: id = 803 start_va = 0xfd0000 end_va = 0x104ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fd0000" filename = "" Region: id = 804 start_va = 0x1080000 end_va = 0x1097fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001080000" filename = "" Region: id = 805 start_va = 0x10b0000 end_va = 0x10b6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010b0000" filename = "" Region: id = 806 start_va = 0x10d0000 end_va = 0x10d6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010d0000" filename = "" Region: id = 807 start_va = 0x1100000 end_va = 0x1106fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001100000" filename = "" Region: id = 808 start_va = 0x1110000 end_va = 0x118ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001110000" filename = "" Region: id = 809 start_va = 0x1190000 end_va = 0x11defff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001190000" filename = "" Region: id = 810 start_va = 0x1200000 end_va = 0x12fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001200000" filename = "" Region: id = 811 start_va = 0x1300000 end_va = 0x137ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001300000" filename = "" Region: id = 812 start_va = 0x1380000 end_va = 0x13fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001380000" filename = "" Region: id = 813 start_va = 0x1400000 end_va = 0x14fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001400000" filename = "" Region: id = 814 start_va = 0x1500000 end_va = 0x15fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001500000" filename = "" Region: id = 815 start_va = 0x1600000 end_va = 0x1936fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 816 start_va = 0x1940000 end_va = 0x1a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001940000" filename = "" Region: id = 817 start_va = 0x1a40000 end_va = 0x1b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a40000" filename = "" Region: id = 818 start_va = 0x1b40000 end_va = 0x1c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b40000" filename = "" Region: id = 819 start_va = 0x1c40000 end_va = 0x1ccdfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 820 start_va = 0x1d40000 end_va = 0x1e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d40000" filename = "" Region: id = 821 start_va = 0x1e40000 end_va = 0x1f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 822 start_va = 0x1f40000 end_va = 0x203ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f40000" filename = "" Region: id = 823 start_va = 0x2100000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 824 start_va = 0x2200000 end_va = 0x22fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 825 start_va = 0x2300000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 826 start_va = 0x2400000 end_va = 0x24fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 827 start_va = 0x2500000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 828 start_va = 0x2600000 end_va = 0x26fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 829 start_va = 0x2700000 end_va = 0x27fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002700000" filename = "" Region: id = 830 start_va = 0x2800000 end_va = 0x28fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002800000" filename = "" Region: id = 831 start_va = 0x2900000 end_va = 0x29fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 832 start_va = 0x2a00000 end_va = 0x2afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 833 start_va = 0x2b00000 end_va = 0x2bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b00000" filename = "" Region: id = 834 start_va = 0x2c00000 end_va = 0x2cdffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 835 start_va = 0x2ce0000 end_va = 0x2ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ce0000" filename = "" Region: id = 836 start_va = 0x2de0000 end_va = 0x2edffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002de0000" filename = "" Region: id = 837 start_va = 0x2ef0000 end_va = 0x2ef6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ef0000" filename = "" Region: id = 838 start_va = 0x2f00000 end_va = 0x2ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f00000" filename = "" Region: id = 839 start_va = 0x3000000 end_va = 0x30fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 840 start_va = 0x3100000 end_va = 0x317ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003100000" filename = "" Region: id = 841 start_va = 0x3180000 end_va = 0x31fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003180000" filename = "" Region: id = 842 start_va = 0x3210000 end_va = 0x330ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003210000" filename = "" Region: id = 843 start_va = 0x3310000 end_va = 0x340ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003310000" filename = "" Region: id = 844 start_va = 0x3610000 end_va = 0x370ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003610000" filename = "" Region: id = 845 start_va = 0x3710000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003710000" filename = "" Region: id = 846 start_va = 0x3900000 end_va = 0x39fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003900000" filename = "" Region: id = 847 start_va = 0x3a00000 end_va = 0x3afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a00000" filename = "" Region: id = 848 start_va = 0x3b00000 end_va = 0x3bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b00000" filename = "" Region: id = 849 start_va = 0x3c00000 end_va = 0x3cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003c00000" filename = "" Region: id = 850 start_va = 0x3d00000 end_va = 0x3dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003d00000" filename = "" Region: id = 851 start_va = 0x3e00000 end_va = 0x3efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e00000" filename = "" Region: id = 852 start_va = 0x3f00000 end_va = 0x3ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f00000" filename = "" Region: id = 853 start_va = 0x4000000 end_va = 0x40fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004000000" filename = "" Region: id = 854 start_va = 0x4100000 end_va = 0x41fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004100000" filename = "" Region: id = 855 start_va = 0x4200000 end_va = 0x42fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004200000" filename = "" Region: id = 856 start_va = 0x4300000 end_va = 0x43fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004300000" filename = "" Region: id = 857 start_va = 0x4400000 end_va = 0x44fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004400000" filename = "" Region: id = 858 start_va = 0x4500000 end_va = 0x45fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004500000" filename = "" Region: id = 859 start_va = 0x4600000 end_va = 0x46fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004600000" filename = "" Region: id = 860 start_va = 0x4700000 end_va = 0x47fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004700000" filename = "" Region: id = 861 start_va = 0x4800000 end_va = 0x48fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004800000" filename = "" Region: id = 862 start_va = 0x4900000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004900000" filename = "" Region: id = 863 start_va = 0x4a00000 end_va = 0x4afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a00000" filename = "" Region: id = 864 start_va = 0x4b00000 end_va = 0x4bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 865 start_va = 0x4c00000 end_va = 0x4cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c00000" filename = "" Region: id = 866 start_va = 0x4d00000 end_va = 0x4d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 867 start_va = 0x4e90000 end_va = 0x4e91fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "activeds.dll.mui" filename = "\\Windows\\System32\\en-US\\activeds.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\activeds.dll.mui") Region: id = 868 start_va = 0x4eb0000 end_va = 0x4eb0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004eb0000" filename = "" Region: id = 869 start_va = 0x4ec0000 end_va = 0x4ec4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll" filename = "\\Windows\\System32\\winnlsres.dll" (normalized: "c:\\windows\\system32\\winnlsres.dll") Region: id = 870 start_va = 0x4ee0000 end_va = 0x4eeffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll.mui" filename = "\\Windows\\System32\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winnlsres.dll.mui") Region: id = 871 start_va = 0x4ef0000 end_va = 0x4f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ef0000" filename = "" Region: id = 872 start_va = 0x50f0000 end_va = 0x51effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050f0000" filename = "" Region: id = 873 start_va = 0x5200000 end_va = 0x52fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005200000" filename = "" Region: id = 874 start_va = 0x5300000 end_va = 0x53fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005300000" filename = "" Region: id = 875 start_va = 0x5400000 end_va = 0x54fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005400000" filename = "" Region: id = 876 start_va = 0x5500000 end_va = 0x55fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005500000" filename = "" Region: id = 877 start_va = 0x5620000 end_va = 0x5630fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1256.nls" filename = "\\Windows\\System32\\C_1256.NLS" (normalized: "c:\\windows\\system32\\c_1256.nls") Region: id = 878 start_va = 0x5640000 end_va = 0x5650fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1251.nls" filename = "\\Windows\\System32\\C_1251.NLS" (normalized: "c:\\windows\\system32\\c_1251.nls") Region: id = 879 start_va = 0x5660000 end_va = 0x5670fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1254.nls" filename = "\\Windows\\System32\\C_1254.NLS" (normalized: "c:\\windows\\system32\\c_1254.nls") Region: id = 880 start_va = 0x5680000 end_va = 0x5690fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1250.nls" filename = "\\Windows\\System32\\C_1250.NLS" (normalized: "c:\\windows\\system32\\c_1250.nls") Region: id = 881 start_va = 0x56a0000 end_va = 0x56b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1253.nls" filename = "\\Windows\\System32\\C_1253.NLS" (normalized: "c:\\windows\\system32\\c_1253.nls") Region: id = 882 start_va = 0x56c0000 end_va = 0x56d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1257.nls" filename = "\\Windows\\System32\\C_1257.NLS" (normalized: "c:\\windows\\system32\\c_1257.nls") Region: id = 883 start_va = 0x56f0000 end_va = 0x56f6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000056f0000" filename = "" Region: id = 884 start_va = 0x5700000 end_va = 0x57fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005700000" filename = "" Region: id = 885 start_va = 0x5800000 end_va = 0x58fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005800000" filename = "" Region: id = 886 start_va = 0x5900000 end_va = 0x59fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005900000" filename = "" Region: id = 887 start_va = 0x5a00000 end_va = 0x5a10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1255.nls" filename = "\\Windows\\System32\\C_1255.NLS" (normalized: "c:\\windows\\system32\\c_1255.nls") Region: id = 888 start_va = 0x5a20000 end_va = 0x5a30fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_874.nls" filename = "\\Windows\\System32\\C_874.NLS" (normalized: "c:\\windows\\system32\\c_874.nls") Region: id = 889 start_va = 0x5a40000 end_va = 0x5abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a40000" filename = "" Region: id = 890 start_va = 0x5ad0000 end_va = 0x5b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ad0000" filename = "" Region: id = 891 start_va = 0x5b50000 end_va = 0x5bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 892 start_va = 0x5bd0000 end_va = 0x5bd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005bd0000" filename = "" Region: id = 893 start_va = 0x5be0000 end_va = 0x5bf0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1258.nls" filename = "\\Windows\\System32\\C_1258.NLS" (normalized: "c:\\windows\\system32\\c_1258.nls") Region: id = 894 start_va = 0x5c10000 end_va = 0x5c37fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_932.nls" filename = "\\Windows\\System32\\C_932.NLS" (normalized: "c:\\windows\\system32\\c_932.nls") Region: id = 895 start_va = 0x5c40000 end_va = 0x5c70fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_949.nls" filename = "\\Windows\\System32\\C_949.NLS" (normalized: "c:\\windows\\system32\\c_949.nls") Region: id = 896 start_va = 0x5c80000 end_va = 0x5cb0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_936.nls" filename = "\\Windows\\System32\\C_936.NLS" (normalized: "c:\\windows\\system32\\c_936.nls") Region: id = 897 start_va = 0x5cc0000 end_va = 0x5cf0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_950.nls" filename = "\\Windows\\System32\\C_950.NLS" (normalized: "c:\\windows\\system32\\c_950.nls") Region: id = 898 start_va = 0x5d10000 end_va = 0x5e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d10000" filename = "" Region: id = 899 start_va = 0x5f10000 end_va = 0x5f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 900 start_va = 0x5f90000 end_va = 0x608ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f90000" filename = "" Region: id = 901 start_va = 0x6090000 end_va = 0x610ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006090000" filename = "" Region: id = 902 start_va = 0x6110000 end_va = 0x620ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006110000" filename = "" Region: id = 903 start_va = 0x6210000 end_va = 0x630ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006210000" filename = "" Region: id = 904 start_va = 0x6310000 end_va = 0x640ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006310000" filename = "" Region: id = 905 start_va = 0x6410000 end_va = 0x650ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006410000" filename = "" Region: id = 906 start_va = 0x6510000 end_va = 0x660ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006510000" filename = "" Region: id = 907 start_va = 0x6610000 end_va = 0x670ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006610000" filename = "" Region: id = 908 start_va = 0x6710000 end_va = 0x680ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006710000" filename = "" Region: id = 909 start_va = 0x6900000 end_va = 0x69fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006900000" filename = "" Region: id = 910 start_va = 0x6a00000 end_va = 0x6afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006a00000" filename = "" Region: id = 911 start_va = 0x6b00000 end_va = 0x6bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006b00000" filename = "" Region: id = 912 start_va = 0x6c00000 end_va = 0x6cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006c00000" filename = "" Region: id = 913 start_va = 0x6d00000 end_va = 0x6dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006d00000" filename = "" Region: id = 914 start_va = 0x6e00000 end_va = 0x6efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006e00000" filename = "" Region: id = 915 start_va = 0x6f00000 end_va = 0x6ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006f00000" filename = "" Region: id = 916 start_va = 0x7000000 end_va = 0x70fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007000000" filename = "" Region: id = 917 start_va = 0x7200000 end_va = 0x72fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007200000" filename = "" Region: id = 918 start_va = 0x7300000 end_va = 0x73fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007300000" filename = "" Region: id = 919 start_va = 0x7400000 end_va = 0x74fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007400000" filename = "" Region: id = 920 start_va = 0x7500000 end_va = 0x75fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007500000" filename = "" Region: id = 921 start_va = 0x7600000 end_va = 0x76fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007600000" filename = "" Region: id = 922 start_va = 0x7720000 end_va = 0x781ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007720000" filename = "" Region: id = 923 start_va = 0x7820000 end_va = 0x791ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007820000" filename = "" Region: id = 924 start_va = 0x7920000 end_va = 0x7a1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007920000" filename = "" Region: id = 925 start_va = 0x7a20000 end_va = 0x7b1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007a20000" filename = "" Region: id = 926 start_va = 0x7b20000 end_va = 0x7c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007b20000" filename = "" Region: id = 927 start_va = 0x7c20000 end_va = 0x7d1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c20000" filename = "" Region: id = 928 start_va = 0x7d20000 end_va = 0x7e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007d20000" filename = "" Region: id = 929 start_va = 0x7e20000 end_va = 0x7f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007e20000" filename = "" Region: id = 930 start_va = 0x7f20000 end_va = 0x801ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007f20000" filename = "" Region: id = 931 start_va = 0x8020000 end_va = 0x811ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008020000" filename = "" Region: id = 932 start_va = 0x8120000 end_va = 0x821ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008120000" filename = "" Region: id = 933 start_va = 0x8400000 end_va = 0x84fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008400000" filename = "" Region: id = 934 start_va = 0x8700000 end_va = 0x87fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008700000" filename = "" Region: id = 935 start_va = 0x8800000 end_va = 0x88fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008800000" filename = "" Region: id = 936 start_va = 0x8900000 end_va = 0x89fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008900000" filename = "" Region: id = 937 start_va = 0x8e00000 end_va = 0x8efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008e00000" filename = "" Region: id = 938 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 939 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 940 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 941 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 942 start_va = 0x7ff73cbd0000 end_va = 0x7ff73cbdcfff monitored = 0 entry_point = 0x7ff73cbd3980 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 943 start_va = 0x7ffd8cac0000 end_va = 0x7ffd8cd6ffff monitored = 0 entry_point = 0x7ffd8cac1cf0 region_type = mapped_file name = "netshell.dll" filename = "\\Windows\\System32\\netshell.dll" (normalized: "c:\\windows\\system32\\netshell.dll") Region: id = 944 start_va = 0x7ffd914c0000 end_va = 0x7ffd914fefff monitored = 0 entry_point = 0x7ffd914e82d0 region_type = mapped_file name = "tcpipcfg.dll" filename = "\\Windows\\System32\\tcpipcfg.dll" (normalized: "c:\\windows\\system32\\tcpipcfg.dll") Region: id = 945 start_va = 0x7ffd96960000 end_va = 0x7ffd96991fff monitored = 0 entry_point = 0x7ffd9696b0c0 region_type = mapped_file name = "shacct.dll" filename = "\\Windows\\System32\\shacct.dll" (normalized: "c:\\windows\\system32\\shacct.dll") Region: id = 946 start_va = 0x7ffd96c80000 end_va = 0x7ffd96c90fff monitored = 0 entry_point = 0x7ffd96c828d0 region_type = mapped_file name = "credentialmigrationhandler.dll" filename = "\\Windows\\System32\\CredentialMigrationHandler.dll" (normalized: "c:\\windows\\system32\\credentialmigrationhandler.dll") Region: id = 947 start_va = 0x7ffd96d00000 end_va = 0x7ffd96d13fff monitored = 0 entry_point = 0x7ffd96d03710 region_type = mapped_file name = "mskeyprotect.dll" filename = "\\Windows\\System32\\mskeyprotect.dll" (normalized: "c:\\windows\\system32\\mskeyprotect.dll") Region: id = 948 start_va = 0x7ffd96d20000 end_va = 0x7ffd96d47fff monitored = 0 entry_point = 0x7ffd96d2efc0 region_type = mapped_file name = "dssenh.dll" filename = "\\Windows\\System32\\dssenh.dll" (normalized: "c:\\windows\\system32\\dssenh.dll") Region: id = 949 start_va = 0x7ffd96db0000 end_va = 0x7ffd96dcdfff monitored = 0 entry_point = 0x7ffd96dbef80 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\System32\\ncryptsslp.dll" (normalized: "c:\\windows\\system32\\ncryptsslp.dll") Region: id = 950 start_va = 0x7ffd96dd0000 end_va = 0x7ffd96e4ffff monitored = 0 entry_point = 0x7ffd96dfd280 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 951 start_va = 0x7ffd96e50000 end_va = 0x7ffd96e85fff monitored = 0 entry_point = 0x7ffd96e527f0 region_type = mapped_file name = "windows.networking.hostname.dll" filename = "\\Windows\\System32\\Windows.Networking.HostName.dll" (normalized: "c:\\windows\\system32\\windows.networking.hostname.dll") Region: id = 952 start_va = 0x7ffd96ef0000 end_va = 0x7ffd96f05fff monitored = 0 entry_point = 0x7ffd96ef1d50 region_type = mapped_file name = "wwapi.dll" filename = "\\Windows\\System32\\wwapi.dll" (normalized: "c:\\windows\\system32\\wwapi.dll") Region: id = 953 start_va = 0x7ffd96f10000 end_va = 0x7ffd96f21fff monitored = 0 entry_point = 0x7ffd96f11a80 region_type = mapped_file name = "bitsproxy.dll" filename = "\\Windows\\System32\\BitsProxy.dll" (normalized: "c:\\windows\\system32\\bitsproxy.dll") Region: id = 954 start_va = 0x7ffd96fc0000 end_va = 0x7ffd96fd0fff monitored = 0 entry_point = 0x7ffd96fc7480 region_type = mapped_file name = "tetheringclient.dll" filename = "\\Windows\\System32\\tetheringclient.dll" (normalized: "c:\\windows\\system32\\tetheringclient.dll") Region: id = 955 start_va = 0x7ffd96fe0000 end_va = 0x7ffd97063fff monitored = 0 entry_point = 0x7ffd96ff8d50 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 956 start_va = 0x7ffd97150000 end_va = 0x7ffd97165fff monitored = 0 entry_point = 0x7ffd971555e0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 957 start_va = 0x7ffd97170000 end_va = 0x7ffd97245fff monitored = 0 entry_point = 0x7ffd9719a800 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 958 start_va = 0x7ffd97250000 end_va = 0x7ffd972b3fff monitored = 0 entry_point = 0x7ffd9726bed0 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 959 start_va = 0x7ffd972c0000 end_va = 0x7ffd972e4fff monitored = 0 entry_point = 0x7ffd972c9900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 960 start_va = 0x7ffd972f0000 end_va = 0x7ffd97303fff monitored = 0 entry_point = 0x7ffd972f1800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 961 start_va = 0x7ffd97310000 end_va = 0x7ffd97325fff monitored = 0 entry_point = 0x7ffd97311af0 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 962 start_va = 0x7ffd97330000 end_va = 0x7ffd97349fff monitored = 0 entry_point = 0x7ffd97332330 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 963 start_va = 0x7ffd97350000 end_va = 0x7ffd97445fff monitored = 0 entry_point = 0x7ffd97389590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 964 start_va = 0x7ffd97450000 end_va = 0x7ffd974c3fff monitored = 0 entry_point = 0x7ffd97465eb0 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 965 start_va = 0x7ffd974d0000 end_va = 0x7ffd97606fff monitored = 0 entry_point = 0x7ffd97510480 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 966 start_va = 0x7ffd97630000 end_va = 0x7ffd97640fff monitored = 0 entry_point = 0x7ffd97632fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 967 start_va = 0x7ffd97650000 end_va = 0x7ffd9766dfff monitored = 0 entry_point = 0x7ffd97653a40 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 968 start_va = 0x7ffd97670000 end_va = 0x7ffd976f1fff monitored = 0 entry_point = 0x7ffd97672a10 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 969 start_va = 0x7ffd98150000 end_va = 0x7ffd9815efff monitored = 0 entry_point = 0x7ffd98154960 region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 970 start_va = 0x7ffd981b0000 end_va = 0x7ffd981effff monitored = 0 entry_point = 0x7ffd981bcbe0 region_type = mapped_file name = "adsldpc.dll" filename = "\\Windows\\System32\\adsldpc.dll" (normalized: "c:\\windows\\system32\\adsldpc.dll") Region: id = 971 start_va = 0x7ffd981f0000 end_va = 0x7ffd98236fff monitored = 0 entry_point = 0x7ffd981f1d10 region_type = mapped_file name = "activeds.dll" filename = "\\Windows\\System32\\activeds.dll" (normalized: "c:\\windows\\system32\\activeds.dll") Region: id = 972 start_va = 0x7ffd98290000 end_va = 0x7ffd9829cfff monitored = 0 entry_point = 0x7ffd98291420 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 973 start_va = 0x7ffd984f0000 end_va = 0x7ffd98531fff monitored = 0 entry_point = 0x7ffd984f3670 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 974 start_va = 0x7ffd985b0000 end_va = 0x7ffd985cefff monitored = 0 entry_point = 0x7ffd985b37e0 region_type = mapped_file name = "netsetupapi.dll" filename = "\\Windows\\System32\\NetSetupApi.dll" (normalized: "c:\\windows\\system32\\netsetupapi.dll") Region: id = 975 start_va = 0x7ffd985d0000 end_va = 0x7ffd98648fff monitored = 0 entry_point = 0x7ffd985d76a0 region_type = mapped_file name = "netsetupshim.dll" filename = "\\Windows\\System32\\NetSetupShim.dll" (normalized: "c:\\windows\\system32\\netsetupshim.dll") Region: id = 976 start_va = 0x7ffd98830000 end_va = 0x7ffd98847fff monitored = 0 entry_point = 0x7ffd98832000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 977 start_va = 0x7ffd98850000 end_va = 0x7ffd989d1fff monitored = 0 entry_point = 0x7ffd988682a0 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 978 start_va = 0x7ffd989e0000 end_va = 0x7ffd989f7fff monitored = 0 entry_point = 0x7ffd989e4e10 region_type = mapped_file name = "adhsvc.dll" filename = "\\Windows\\System32\\adhsvc.dll" (normalized: "c:\\windows\\system32\\adhsvc.dll") Region: id = 979 start_va = 0x7ffd98a00000 end_va = 0x7ffd98a24fff monitored = 0 entry_point = 0x7ffd98a05ca0 region_type = mapped_file name = "httpprxm.dll" filename = "\\Windows\\System32\\httpprxm.dll" (normalized: "c:\\windows\\system32\\httpprxm.dll") Region: id = 980 start_va = 0x7ffd98b40000 end_va = 0x7ffd98be2fff monitored = 0 entry_point = 0x7ffd98b42c10 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 981 start_va = 0x7ffd98bf0000 end_va = 0x7ffd98c41fff monitored = 0 entry_point = 0x7ffd98bf5770 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 982 start_va = 0x7ffd98c50000 end_va = 0x7ffd98c7dfff monitored = 1 entry_point = 0x7ffd98c52300 region_type = mapped_file name = "wmidcom.dll" filename = "\\Windows\\System32\\wmidcom.dll" (normalized: "c:\\windows\\system32\\wmidcom.dll") Region: id = 983 start_va = 0x7ffd98c80000 end_va = 0x7ffd98cddfff monitored = 0 entry_point = 0x7ffd98c85080 region_type = mapped_file name = "miutils.dll" filename = "\\Windows\\System32\\miutils.dll" (normalized: "c:\\windows\\system32\\miutils.dll") Region: id = 984 start_va = 0x7ffd98ce0000 end_va = 0x7ffd98cfffff monitored = 0 entry_point = 0x7ffd98ce1f50 region_type = mapped_file name = "mi.dll" filename = "\\Windows\\System32\\mi.dll" (normalized: "c:\\windows\\system32\\mi.dll") Region: id = 985 start_va = 0x7ffd98d00000 end_va = 0x7ffd98d08fff monitored = 0 entry_point = 0x7ffd98d018f0 region_type = mapped_file name = "sscoreext.dll" filename = "\\Windows\\System32\\sscoreext.dll" (normalized: "c:\\windows\\system32\\sscoreext.dll") Region: id = 986 start_va = 0x7ffd98d10000 end_va = 0x7ffd98d20fff monitored = 0 entry_point = 0x7ffd98d11d30 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 987 start_va = 0x7ffd98d30000 end_va = 0x7ffd98d70fff monitored = 0 entry_point = 0x7ffd98d33750 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 988 start_va = 0x7ffd98d80000 end_va = 0x7ffd98e72fff monitored = 0 entry_point = 0x7ffd98da5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 989 start_va = 0x7ffd9b190000 end_va = 0x7ffd9b1dbfff monitored = 0 entry_point = 0x7ffd9b1a5310 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 990 start_va = 0x7ffd9b2a0000 end_va = 0x7ffd9b2a9fff monitored = 0 entry_point = 0x7ffd9b2a1350 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 991 start_va = 0x7ffd9b340000 end_va = 0x7ffd9b3befff monitored = 0 entry_point = 0x7ffd9b357110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 992 start_va = 0x7ffd9b3c0000 end_va = 0x7ffd9b3fbfff monitored = 0 entry_point = 0x7ffd9b3c6aa0 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 993 start_va = 0x7ffd9b400000 end_va = 0x7ffd9b40bfff monitored = 0 entry_point = 0x7ffd9b4035c0 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 994 start_va = 0x7ffd9ca20000 end_va = 0x7ffd9ca28fff monitored = 0 entry_point = 0x7ffd9ca221d0 region_type = mapped_file name = "httpprxc.dll" filename = "\\Windows\\System32\\httpprxc.dll" (normalized: "c:\\windows\\system32\\httpprxc.dll") Region: id = 995 start_va = 0x7ffd9ca30000 end_va = 0x7ffd9ca64fff monitored = 0 entry_point = 0x7ffd9ca3a270 region_type = mapped_file name = "fwpolicyiomgr.dll" filename = "\\Windows\\System32\\fwpolicyiomgr.dll" (normalized: "c:\\windows\\system32\\fwpolicyiomgr.dll") Region: id = 996 start_va = 0x7ffd9da20000 end_va = 0x7ffd9da41fff monitored = 0 entry_point = 0x7ffd9da32540 region_type = mapped_file name = "updatepolicy.dll" filename = "\\Windows\\System32\\updatepolicy.dll" (normalized: "c:\\windows\\system32\\updatepolicy.dll") Region: id = 997 start_va = 0x7ffd9da50000 end_va = 0x7ffd9db24fff monitored = 0 entry_point = 0x7ffd9da6cf80 region_type = mapped_file name = "wuapi.dll" filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll") Region: id = 998 start_va = 0x7ffd9e4c0000 end_va = 0x7ffd9e503fff monitored = 0 entry_point = 0x7ffd9e4e83e0 region_type = mapped_file name = "updatehandlers.dll" filename = "\\Windows\\System32\\updatehandlers.dll" (normalized: "c:\\windows\\system32\\updatehandlers.dll") Region: id = 999 start_va = 0x7ffd9e510000 end_va = 0x7ffd9e56cfff monitored = 0 entry_point = 0x7ffd9e53e510 region_type = mapped_file name = "usocore.dll" filename = "\\Windows\\System32\\usocore.dll" (normalized: "c:\\windows\\system32\\usocore.dll") Region: id = 1000 start_va = 0x7ffd9e610000 end_va = 0x7ffd9e61ffff monitored = 0 entry_point = 0x7ffd9e611700 region_type = mapped_file name = "proximityservicepal.dll" filename = "\\Windows\\System32\\ProximityServicePal.dll" (normalized: "c:\\windows\\system32\\proximityservicepal.dll") Region: id = 1001 start_va = 0x7ffd9e620000 end_va = 0x7ffd9e628fff monitored = 0 entry_point = 0x7ffd9e621ed0 region_type = mapped_file name = "proximitycommonpal.dll" filename = "\\Windows\\System32\\ProximityCommonPal.dll" (normalized: "c:\\windows\\system32\\proximitycommonpal.dll") Region: id = 1002 start_va = 0x7ffd9e630000 end_va = 0x7ffd9e65cfff monitored = 0 entry_point = 0x7ffd9e632290 region_type = mapped_file name = "proximitycommon.dll" filename = "\\Windows\\System32\\ProximityCommon.dll" (normalized: "c:\\windows\\system32\\proximitycommon.dll") Region: id = 1003 start_va = 0x7ffd9e660000 end_va = 0x7ffd9e6b1fff monitored = 0 entry_point = 0x7ffd9e6638e0 region_type = mapped_file name = "proximityservice.dll" filename = "\\Windows\\System32\\ProximityService.dll" (normalized: "c:\\windows\\system32\\proximityservice.dll") Region: id = 1004 start_va = 0x7ffd9ece0000 end_va = 0x7ffd9ece9fff monitored = 0 entry_point = 0x7ffd9ece14c0 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 1005 start_va = 0x7ffd9f020000 end_va = 0x7ffd9f031fff monitored = 0 entry_point = 0x7ffd9f023580 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 1006 start_va = 0x7ffd9f0b0000 end_va = 0x7ffd9f0cafff monitored = 0 entry_point = 0x7ffd9f0b1040 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 1007 start_va = 0x7ffd9f190000 end_va = 0x7ffd9f1a6fff monitored = 0 entry_point = 0x7ffd9f197520 region_type = mapped_file name = "usoapi.dll" filename = "\\Windows\\System32\\usoapi.dll" (normalized: "c:\\windows\\system32\\usoapi.dll") Region: id = 1008 start_va = 0x7ffd9f1b0000 end_va = 0x7ffd9f1c4fff monitored = 0 entry_point = 0x7ffd9f1b2dc0 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll") Region: id = 1009 start_va = 0x7ffd9f300000 end_va = 0x7ffd9f40efff monitored = 0 entry_point = 0x7ffd9f33c010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 1010 start_va = 0x7ffd9f4e0000 end_va = 0x7ffd9f546fff monitored = 0 entry_point = 0x7ffd9f4eb160 region_type = mapped_file name = "upnp.dll" filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll") Region: id = 1011 start_va = 0x7ffd9f9d0000 end_va = 0x7ffd9f9ecfff monitored = 0 entry_point = 0x7ffd9f9d4f60 region_type = mapped_file name = "appinfo.dll" filename = "\\Windows\\System32\\appinfo.dll" (normalized: "c:\\windows\\system32\\appinfo.dll") Region: id = 1012 start_va = 0x7ffd9fb70000 end_va = 0x7ffd9fb83fff monitored = 0 entry_point = 0x7ffd9fb72a00 region_type = mapped_file name = "bitsigd.dll" filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll") Region: id = 1013 start_va = 0x7ffd9fb90000 end_va = 0x7ffd9fbd5fff monitored = 0 entry_point = 0x7ffd9fb979a0 region_type = mapped_file name = "adsldp.dll" filename = "\\Windows\\System32\\adsldp.dll" (normalized: "c:\\windows\\system32\\adsldp.dll") Region: id = 1014 start_va = 0x7ffd9fd20000 end_va = 0x7ffd9fe3cfff monitored = 0 entry_point = 0x7ffd9fd4fe60 region_type = mapped_file name = "qmgr.dll" filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll") Region: id = 1015 start_va = 0x7ffda0160000 end_va = 0x7ffda01f9fff monitored = 0 entry_point = 0x7ffda017ada0 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 1016 start_va = 0x7ffda02f0000 end_va = 0x7ffda02fdfff monitored = 0 entry_point = 0x7ffda02f1460 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 1017 start_va = 0x7ffda0310000 end_va = 0x7ffda0376fff monitored = 0 entry_point = 0x7ffda03163e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1018 start_va = 0x7ffda0530000 end_va = 0x7ffda05effff monitored = 0 entry_point = 0x7ffda055fd20 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 1019 start_va = 0x7ffda07a0000 end_va = 0x7ffda084dfff monitored = 0 entry_point = 0x7ffda07b80c0 region_type = mapped_file name = "windows.networking.connectivity.dll" filename = "\\Windows\\System32\\Windows.Networking.Connectivity.dll" (normalized: "c:\\windows\\system32\\windows.networking.connectivity.dll") Region: id = 1020 start_va = 0x7ffda0850000 end_va = 0x7ffda0861fff monitored = 0 entry_point = 0x7ffda0859260 region_type = mapped_file name = "rilproxy.dll" filename = "\\Windows\\System32\\rilproxy.dll" (normalized: "c:\\windows\\system32\\rilproxy.dll") Region: id = 1021 start_va = 0x7ffda0870000 end_va = 0x7ffda0920fff monitored = 0 entry_point = 0x7ffda08e88b0 region_type = mapped_file name = "cellularapi.dll" filename = "\\Windows\\System32\\CellularAPI.dll" (normalized: "c:\\windows\\system32\\cellularapi.dll") Region: id = 1022 start_va = 0x7ffda0930000 end_va = 0x7ffda0954fff monitored = 0 entry_point = 0x7ffda0942f20 region_type = mapped_file name = "wificonnapi.dll" filename = "\\Windows\\System32\\wificonnapi.dll" (normalized: "c:\\windows\\system32\\wificonnapi.dll") Region: id = 1023 start_va = 0x7ffda0960000 end_va = 0x7ffda0970fff monitored = 0 entry_point = 0x7ffda0967ea0 region_type = mapped_file name = "dcpapi.dll" filename = "\\Windows\\System32\\dcpapi.dll" (normalized: "c:\\windows\\system32\\dcpapi.dll") Region: id = 1024 start_va = 0x7ffda0980000 end_va = 0x7ffda0999fff monitored = 0 entry_point = 0x7ffda0982cf0 region_type = mapped_file name = "locationpelegacywinlocation.dll" filename = "\\Windows\\System32\\LocationPeLegacyWinLocation.dll" (normalized: "c:\\windows\\system32\\locationpelegacywinlocation.dll") Region: id = 1025 start_va = 0x7ffda09a0000 end_va = 0x7ffda09abfff monitored = 0 entry_point = 0x7ffda09a14d0 region_type = mapped_file name = "locationframeworkps.dll" filename = "\\Windows\\System32\\LocationFrameworkPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkps.dll") Region: id = 1026 start_va = 0x7ffda09b0000 end_va = 0x7ffda09c4fff monitored = 0 entry_point = 0x7ffda09b3460 region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 1027 start_va = 0x7ffda0aa0000 end_va = 0x7ffda0af4fff monitored = 0 entry_point = 0x7ffda0aa3fb0 region_type = mapped_file name = "policymanager.dll" filename = "\\Windows\\System32\\policymanager.dll" (normalized: "c:\\windows\\system32\\policymanager.dll") Region: id = 1028 start_va = 0x7ffda0b00000 end_va = 0x7ffda0b36fff monitored = 0 entry_point = 0x7ffda0b06020 region_type = mapped_file name = "gnssadapter.dll" filename = "\\Windows\\System32\\GnssAdapter.dll" (normalized: "c:\\windows\\system32\\gnssadapter.dll") Region: id = 1029 start_va = 0x7ffda0b40000 end_va = 0x7ffda0b5ffff monitored = 0 entry_point = 0x7ffda0b439a0 region_type = mapped_file name = "locationwinpalmisc.dll" filename = "\\Windows\\System32\\LocationWinPalMisc.dll" (normalized: "c:\\windows\\system32\\locationwinpalmisc.dll") Region: id = 1030 start_va = 0x7ffda0b60000 end_va = 0x7ffda0ba0fff monitored = 0 entry_point = 0x7ffda0b64840 region_type = mapped_file name = "usermgrproxy.dll" filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll") Region: id = 1031 start_va = 0x7ffda0bb0000 end_va = 0x7ffda0bb7fff monitored = 0 entry_point = 0x7ffda0bb13b0 region_type = mapped_file name = "dmiso8601utils.dll" filename = "\\Windows\\System32\\dmiso8601utils.dll" (normalized: "c:\\windows\\system32\\dmiso8601utils.dll") Region: id = 1032 start_va = 0x7ffda0bc0000 end_va = 0x7ffda0bd7fff monitored = 0 entry_point = 0x7ffda0bcb850 region_type = mapped_file name = "dmcmnutils.dll" filename = "\\Windows\\System32\\dmcmnutils.dll" (normalized: "c:\\windows\\system32\\dmcmnutils.dll") Region: id = 1033 start_va = 0x7ffda0d10000 end_va = 0x7ffda0d23fff monitored = 0 entry_point = 0x7ffda0d12d50 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 1034 start_va = 0x7ffda0de0000 end_va = 0x7ffda0df7fff monitored = 0 entry_point = 0x7ffda0de1b10 region_type = mapped_file name = "locationframeworkinternalps.dll" filename = "\\Windows\\System32\\LocationFrameworkInternalPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkinternalps.dll") Region: id = 1035 start_va = 0x7ffda1010000 end_va = 0x7ffda10a2fff monitored = 0 entry_point = 0x7ffda1019680 region_type = mapped_file name = "msvcp_win.dll" filename = "\\Windows\\System32\\msvcp_win.dll" (normalized: "c:\\windows\\system32\\msvcp_win.dll") Region: id = 1036 start_va = 0x7ffda11c0000 end_va = 0x7ffda11d8fff monitored = 0 entry_point = 0x7ffda11c4520 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1037 start_va = 0x7ffda1290000 end_va = 0x7ffda1357fff monitored = 0 entry_point = 0x7ffda12d13f0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1038 start_va = 0x7ffda1360000 end_va = 0x7ffda13c0fff monitored = 0 entry_point = 0x7ffda1364b50 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 1039 start_va = 0x7ffda13d0000 end_va = 0x7ffda154bfff monitored = 0 entry_point = 0x7ffda1421650 region_type = mapped_file name = "locationframework.dll" filename = "\\Windows\\System32\\LocationFramework.dll" (normalized: "c:\\windows\\system32\\locationframework.dll") Region: id = 1040 start_va = 0x7ffda1550000 end_va = 0x7ffda155afff monitored = 0 entry_point = 0x7ffda1551770 region_type = mapped_file name = "lfsvc.dll" filename = "\\Windows\\System32\\lfsvc.dll" (normalized: "c:\\windows\\system32\\lfsvc.dll") Region: id = 1041 start_va = 0x7ffda1560000 end_va = 0x7ffda158dfff monitored = 0 entry_point = 0x7ffda1567550 region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 1042 start_va = 0x7ffda1590000 end_va = 0x7ffda15a6fff monitored = 0 entry_point = 0x7ffda1595630 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 1043 start_va = 0x7ffda1790000 end_va = 0x7ffda17a9fff monitored = 0 entry_point = 0x7ffda1792430 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1044 start_va = 0x7ffda17b0000 end_va = 0x7ffda17c5fff monitored = 0 entry_point = 0x7ffda17b19f0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1045 start_va = 0x7ffda17d0000 end_va = 0x7ffda1807fff monitored = 0 entry_point = 0x7ffda17e8cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1046 start_va = 0x7ffda1810000 end_va = 0x7ffda181afff monitored = 0 entry_point = 0x7ffda1811d30 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1047 start_va = 0x7ffda1820000 end_va = 0x7ffda182cfff monitored = 0 entry_point = 0x7ffda1822ca0 region_type = mapped_file name = "csystemeventsbrokerclient.dll" filename = "\\Windows\\System32\\CSystemEventsBrokerClient.dll" (normalized: "c:\\windows\\system32\\csystemeventsbrokerclient.dll") Region: id = 1048 start_va = 0x7ffda1830000 end_va = 0x7ffda185efff monitored = 0 entry_point = 0x7ffda1838910 region_type = mapped_file name = "wptaskscheduler.dll" filename = "\\Windows\\System32\\WPTaskScheduler.dll" (normalized: "c:\\windows\\system32\\wptaskscheduler.dll") Region: id = 1049 start_va = 0x7ffda18b0000 end_va = 0x7ffda18c5fff monitored = 0 entry_point = 0x7ffda18b1b60 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1050 start_va = 0x7ffda1930000 end_va = 0x7ffda1a15fff monitored = 0 entry_point = 0x7ffda194cf10 region_type = mapped_file name = "usermgr.dll" filename = "\\Windows\\System32\\usermgr.dll" (normalized: "c:\\windows\\system32\\usermgr.dll") Region: id = 1051 start_va = 0x7ffda1a20000 end_va = 0x7ffda1a99fff monitored = 0 entry_point = 0x7ffda1a47630 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 1052 start_va = 0x7ffda1cb0000 end_va = 0x7ffda1ccefff monitored = 0 entry_point = 0x7ffda1cb4960 region_type = mapped_file name = "ncprov.dll" filename = "\\Windows\\System32\\wbem\\NCProv.dll" (normalized: "c:\\windows\\system32\\wbem\\ncprov.dll") Region: id = 1053 start_va = 0x7ffda1cd0000 end_va = 0x7ffda1d3dfff monitored = 0 entry_point = 0x7ffda1cd7f60 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 1054 start_va = 0x7ffda1d80000 end_va = 0x7ffda1e11fff monitored = 0 entry_point = 0x7ffda1dca780 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 1055 start_va = 0x7ffda1ea0000 end_va = 0x7ffda1eb0fff monitored = 0 entry_point = 0x7ffda1ea3320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 1056 start_va = 0x7ffda22b0000 end_va = 0x7ffda22f0fff monitored = 0 entry_point = 0x7ffda22c7eb0 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 1057 start_va = 0x7ffda2300000 end_va = 0x7ffda23fbfff monitored = 0 entry_point = 0x7ffda2336df0 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 1058 start_va = 0x7ffda25e0000 end_va = 0x7ffda2961fff monitored = 0 entry_point = 0x7ffda2631220 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 1059 start_va = 0x7ffda2970000 end_va = 0x7ffda2aa5fff monitored = 0 entry_point = 0x7ffda299f350 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 1060 start_va = 0x7ffda3ba0000 end_va = 0x7ffda3cadfff monitored = 0 entry_point = 0x7ffda3beeaa0 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 1061 start_va = 0x7ffda3fb0000 end_va = 0x7ffda3fbffff monitored = 0 entry_point = 0x7ffda3fb2c60 region_type = mapped_file name = "usermgrcli.dll" filename = "\\Windows\\System32\\usermgrcli.dll" (normalized: "c:\\windows\\system32\\usermgrcli.dll") Region: id = 1062 start_va = 0x7ffda3fc0000 end_va = 0x7ffda3fd2fff monitored = 0 entry_point = 0x7ffda3fc57f0 region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 1063 start_va = 0x7ffda3fe0000 end_va = 0x7ffda401dfff monitored = 0 entry_point = 0x7ffda3fea050 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 1064 start_va = 0x7ffda4020000 end_va = 0x7ffda4046fff monitored = 0 entry_point = 0x7ffda4023bf0 region_type = mapped_file name = "profsvcext.dll" filename = "\\Windows\\System32\\profsvcext.dll" (normalized: "c:\\windows\\system32\\profsvcext.dll") Region: id = 1065 start_va = 0x7ffda4050000 end_va = 0x7ffda405bfff monitored = 0 entry_point = 0x7ffda4052830 region_type = mapped_file name = "bi.dll" filename = "\\Windows\\System32\\bi.dll" (normalized: "c:\\windows\\system32\\bi.dll") Region: id = 1066 start_va = 0x7ffda4060000 end_va = 0x7ffda40b4fff monitored = 0 entry_point = 0x7ffda406fc00 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 1067 start_va = 0x7ffda40c0000 end_va = 0x7ffda4123fff monitored = 0 entry_point = 0x7ffda40d5ae0 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1068 start_va = 0x7ffda42f0000 end_va = 0x7ffda43aefff monitored = 0 entry_point = 0x7ffda4311c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 1069 start_va = 0x7ffda43b0000 end_va = 0x7ffda43effff monitored = 0 entry_point = 0x7ffda43c6c60 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 1070 start_va = 0x7ffda4420000 end_va = 0x7ffda4455fff monitored = 0 entry_point = 0x7ffda4430070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 1071 start_va = 0x7ffda4d20000 end_va = 0x7ffda4d29fff monitored = 0 entry_point = 0x7ffda4d21660 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1072 start_va = 0x7ffda4d30000 end_va = 0x7ffda4d47fff monitored = 0 entry_point = 0x7ffda4d35910 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 1073 start_va = 0x7ffda4d50000 end_va = 0x7ffda4e9cfff monitored = 0 entry_point = 0x7ffda4d93da0 region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 1074 start_va = 0x7ffda5930000 end_va = 0x7ffda59a8fff monitored = 0 entry_point = 0x7ffda594fb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 1075 start_va = 0x7ffda5b60000 end_va = 0x7ffda5ff2fff monitored = 0 entry_point = 0x7ffda5b6f760 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 1076 start_va = 0x7ffda6000000 end_va = 0x7ffda6066fff monitored = 0 entry_point = 0x7ffda601e710 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 1077 start_va = 0x7ffda60c0000 end_va = 0x7ffda60c7fff monitored = 0 entry_point = 0x7ffda60c13e0 region_type = mapped_file name = "dabapi.dll" filename = "\\Windows\\System32\\dabapi.dll" (normalized: "c:\\windows\\system32\\dabapi.dll") Region: id = 1078 start_va = 0x7ffda6100000 end_va = 0x7ffda6285fff monitored = 0 entry_point = 0x7ffda614d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1079 start_va = 0x7ffda6290000 end_va = 0x7ffda62abfff monitored = 0 entry_point = 0x7ffda62937a0 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 1080 start_va = 0x7ffda62b0000 end_va = 0x7ffda62bafff monitored = 0 entry_point = 0x7ffda62b1de0 region_type = mapped_file name = "bitsperf.dll" filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll") Region: id = 1081 start_va = 0x7ffda62f0000 end_va = 0x7ffda6302fff monitored = 0 entry_point = 0x7ffda62f2760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1082 start_va = 0x7ffda6460000 end_va = 0x7ffda649ffff monitored = 0 entry_point = 0x7ffda6471960 region_type = mapped_file name = "brokerlib.dll" filename = "\\Windows\\System32\\BrokerLib.dll" (normalized: "c:\\windows\\system32\\brokerlib.dll") Region: id = 1083 start_va = 0x7ffda65d0000 end_va = 0x7ffda65f6fff monitored = 0 entry_point = 0x7ffda65d7940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1084 start_va = 0x7ffda6620000 end_va = 0x7ffda66c9fff monitored = 0 entry_point = 0x7ffda6647910 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1085 start_va = 0x7ffda66d0000 end_va = 0x7ffda67cffff monitored = 0 entry_point = 0x7ffda6710f80 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 1086 start_va = 0x7ffda6860000 end_va = 0x7ffda686bfff monitored = 0 entry_point = 0x7ffda6862480 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 1087 start_va = 0x7ffda6a30000 end_va = 0x7ffda6a61fff monitored = 0 entry_point = 0x7ffda6a42340 region_type = mapped_file name = "fwbase.dll" filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll") Region: id = 1088 start_va = 0x7ffda6ba0000 end_va = 0x7ffda6babfff monitored = 0 entry_point = 0x7ffda6ba2790 region_type = mapped_file name = "hid.dll" filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll") Region: id = 1089 start_va = 0x7ffda6bb0000 end_va = 0x7ffda6bd3fff monitored = 0 entry_point = 0x7ffda6bb3260 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 1090 start_va = 0x7ffda6d50000 end_va = 0x7ffda6e43fff monitored = 0 entry_point = 0x7ffda6d5a960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 1091 start_va = 0x7ffda6ea0000 end_va = 0x7ffda6ee8fff monitored = 0 entry_point = 0x7ffda6eaa090 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 1092 start_va = 0x7ffda6fc0000 end_va = 0x7ffda6fcbfff monitored = 0 entry_point = 0x7ffda6fc27e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1093 start_va = 0x7ffda70a0000 end_va = 0x7ffda70d0fff monitored = 0 entry_point = 0x7ffda70a7d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1094 start_va = 0x7ffda7100000 end_va = 0x7ffda7179fff monitored = 0 entry_point = 0x7ffda7121a50 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 1095 start_va = 0x7ffda71c0000 end_va = 0x7ffda71f3fff monitored = 0 entry_point = 0x7ffda71dae70 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1096 start_va = 0x7ffda7200000 end_va = 0x7ffda7209fff monitored = 0 entry_point = 0x7ffda7201830 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll") Region: id = 1097 start_va = 0x7ffda7310000 end_va = 0x7ffda732efff monitored = 0 entry_point = 0x7ffda7315d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1098 start_va = 0x7ffda7480000 end_va = 0x7ffda74dbfff monitored = 0 entry_point = 0x7ffda7496f70 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1099 start_va = 0x7ffda7530000 end_va = 0x7ffda7546fff monitored = 0 entry_point = 0x7ffda75379d0 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1100 start_va = 0x7ffda7650000 end_va = 0x7ffda765afff monitored = 0 entry_point = 0x7ffda76519a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1101 start_va = 0x7ffda7690000 end_va = 0x7ffda76b0fff monitored = 0 entry_point = 0x7ffda76a0250 region_type = mapped_file name = "joinutil.dll" filename = "\\Windows\\System32\\joinutil.dll" (normalized: "c:\\windows\\system32\\joinutil.dll") Region: id = 1102 start_va = 0x7ffda76e0000 end_va = 0x7ffda7719fff monitored = 0 entry_point = 0x7ffda76e8d20 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll") Region: id = 1103 start_va = 0x7ffda7720000 end_va = 0x7ffda7746fff monitored = 0 entry_point = 0x7ffda7730aa0 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 1104 start_va = 0x7ffda7830000 end_va = 0x7ffda785cfff monitored = 0 entry_point = 0x7ffda7849d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1105 start_va = 0x7ffda79c0000 end_va = 0x7ffda7a15fff monitored = 0 entry_point = 0x7ffda79d0bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1106 start_va = 0x7ffda7a20000 end_va = 0x7ffda7a38fff monitored = 0 entry_point = 0x7ffda7a25e10 region_type = mapped_file name = "eventaggregation.dll" filename = "\\Windows\\System32\\EventAggregation.dll" (normalized: "c:\\windows\\system32\\eventaggregation.dll") Region: id = 1107 start_va = 0x7ffda7a40000 end_va = 0x7ffda7a68fff monitored = 0 entry_point = 0x7ffda7a54530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1108 start_va = 0x7ffda7a70000 end_va = 0x7ffda7b08fff monitored = 0 entry_point = 0x7ffda7a9f4e0 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 1109 start_va = 0x7ffda7bb0000 end_va = 0x7ffda7bfafff monitored = 0 entry_point = 0x7ffda7bb35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1110 start_va = 0x7ffda7c00000 end_va = 0x7ffda7c0efff monitored = 0 entry_point = 0x7ffda7c03210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1111 start_va = 0x7ffda7c10000 end_va = 0x7ffda7c23fff monitored = 0 entry_point = 0x7ffda7c152e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1112 start_va = 0x7ffda7c30000 end_va = 0x7ffda7c3ffff monitored = 0 entry_point = 0x7ffda7c356e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1113 start_va = 0x7ffda7c40000 end_va = 0x7ffda7cc5fff monitored = 0 entry_point = 0x7ffda7c4d8f0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 1114 start_va = 0x7ffda7cd0000 end_va = 0x7ffda7d39fff monitored = 0 entry_point = 0x7ffda7d06d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1115 start_va = 0x7ffda7d40000 end_va = 0x7ffda7f27fff monitored = 0 entry_point = 0x7ffda7d6ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1116 start_va = 0x7ffda7f30000 end_va = 0x7ffda80f6fff monitored = 0 entry_point = 0x7ffda7f8db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1117 start_va = 0x7ffda8100000 end_va = 0x7ffda8142fff monitored = 0 entry_point = 0x7ffda8114b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1118 start_va = 0x7ffda8150000 end_va = 0x7ffda81a4fff monitored = 0 entry_point = 0x7ffda8167970 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 1119 start_va = 0x7ffda8260000 end_va = 0x7ffda8314fff monitored = 0 entry_point = 0x7ffda82a22e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1120 start_va = 0x7ffda8320000 end_va = 0x7ffda8963fff monitored = 0 entry_point = 0x7ffda84e64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 1121 start_va = 0x7ffda8970000 end_va = 0x7ffda8986fff monitored = 0 entry_point = 0x7ffda8971390 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1122 start_va = 0x7ffda8990000 end_va = 0x7ffda89ebfff monitored = 0 entry_point = 0x7ffda89ab720 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1123 start_va = 0x7ffda8a30000 end_va = 0x7ffda8adcfff monitored = 0 entry_point = 0x7ffda8a481a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1124 start_va = 0x7ffda8ae0000 end_va = 0x7ffda8b86fff monitored = 0 entry_point = 0x7ffda8aeb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1125 start_va = 0x7ffda8b90000 end_va = 0x7ffda8b97fff monitored = 0 entry_point = 0x7ffda8b91ea0 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1126 start_va = 0x7ffda8ba0000 end_va = 0x7ffda8cbbfff monitored = 0 entry_point = 0x7ffda8be02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1127 start_va = 0x7ffda8cc0000 end_va = 0x7ffda8d80fff monitored = 0 entry_point = 0x7ffda8ce0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1128 start_va = 0x7ffda8ea0000 end_va = 0x7ffda8ff5fff monitored = 0 entry_point = 0x7ffda8eaa8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1129 start_va = 0x7ffda9000000 end_va = 0x7ffda927cfff monitored = 0 entry_point = 0x7ffda90d4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1130 start_va = 0x7ffda9280000 end_va = 0x7ffda96a8fff monitored = 0 entry_point = 0x7ffda92a8740 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1131 start_va = 0x7ffda96b0000 end_va = 0x7ffda97f2fff monitored = 0 entry_point = 0x7ffda96d8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1132 start_va = 0x7ffda9800000 end_va = 0x7ffda986afff monitored = 0 entry_point = 0x7ffda98190c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1133 start_va = 0x7ffda9870000 end_va = 0x7ffdaadcefff monitored = 0 entry_point = 0x7ffda99d11f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1134 start_va = 0x7ffdaadd0000 end_va = 0x7ffdaae21fff monitored = 0 entry_point = 0x7ffdaaddf530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1135 start_va = 0x7ffdaae30000 end_va = 0x7ffdaaeccfff monitored = 0 entry_point = 0x7ffdaae378a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1136 start_va = 0x7ffdaaee0000 end_va = 0x7ffdaaf86fff monitored = 0 entry_point = 0x7ffdaaef58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1137 start_va = 0x7ffdab030000 end_va = 0x7ffdab08afff monitored = 0 entry_point = 0x7ffdab0438b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1138 start_va = 0x7ffdab400000 end_va = 0x7ffdab585fff monitored = 0 entry_point = 0x7ffdab44ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1139 start_va = 0x7ffdab590000 end_va = 0x7ffdab750fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1171 start_va = 0x8f00000 end_va = 0x8ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008f00000" filename = "" Region: id = 1172 start_va = 0x9000000 end_va = 0x90fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009000000" filename = "" Region: id = 1173 start_va = 0x9100000 end_va = 0x91fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009100000" filename = "" Region: id = 1174 start_va = 0x9200000 end_va = 0x92fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009200000" filename = "" Region: id = 1296 start_va = 0x130000 end_va = 0x134fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 1298 start_va = 0x130000 end_va = 0x134fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 1343 start_va = 0x130000 end_va = 0x131fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 1348 start_va = 0x9300000 end_va = 0x93fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009300000" filename = "" Region: id = 1722 start_va = 0x130000 end_va = 0x132fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 1723 start_va = 0x1e0000 end_va = 0x1e2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 1727 start_va = 0x1050000 end_va = 0x1062fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001050000" filename = "" Region: id = 1729 start_va = 0x9400000 end_va = 0x94fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009400000" filename = "" Region: id = 1730 start_va = 0x9500000 end_va = 0x95fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009500000" filename = "" Region: id = 1731 start_va = 0x9600000 end_va = 0x96fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009600000" filename = "" Region: id = 1738 start_va = 0x1050000 end_va = 0x1062fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001050000" filename = "" Region: id = 1740 start_va = 0x130000 end_va = 0x132fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 1741 start_va = 0x130000 end_va = 0x133fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 1742 start_va = 0x130000 end_va = 0x132fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 2145 start_va = 0x130000 end_va = 0x132fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 2147 start_va = 0x130000 end_va = 0x132fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 2154 start_va = 0x130000 end_va = 0x132fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 2155 start_va = 0x130000 end_va = 0x132fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 2191 start_va = 0x130000 end_va = 0x131fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 2192 start_va = 0x130000 end_va = 0x130fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 2193 start_va = 0x9700000 end_va = 0x97fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009700000" filename = "" Region: id = 2194 start_va = 0x130000 end_va = 0x130fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Thread: id = 18 os_tid = 0xe9c Thread: id = 19 os_tid = 0x4e8 Thread: id = 20 os_tid = 0x714 Thread: id = 21 os_tid = 0x758 Thread: id = 22 os_tid = 0x428 Thread: id = 23 os_tid = 0x1038 Thread: id = 24 os_tid = 0x454 Thread: id = 25 os_tid = 0xbd0 Thread: id = 26 os_tid = 0xac0 Thread: id = 27 os_tid = 0xab8 Thread: id = 28 os_tid = 0xbd4 Thread: id = 29 os_tid = 0x8f4 Thread: id = 30 os_tid = 0x834 Thread: id = 31 os_tid = 0x554 Thread: id = 32 os_tid = 0x2cc Thread: id = 33 os_tid = 0x438 Thread: id = 34 os_tid = 0x2d4 Thread: id = 35 os_tid = 0x414 Thread: id = 36 os_tid = 0xc48 Thread: id = 37 os_tid = 0x894 Thread: id = 38 os_tid = 0x898 Thread: id = 39 os_tid = 0x838 Thread: id = 40 os_tid = 0xd88 Thread: id = 41 os_tid = 0xfdc Thread: id = 42 os_tid = 0x95c Thread: id = 43 os_tid = 0xf14 Thread: id = 44 os_tid = 0xf5c Thread: id = 45 os_tid = 0xf64 Thread: id = 46 os_tid = 0x99c Thread: id = 47 os_tid = 0x7b4 Thread: id = 48 os_tid = 0x5d8 Thread: id = 49 os_tid = 0x7b8 Thread: id = 50 os_tid = 0xf4c Thread: id = 51 os_tid = 0xee0 Thread: id = 52 os_tid = 0x518 Thread: id = 53 os_tid = 0xcbc Thread: id = 54 os_tid = 0xec4 Thread: id = 55 os_tid = 0xecc Thread: id = 56 os_tid = 0xedc Thread: id = 57 os_tid = 0xe04 Thread: id = 58 os_tid = 0xca8 Thread: id = 59 os_tid = 0xd18 Thread: id = 60 os_tid = 0xe64 Thread: id = 61 os_tid = 0x9d8 Thread: id = 62 os_tid = 0xdd0 Thread: id = 63 os_tid = 0xe00 Thread: id = 64 os_tid = 0xdec Thread: id = 65 os_tid = 0xdf4 Thread: id = 66 os_tid = 0xdf0 Thread: id = 67 os_tid = 0xa88 Thread: id = 68 os_tid = 0xb24 Thread: id = 69 os_tid = 0x9ac Thread: id = 70 os_tid = 0xc0c Thread: id = 71 os_tid = 0xd40 Thread: id = 72 os_tid = 0xd38 Thread: id = 73 os_tid = 0x89c Thread: id = 74 os_tid = 0xfd8 Thread: id = 75 os_tid = 0xcac Thread: id = 76 os_tid = 0x6c4 Thread: id = 77 os_tid = 0x8a0 Thread: id = 78 os_tid = 0x878 Thread: id = 79 os_tid = 0x860 Thread: id = 80 os_tid = 0x858 Thread: id = 81 os_tid = 0x854 Thread: id = 82 os_tid = 0x814 Thread: id = 83 os_tid = 0x808 Thread: id = 84 os_tid = 0x500 Thread: id = 85 os_tid = 0x4f4 Thread: id = 86 os_tid = 0x524 Thread: id = 87 os_tid = 0x460 Thread: id = 88 os_tid = 0x574 Thread: id = 89 os_tid = 0x4e8 Thread: id = 90 os_tid = 0x760 Thread: id = 91 os_tid = 0x718 Thread: id = 92 os_tid = 0x6c0 Thread: id = 93 os_tid = 0x608 Thread: id = 94 os_tid = 0x59c Thread: id = 95 os_tid = 0x4fc Thread: id = 96 os_tid = 0x4bc Thread: id = 97 os_tid = 0x4a8 Thread: id = 98 os_tid = 0x478 Thread: id = 99 os_tid = 0x2e4 Thread: id = 100 os_tid = 0x8 Thread: id = 101 os_tid = 0x2f0 Thread: id = 102 os_tid = 0x308 Thread: id = 103 os_tid = 0x270 Thread: id = 104 os_tid = 0x210 Thread: id = 105 os_tid = 0x18c Thread: id = 106 os_tid = 0x140 Thread: id = 107 os_tid = 0x3f4 Thread: id = 108 os_tid = 0x3ec Thread: id = 109 os_tid = 0x3e4 Thread: id = 110 os_tid = 0x368 Thread: id = 127 os_tid = 0xc44 Thread: id = 128 os_tid = 0xd10 Thread: id = 129 os_tid = 0x13e0 Thread: id = 130 os_tid = 0x644 Thread: id = 134 os_tid = 0x80c Thread: id = 136 os_tid = 0x6a0 Thread: id = 137 os_tid = 0xbcc Thread: id = 138 os_tid = 0xef0 Thread: id = 147 os_tid = 0xbe4 Process: id = "4" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x61d1b000" os_pid = "0x3e0" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x274" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xe], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xe], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000ac37" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1373 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1374 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1375 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1376 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1377 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 1378 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1379 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1380 start_va = 0x100000 end_va = 0x1bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1381 start_va = 0x1c0000 end_va = 0x1c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 1382 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1383 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 1384 start_va = 0x1f0000 end_va = 0x1f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 1385 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1386 start_va = 0x480000 end_va = 0x480fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000480000" filename = "" Region: id = 1387 start_va = 0x490000 end_va = 0x494fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 1388 start_va = 0x4a0000 end_va = 0x4a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004a0000" filename = "" Region: id = 1389 start_va = 0x4b0000 end_va = 0x4b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004b0000" filename = "" Region: id = 1390 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004c0000" filename = "" Region: id = 1391 start_va = 0x4d0000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 1392 start_va = 0x5d0000 end_va = 0x757fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005d0000" filename = "" Region: id = 1393 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 1394 start_va = 0x7a0000 end_va = 0xad6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1395 start_va = 0xae0000 end_va = 0xc60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ae0000" filename = "" Region: id = 1396 start_va = 0xc70000 end_va = 0xd2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c70000" filename = "" Region: id = 1397 start_va = 0xd30000 end_va = 0xdaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d30000" filename = "" Region: id = 1398 start_va = 0xdb0000 end_va = 0xeaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000db0000" filename = "" Region: id = 1399 start_va = 0xeb0000 end_va = 0xf2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000eb0000" filename = "" Region: id = 1400 start_va = 0xf30000 end_va = 0xfaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f30000" filename = "" Region: id = 1401 start_va = 0xfb0000 end_va = 0x102ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fb0000" filename = "" Region: id = 1402 start_va = 0x1030000 end_va = 0x10affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001030000" filename = "" Region: id = 1403 start_va = 0x10b0000 end_va = 0x112ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010b0000" filename = "" Region: id = 1404 start_va = 0x1130000 end_va = 0x11affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001130000" filename = "" Region: id = 1405 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1406 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 1407 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 1408 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 1409 start_va = 0x7ff61e550000 end_va = 0x7ff61e5cffff monitored = 0 entry_point = 0x7ff61e565f50 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 1410 start_va = 0x7ffd8b180000 end_va = 0x7ffd8b1ccfff monitored = 0 entry_point = 0x7ffd8b18b470 region_type = mapped_file name = "pdh.dll" filename = "\\Windows\\System32\\pdh.dll" (normalized: "c:\\windows\\system32\\pdh.dll") Region: id = 1411 start_va = 0x7ffd8cd70000 end_va = 0x7ffd8cdacfff monitored = 1 entry_point = 0x7ffd8cd7b760 region_type = mapped_file name = "wmiprov.dll" filename = "\\Windows\\System32\\wbem\\wmiprov.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprov.dll") Region: id = 1412 start_va = 0x7ffd90450000 end_va = 0x7ffd90474fff monitored = 1 entry_point = 0x7ffd90465dc0 region_type = mapped_file name = "wmiperfclass.dll" filename = "\\Windows\\System32\\wbem\\WmiPerfClass.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiperfclass.dll") Region: id = 1413 start_va = 0x7ffd97150000 end_va = 0x7ffd97165fff monitored = 0 entry_point = 0x7ffd971555e0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1414 start_va = 0x7ffd972c0000 end_va = 0x7ffd972e4fff monitored = 0 entry_point = 0x7ffd972c9900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1415 start_va = 0x7ffd972f0000 end_va = 0x7ffd97303fff monitored = 0 entry_point = 0x7ffd972f1800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1416 start_va = 0x7ffd97350000 end_va = 0x7ffd97445fff monitored = 0 entry_point = 0x7ffd97389590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1417 start_va = 0x7ffd97630000 end_va = 0x7ffd97640fff monitored = 0 entry_point = 0x7ffd97632fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1418 start_va = 0x7ffd9b340000 end_va = 0x7ffd9b3befff monitored = 1 entry_point = 0x7ffd9b357110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1419 start_va = 0x7ffda1ea0000 end_va = 0x7ffda1eb0fff monitored = 0 entry_point = 0x7ffda1ea3320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 1420 start_va = 0x7ffda40c0000 end_va = 0x7ffda4123fff monitored = 0 entry_point = 0x7ffda40d5ae0 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1421 start_va = 0x7ffda70a0000 end_va = 0x7ffda70d0fff monitored = 0 entry_point = 0x7ffda70a7d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1422 start_va = 0x7ffda7a40000 end_va = 0x7ffda7a68fff monitored = 0 entry_point = 0x7ffda7a54530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1423 start_va = 0x7ffda7c00000 end_va = 0x7ffda7c0efff monitored = 0 entry_point = 0x7ffda7c03210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1424 start_va = 0x7ffda7cd0000 end_va = 0x7ffda7d39fff monitored = 0 entry_point = 0x7ffda7d06d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1425 start_va = 0x7ffda7d40000 end_va = 0x7ffda7f27fff monitored = 0 entry_point = 0x7ffda7d6ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1426 start_va = 0x7ffda8a30000 end_va = 0x7ffda8adcfff monitored = 0 entry_point = 0x7ffda8a481a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1427 start_va = 0x7ffda8ae0000 end_va = 0x7ffda8b86fff monitored = 0 entry_point = 0x7ffda8aeb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1428 start_va = 0x7ffda8ba0000 end_va = 0x7ffda8cbbfff monitored = 0 entry_point = 0x7ffda8be02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1429 start_va = 0x7ffda8cc0000 end_va = 0x7ffda8d80fff monitored = 0 entry_point = 0x7ffda8ce0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1430 start_va = 0x7ffda8ea0000 end_va = 0x7ffda8ff5fff monitored = 0 entry_point = 0x7ffda8eaa8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1431 start_va = 0x7ffda9000000 end_va = 0x7ffda927cfff monitored = 0 entry_point = 0x7ffda90d4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1432 start_va = 0x7ffda9800000 end_va = 0x7ffda986afff monitored = 0 entry_point = 0x7ffda98190c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1433 start_va = 0x7ffdaae30000 end_va = 0x7ffdaaeccfff monitored = 0 entry_point = 0x7ffdaae378a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1434 start_va = 0x7ffdaaee0000 end_va = 0x7ffdaaf86fff monitored = 0 entry_point = 0x7ffdaaef58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1435 start_va = 0x7ffdab030000 end_va = 0x7ffdab08afff monitored = 0 entry_point = 0x7ffdab0438b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1436 start_va = 0x7ffdab400000 end_va = 0x7ffdab585fff monitored = 0 entry_point = 0x7ffdab44ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1437 start_va = 0x7ffdab590000 end_va = 0x7ffdab750fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Thread: id = 111 os_tid = 0xbf8 Thread: id = 112 os_tid = 0x410 Thread: id = 113 os_tid = 0x630 [0277.803] DllCanUnloadNow () returned 0x1 [0277.803] DllCanUnloadNow () returned 0x1 Thread: id = 114 os_tid = 0xff8 Thread: id = 115 os_tid = 0x144 Thread: id = 116 os_tid = 0x874 Thread: id = 117 os_tid = 0x82c Thread: id = 118 os_tid = 0xb20 Process: id = "5" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x2010b000" os_pid = "0xe18" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x274" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:00038627" [0xc000000f] Region: id = 1175 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1176 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1177 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1178 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1179 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 1180 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1181 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1182 start_va = 0x100000 end_va = 0x1bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1183 start_va = 0x1c0000 end_va = 0x1c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 1184 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1185 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 1186 start_va = 0x1f0000 end_va = 0x1f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 1187 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1188 start_va = 0x400000 end_va = 0x400fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 1189 start_va = 0x410000 end_va = 0x414fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 1190 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1191 start_va = 0x430000 end_va = 0x430fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 1192 start_va = 0x440000 end_va = 0x440fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 1193 start_va = 0x450000 end_va = 0x452fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cimwin32.dll.mui" filename = "\\Windows\\System32\\wbem\\en-US\\cimwin32.dll.mui" (normalized: "c:\\windows\\system32\\wbem\\en-us\\cimwin32.dll.mui") Region: id = 1194 start_va = 0x460000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 1195 start_va = 0x470000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 1196 start_va = 0x5f0000 end_va = 0x926fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1197 start_va = 0x930000 end_va = 0xab7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000930000" filename = "" Region: id = 1198 start_va = 0xac0000 end_va = 0xc40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ac0000" filename = "" Region: id = 1199 start_va = 0xc50000 end_va = 0xd0ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c50000" filename = "" Region: id = 1200 start_va = 0xd90000 end_va = 0xe8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d90000" filename = "" Region: id = 1201 start_va = 0xe90000 end_va = 0xf0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e90000" filename = "" Region: id = 1202 start_va = 0xf90000 end_va = 0x100ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f90000" filename = "" Region: id = 1203 start_va = 0x1010000 end_va = 0x108ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001010000" filename = "" Region: id = 1204 start_va = 0x1110000 end_va = 0x118ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001110000" filename = "" Region: id = 1205 start_va = 0x1190000 end_va = 0x128ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001190000" filename = "" Region: id = 1206 start_va = 0x1290000 end_va = 0x130ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001290000" filename = "" Region: id = 1207 start_va = 0x1390000 end_va = 0x140ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001390000" filename = "" Region: id = 1208 start_va = 0x1410000 end_va = 0x148ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001410000" filename = "" Region: id = 1209 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1210 start_va = 0x180000000 end_va = 0x180002fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "security.dll" filename = "\\Windows\\System32\\security.dll" (normalized: "c:\\windows\\system32\\security.dll") Region: id = 1211 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 1212 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 1213 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 1214 start_va = 0x7ff61e550000 end_va = 0x7ff61e5cffff monitored = 0 entry_point = 0x7ff61e565f50 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 1215 start_va = 0x7ffd8ecc0000 end_va = 0x7ffd8ee8efff monitored = 1 entry_point = 0x7ffd8ece7df0 region_type = mapped_file name = "cimwin32.dll" filename = "\\Windows\\System32\\wbem\\cimwin32.dll" (normalized: "c:\\windows\\system32\\wbem\\cimwin32.dll") Region: id = 1216 start_va = 0x7ffd91320000 end_va = 0x7ffd9136dfff monitored = 0 entry_point = 0x7ffd91331ce0 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 1217 start_va = 0x7ffd92210000 end_va = 0x7ffd9221dfff monitored = 0 entry_point = 0x7ffd92211da0 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 1218 start_va = 0x7ffd97150000 end_va = 0x7ffd97165fff monitored = 0 entry_point = 0x7ffd971555e0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1219 start_va = 0x7ffd972c0000 end_va = 0x7ffd972e4fff monitored = 0 entry_point = 0x7ffd972c9900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1220 start_va = 0x7ffd972f0000 end_va = 0x7ffd97303fff monitored = 0 entry_point = 0x7ffd972f1800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1221 start_va = 0x7ffd97350000 end_va = 0x7ffd97445fff monitored = 0 entry_point = 0x7ffd97389590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1222 start_va = 0x7ffd982b0000 end_va = 0x7ffd982d5fff monitored = 0 entry_point = 0x7ffd982b1cf0 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1223 start_va = 0x7ffd9b340000 end_va = 0x7ffd9b3befff monitored = 1 entry_point = 0x7ffd9b357110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1224 start_va = 0x7ffd9b400000 end_va = 0x7ffd9b40bfff monitored = 0 entry_point = 0x7ffd9b4035c0 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1225 start_va = 0x7ffd9f020000 end_va = 0x7ffd9f031fff monitored = 0 entry_point = 0x7ffd9f023580 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 1226 start_va = 0x7ffd9f460000 end_va = 0x7ffd9f46afff monitored = 0 entry_point = 0x7ffd9f4612b0 region_type = mapped_file name = "schedcli.dll" filename = "\\Windows\\System32\\schedcli.dll" (normalized: "c:\\windows\\system32\\schedcli.dll") Region: id = 1227 start_va = 0x7ffd9f470000 end_va = 0x7ffd9f483fff monitored = 0 entry_point = 0x7ffd9f471310 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\System32\\browcli.dll" (normalized: "c:\\windows\\system32\\browcli.dll") Region: id = 1228 start_va = 0x7ffda11c0000 end_va = 0x7ffda11d8fff monitored = 0 entry_point = 0x7ffda11c4520 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1229 start_va = 0x7ffda18b0000 end_va = 0x7ffda18c5fff monitored = 0 entry_point = 0x7ffda18b1b60 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1230 start_va = 0x7ffda3fe0000 end_va = 0x7ffda401dfff monitored = 0 entry_point = 0x7ffda3fea050 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 1231 start_va = 0x7ffda4d20000 end_va = 0x7ffda4d29fff monitored = 0 entry_point = 0x7ffda4d21660 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1232 start_va = 0x7ffda62f0000 end_va = 0x7ffda6302fff monitored = 0 entry_point = 0x7ffda62f2760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1233 start_va = 0x7ffda65d0000 end_va = 0x7ffda65f6fff monitored = 0 entry_point = 0x7ffda65d7940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1234 start_va = 0x7ffda6fc0000 end_va = 0x7ffda6fcbfff monitored = 0 entry_point = 0x7ffda6fc27e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1235 start_va = 0x7ffda7100000 end_va = 0x7ffda7179fff monitored = 0 entry_point = 0x7ffda7121a50 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 1236 start_va = 0x7ffda7830000 end_va = 0x7ffda785cfff monitored = 0 entry_point = 0x7ffda7849d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1237 start_va = 0x7ffda79c0000 end_va = 0x7ffda7a15fff monitored = 0 entry_point = 0x7ffda79d0bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1238 start_va = 0x7ffda7a40000 end_va = 0x7ffda7a68fff monitored = 0 entry_point = 0x7ffda7a54530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1239 start_va = 0x7ffda7bb0000 end_va = 0x7ffda7bfafff monitored = 0 entry_point = 0x7ffda7bb35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1240 start_va = 0x7ffda7c00000 end_va = 0x7ffda7c0efff monitored = 0 entry_point = 0x7ffda7c03210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1241 start_va = 0x7ffda7c30000 end_va = 0x7ffda7c3ffff monitored = 0 entry_point = 0x7ffda7c356e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1242 start_va = 0x7ffda7cd0000 end_va = 0x7ffda7d39fff monitored = 0 entry_point = 0x7ffda7d06d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1243 start_va = 0x7ffda7d40000 end_va = 0x7ffda7f27fff monitored = 0 entry_point = 0x7ffda7d6ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1244 start_va = 0x7ffda7f30000 end_va = 0x7ffda80f6fff monitored = 0 entry_point = 0x7ffda7f8db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1245 start_va = 0x7ffda8100000 end_va = 0x7ffda8142fff monitored = 0 entry_point = 0x7ffda8114b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1246 start_va = 0x7ffda8970000 end_va = 0x7ffda8986fff monitored = 0 entry_point = 0x7ffda8971390 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1247 start_va = 0x7ffda8a30000 end_va = 0x7ffda8adcfff monitored = 0 entry_point = 0x7ffda8a481a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1248 start_va = 0x7ffda8ae0000 end_va = 0x7ffda8b86fff monitored = 0 entry_point = 0x7ffda8aeb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1249 start_va = 0x7ffda8ba0000 end_va = 0x7ffda8cbbfff monitored = 0 entry_point = 0x7ffda8be02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1250 start_va = 0x7ffda8cc0000 end_va = 0x7ffda8d80fff monitored = 0 entry_point = 0x7ffda8ce0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1251 start_va = 0x7ffda8ea0000 end_va = 0x7ffda8ff5fff monitored = 0 entry_point = 0x7ffda8eaa8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1252 start_va = 0x7ffda9000000 end_va = 0x7ffda927cfff monitored = 0 entry_point = 0x7ffda90d4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1253 start_va = 0x7ffda9800000 end_va = 0x7ffda986afff monitored = 0 entry_point = 0x7ffda98190c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1254 start_va = 0x7ffdaae30000 end_va = 0x7ffdaaeccfff monitored = 0 entry_point = 0x7ffdaae378a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1255 start_va = 0x7ffdaaee0000 end_va = 0x7ffdaaf86fff monitored = 0 entry_point = 0x7ffdaaef58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1256 start_va = 0x7ffdab030000 end_va = 0x7ffdab08afff monitored = 0 entry_point = 0x7ffdab0438b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1257 start_va = 0x7ffdab400000 end_va = 0x7ffdab585fff monitored = 0 entry_point = 0x7ffdab44ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1258 start_va = 0x7ffdab590000 end_va = 0x7ffdab750fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1259 start_va = 0x570000 end_va = 0x572fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 1299 start_va = 0x570000 end_va = 0x571fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 1300 start_va = 0x580000 end_va = 0x584fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000580000" filename = "" Region: id = 1301 start_va = 0x1490000 end_va = 0x158ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001490000" filename = "" Region: id = 1302 start_va = 0x580000 end_va = 0x595fff monitored = 0 entry_point = 0x590420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1303 start_va = 0x5a0000 end_va = 0x5a2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1304 start_va = 0x580000 end_va = 0x595fff monitored = 0 entry_point = 0x590420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1305 start_va = 0x5a0000 end_va = 0x5a2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1306 start_va = 0x580000 end_va = 0x595fff monitored = 0 entry_point = 0x590420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1307 start_va = 0x5a0000 end_va = 0x5a2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1308 start_va = 0x580000 end_va = 0x595fff monitored = 0 entry_point = 0x590420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1309 start_va = 0x5a0000 end_va = 0x5a2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1310 start_va = 0x580000 end_va = 0x599fff monitored = 1 entry_point = 0x581190 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 1311 start_va = 0x5a0000 end_va = 0x5a5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 1312 start_va = 0x580000 end_va = 0x599fff monitored = 1 entry_point = 0x581190 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 1313 start_va = 0x5a0000 end_va = 0x5a5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 1314 start_va = 0x580000 end_va = 0x5aafff monitored = 0 entry_point = 0x59d000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1315 start_va = 0x5b0000 end_va = 0x5b4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1316 start_va = 0x1650000 end_va = 0x1a4afff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001650000" filename = "" Region: id = 1317 start_va = 0x580000 end_va = 0x5aafff monitored = 0 entry_point = 0x59d000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1318 start_va = 0x5b0000 end_va = 0x5b4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1319 start_va = 0x580000 end_va = 0x5aafff monitored = 0 entry_point = 0x59d000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1320 start_va = 0x5b0000 end_va = 0x5b4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1321 start_va = 0x580000 end_va = 0x5aafff monitored = 0 entry_point = 0x59d000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1322 start_va = 0x5b0000 end_va = 0x5b4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1323 start_va = 0x580000 end_va = 0x5a8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 1324 start_va = 0x1a50000 end_va = 0x1b33fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 1325 start_va = 0x580000 end_va = 0x5a8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 1326 start_va = 0x1a50000 end_va = 0x1b33fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 1327 start_va = 0x580000 end_va = 0x585fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 1328 start_va = 0x1590000 end_va = 0x1622fff monitored = 0 entry_point = 0x1609000 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 1329 start_va = 0x580000 end_va = 0x585fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 1330 start_va = 0x1590000 end_va = 0x1622fff monitored = 0 entry_point = 0x1609000 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 1331 start_va = 0x580000 end_va = 0x585fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fvevol.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui") Region: id = 1332 start_va = 0x1590000 end_va = 0x1630fff monitored = 0 entry_point = 0x1623000 region_type = mapped_file name = "fvevol.sys" filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys") Region: id = 1333 start_va = 0x580000 end_va = 0x585fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fvevol.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui") Region: id = 1334 start_va = 0x1590000 end_va = 0x1630fff monitored = 0 entry_point = 0x1623000 region_type = mapped_file name = "fvevol.sys" filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys") Region: id = 1335 start_va = 0x580000 end_va = 0x58afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1336 start_va = 0x1590000 end_va = 0x1615fff monitored = 0 entry_point = 0x1601000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1337 start_va = 0x580000 end_va = 0x58afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1338 start_va = 0x1590000 end_va = 0x1615fff monitored = 0 entry_point = 0x1601000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1339 start_va = 0x580000 end_va = 0x58afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1340 start_va = 0x1590000 end_va = 0x1615fff monitored = 0 entry_point = 0x1601000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1341 start_va = 0x580000 end_va = 0x58afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1342 start_va = 0x1590000 end_va = 0x1615fff monitored = 0 entry_point = 0x1601000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1344 start_va = 0x580000 end_va = 0x58efff monitored = 0 entry_point = 0x5836e0 region_type = mapped_file name = "dmvsc.sys" filename = "\\Windows\\System32\\drivers\\dmvsc.sys" (normalized: "c:\\windows\\system32\\drivers\\dmvsc.sys") Region: id = 1345 start_va = 0x590000 end_va = 0x591fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dmvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\dmvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\dmvsc.sys.mui") Region: id = 1346 start_va = 0x580000 end_va = 0x58efff monitored = 0 entry_point = 0x5836e0 region_type = mapped_file name = "dmvsc.sys" filename = "\\Windows\\System32\\drivers\\dmvsc.sys" (normalized: "c:\\windows\\system32\\drivers\\dmvsc.sys") Region: id = 1347 start_va = 0x590000 end_va = 0x591fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dmvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\dmvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\dmvsc.sys.mui") Region: id = 1349 start_va = 0x580000 end_va = 0x59afff monitored = 1 entry_point = 0x581190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1350 start_va = 0x5a0000 end_va = 0x5abfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1351 start_va = 0x580000 end_va = 0x59afff monitored = 1 entry_point = 0x581190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1352 start_va = 0x5a0000 end_va = 0x5abfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1353 start_va = 0x580000 end_va = 0x59afff monitored = 1 entry_point = 0x581190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1354 start_va = 0x5a0000 end_va = 0x5abfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1355 start_va = 0x580000 end_va = 0x59afff monitored = 1 entry_point = 0x581190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1356 start_va = 0x5a0000 end_va = 0x5abfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1357 start_va = 0x580000 end_va = 0x59afff monitored = 1 entry_point = 0x581190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1358 start_va = 0x5a0000 end_va = 0x5abfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1359 start_va = 0x580000 end_va = 0x59afff monitored = 1 entry_point = 0x581190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1360 start_va = 0x5a0000 end_va = 0x5abfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1361 start_va = 0x580000 end_va = 0x581fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 1362 start_va = 0x1a50000 end_va = 0x1b5efff monitored = 0 entry_point = 0x1a8c010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 1363 start_va = 0x580000 end_va = 0x581fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 1364 start_va = 0x1a50000 end_va = 0x1b5efff monitored = 0 entry_point = 0x1a8c010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 1365 start_va = 0x580000 end_va = 0x596fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 1366 start_va = 0x1a50000 end_va = 0x1ca6fff monitored = 0 entry_point = 0x1c5ce10 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 1367 start_va = 0x580000 end_va = 0x596fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 1368 start_va = 0x1a50000 end_va = 0x1ca6fff monitored = 0 entry_point = 0x1c5ce10 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 1369 start_va = 0x580000 end_va = 0x589fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1370 start_va = 0x1a50000 end_va = 0x1b60fff monitored = 0 entry_point = 0x1b41bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1438 start_va = 0x580000 end_va = 0x589fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1439 start_va = 0x1a50000 end_va = 0x1b60fff monitored = 0 entry_point = 0x1b41bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1440 start_va = 0x580000 end_va = 0x589fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1441 start_va = 0x1a50000 end_va = 0x1b60fff monitored = 0 entry_point = 0x1b41bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1442 start_va = 0x580000 end_va = 0x589fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1443 start_va = 0x1a50000 end_va = 0x1b60fff monitored = 0 entry_point = 0x1b41bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1444 start_va = 0x580000 end_va = 0x589fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1445 start_va = 0x1a50000 end_va = 0x1b60fff monitored = 0 entry_point = 0x1b41bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1446 start_va = 0x580000 end_va = 0x589fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1447 start_va = 0x1a50000 end_va = 0x1b60fff monitored = 0 entry_point = 0x1b41bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1448 start_va = 0x580000 end_va = 0x58ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 1449 start_va = 0x590000 end_va = 0x59dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 1450 start_va = 0x580000 end_va = 0x58ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 1451 start_va = 0x590000 end_va = 0x59dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 1452 start_va = 0x580000 end_va = 0x591fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1453 start_va = 0x1590000 end_va = 0x163efff monitored = 0 entry_point = 0x1607000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1454 start_va = 0x580000 end_va = 0x591fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1455 start_va = 0x1590000 end_va = 0x163efff monitored = 0 entry_point = 0x1607000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1456 start_va = 0x580000 end_va = 0x591fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1457 start_va = 0x1590000 end_va = 0x163efff monitored = 0 entry_point = 0x1607000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1458 start_va = 0x580000 end_va = 0x591fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1459 start_va = 0x1590000 end_va = 0x163efff monitored = 0 entry_point = 0x1607000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1460 start_va = 0x580000 end_va = 0x591fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1461 start_va = 0x1590000 end_va = 0x163efff monitored = 0 entry_point = 0x1607000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1462 start_va = 0x580000 end_va = 0x591fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1463 start_va = 0x1590000 end_va = 0x163efff monitored = 0 entry_point = 0x1607000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1464 start_va = 0x580000 end_va = 0x5e0fff monitored = 0 entry_point = 0x590770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1465 start_va = 0xd10000 end_va = 0xd13fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1466 start_va = 0x580000 end_va = 0x5e0fff monitored = 0 entry_point = 0x590770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1467 start_va = 0xd10000 end_va = 0xd13fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1468 start_va = 0x580000 end_va = 0x5e0fff monitored = 0 entry_point = 0x590770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1469 start_va = 0xd10000 end_va = 0xd13fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1470 start_va = 0x580000 end_va = 0x5e0fff monitored = 0 entry_point = 0x590770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1471 start_va = 0xd10000 end_va = 0xd13fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1472 start_va = 0x580000 end_va = 0x5e0fff monitored = 0 entry_point = 0x590770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1473 start_va = 0xd10000 end_va = 0xd13fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1474 start_va = 0x580000 end_va = 0x5e0fff monitored = 0 entry_point = 0x590770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1475 start_va = 0xd10000 end_va = 0xd13fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1476 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1477 start_va = 0x1a50000 end_va = 0x1b6ffff monitored = 0 entry_point = 0x1b4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1478 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1479 start_va = 0x1a50000 end_va = 0x1b6ffff monitored = 0 entry_point = 0x1b4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1480 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1481 start_va = 0x1a50000 end_va = 0x1b6ffff monitored = 0 entry_point = 0x1b4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1482 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1483 start_va = 0x1a50000 end_va = 0x1b6ffff monitored = 0 entry_point = 0x1b4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1484 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1485 start_va = 0x1a50000 end_va = 0x1b6ffff monitored = 0 entry_point = 0x1b4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1486 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1487 start_va = 0x1a50000 end_va = 0x1b6ffff monitored = 0 entry_point = 0x1b4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1488 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1489 start_va = 0x1a50000 end_va = 0x1b6ffff monitored = 0 entry_point = 0x1b4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1490 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1491 start_va = 0x1a50000 end_va = 0x1b6ffff monitored = 0 entry_point = 0x1b4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1492 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1493 start_va = 0x1a50000 end_va = 0x1b6ffff monitored = 0 entry_point = 0x1b4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1494 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1495 start_va = 0x1a50000 end_va = 0x1b6ffff monitored = 0 entry_point = 0x1b4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1496 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1497 start_va = 0x1a50000 end_va = 0x1b6ffff monitored = 0 entry_point = 0x1b4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1498 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1499 start_va = 0x1a50000 end_va = 0x1b6ffff monitored = 0 entry_point = 0x1b4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1500 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1501 start_va = 0x1a50000 end_va = 0x1b6ffff monitored = 0 entry_point = 0x1b4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1502 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1503 start_va = 0x1a50000 end_va = 0x1b6ffff monitored = 0 entry_point = 0x1b4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1504 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1505 start_va = 0x1a50000 end_va = 0x1b6ffff monitored = 0 entry_point = 0x1b4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1506 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1507 start_va = 0x1a50000 end_va = 0x1b6ffff monitored = 0 entry_point = 0x1b4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1508 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1509 start_va = 0x1a50000 end_va = 0x1b6ffff monitored = 0 entry_point = 0x1b4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1510 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1511 start_va = 0x1a50000 end_va = 0x1b6ffff monitored = 0 entry_point = 0x1b4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1512 start_va = 0x580000 end_va = 0x582fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1513 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1514 start_va = 0x580000 end_va = 0x582fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1515 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1516 start_va = 0x580000 end_va = 0x582fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1517 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1518 start_va = 0x580000 end_va = 0x582fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1519 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1520 start_va = 0x580000 end_va = 0x582fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1521 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1522 start_va = 0x580000 end_va = 0x582fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1523 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1524 start_va = 0x580000 end_va = 0x582fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1525 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1526 start_va = 0x580000 end_va = 0x582fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1527 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1528 start_va = 0x580000 end_va = 0x582fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1529 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1530 start_va = 0x580000 end_va = 0x582fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1531 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1532 start_va = 0x580000 end_va = 0x582fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1533 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1534 start_va = 0x580000 end_va = 0x582fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1535 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1536 start_va = 0x580000 end_va = 0x582fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1537 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1538 start_va = 0x580000 end_va = 0x582fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1539 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1540 start_va = 0x580000 end_va = 0x58ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mrxsmb.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\mrxsmb.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\mrxsmb.sys.mui") Region: id = 1541 start_va = 0xd10000 end_va = 0xd81fff monitored = 0 entry_point = 0xd67000 region_type = mapped_file name = "mrxsmb.sys" filename = "\\Windows\\System32\\drivers\\mrxsmb.sys" (normalized: "c:\\windows\\system32\\drivers\\mrxsmb.sys") Region: id = 1542 start_va = 0x580000 end_va = 0x58ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mrxsmb.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\mrxsmb.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\mrxsmb.sys.mui") Region: id = 1543 start_va = 0xd10000 end_va = 0xd81fff monitored = 0 entry_point = 0xd67000 region_type = mapped_file name = "mrxsmb.sys" filename = "\\Windows\\System32\\drivers\\mrxsmb.sys" (normalized: "c:\\windows\\system32\\drivers\\mrxsmb.sys") Region: id = 1544 start_va = 0x580000 end_va = 0x595fff monitored = 0 entry_point = 0x590420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1545 start_va = 0x5a0000 end_va = 0x5a2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1546 start_va = 0x580000 end_va = 0x595fff monitored = 0 entry_point = 0x590420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1547 start_va = 0x5a0000 end_va = 0x5a2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1548 start_va = 0x580000 end_va = 0x595fff monitored = 0 entry_point = 0x590420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1549 start_va = 0x5a0000 end_va = 0x5a2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1550 start_va = 0x580000 end_va = 0x595fff monitored = 0 entry_point = 0x590420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1551 start_va = 0x5a0000 end_va = 0x5a2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1552 start_va = 0x580000 end_va = 0x599fff monitored = 1 entry_point = 0x581190 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 1553 start_va = 0x5a0000 end_va = 0x5a5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 1554 start_va = 0x580000 end_va = 0x599fff monitored = 1 entry_point = 0x581190 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 1555 start_va = 0x5a0000 end_va = 0x5a5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 1556 start_va = 0x580000 end_va = 0x5aafff monitored = 0 entry_point = 0x59d000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1557 start_va = 0x5b0000 end_va = 0x5b4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1558 start_va = 0x580000 end_va = 0x5aafff monitored = 0 entry_point = 0x59d000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1559 start_va = 0x5b0000 end_va = 0x5b4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1560 start_va = 0x580000 end_va = 0x5aafff monitored = 0 entry_point = 0x59d000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1561 start_va = 0x5b0000 end_va = 0x5b4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1562 start_va = 0x580000 end_va = 0x5aafff monitored = 0 entry_point = 0x59d000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1563 start_va = 0x5b0000 end_va = 0x5b4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1564 start_va = 0x580000 end_va = 0x5a8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 1565 start_va = 0x1a50000 end_va = 0x1b33fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 1566 start_va = 0x580000 end_va = 0x5a8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 1567 start_va = 0x1a50000 end_va = 0x1b33fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 1568 start_va = 0x580000 end_va = 0x585fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 1569 start_va = 0x1590000 end_va = 0x1622fff monitored = 0 entry_point = 0x1609000 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 1570 start_va = 0x580000 end_va = 0x585fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 1571 start_va = 0x1590000 end_va = 0x1622fff monitored = 0 entry_point = 0x1609000 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 1572 start_va = 0x580000 end_va = 0x585fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fvevol.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui") Region: id = 1573 start_va = 0x1590000 end_va = 0x1630fff monitored = 0 entry_point = 0x1623000 region_type = mapped_file name = "fvevol.sys" filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys") Region: id = 1574 start_va = 0x580000 end_va = 0x585fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fvevol.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui") Region: id = 1575 start_va = 0x1590000 end_va = 0x1630fff monitored = 0 entry_point = 0x1623000 region_type = mapped_file name = "fvevol.sys" filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys") Region: id = 1576 start_va = 0x580000 end_va = 0x58afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1577 start_va = 0x1590000 end_va = 0x1615fff monitored = 0 entry_point = 0x1601000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1578 start_va = 0x580000 end_va = 0x58afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1579 start_va = 0x1590000 end_va = 0x1615fff monitored = 0 entry_point = 0x1601000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1580 start_va = 0x580000 end_va = 0x58afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1581 start_va = 0x1590000 end_va = 0x1615fff monitored = 0 entry_point = 0x1601000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1582 start_va = 0x580000 end_va = 0x58afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1583 start_va = 0x1590000 end_va = 0x1615fff monitored = 0 entry_point = 0x1601000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1584 start_va = 0x580000 end_va = 0x58efff monitored = 0 entry_point = 0x5836e0 region_type = mapped_file name = "dmvsc.sys" filename = "\\Windows\\System32\\drivers\\dmvsc.sys" (normalized: "c:\\windows\\system32\\drivers\\dmvsc.sys") Region: id = 1585 start_va = 0x590000 end_va = 0x591fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dmvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\dmvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\dmvsc.sys.mui") Region: id = 1586 start_va = 0x580000 end_va = 0x59afff monitored = 1 entry_point = 0x581190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1587 start_va = 0x5a0000 end_va = 0x5abfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1588 start_va = 0x580000 end_va = 0x59afff monitored = 1 entry_point = 0x581190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1589 start_va = 0x5a0000 end_va = 0x5abfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1590 start_va = 0x580000 end_va = 0x59afff monitored = 1 entry_point = 0x581190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1591 start_va = 0x5a0000 end_va = 0x5abfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1592 start_va = 0x580000 end_va = 0x59afff monitored = 1 entry_point = 0x581190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1593 start_va = 0x5a0000 end_va = 0x5abfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1594 start_va = 0x580000 end_va = 0x59afff monitored = 1 entry_point = 0x581190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1595 start_va = 0x5a0000 end_va = 0x5abfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1596 start_va = 0x580000 end_va = 0x59afff monitored = 1 entry_point = 0x581190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1597 start_va = 0x5a0000 end_va = 0x5abfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1598 start_va = 0x580000 end_va = 0x59afff monitored = 1 entry_point = 0x581190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1599 start_va = 0x5a0000 end_va = 0x5abfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1600 start_va = 0x580000 end_va = 0x581fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 1601 start_va = 0x1a50000 end_va = 0x1b5efff monitored = 0 entry_point = 0x1a8c010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 1602 start_va = 0x580000 end_va = 0x581fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 1603 start_va = 0x1a50000 end_va = 0x1b5efff monitored = 0 entry_point = 0x1a8c010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 1604 start_va = 0x580000 end_va = 0x596fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 1605 start_va = 0x1a50000 end_va = 0x1ca6fff monitored = 0 entry_point = 0x1c5ce10 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 1606 start_va = 0x580000 end_va = 0x596fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 1607 start_va = 0x1a50000 end_va = 0x1ca6fff monitored = 0 entry_point = 0x1c5ce10 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 1608 start_va = 0x580000 end_va = 0x589fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1609 start_va = 0x1a50000 end_va = 0x1b60fff monitored = 0 entry_point = 0x1b41bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1610 start_va = 0x580000 end_va = 0x589fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1611 start_va = 0x1a50000 end_va = 0x1b60fff monitored = 0 entry_point = 0x1b41bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1612 start_va = 0x580000 end_va = 0x589fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1613 start_va = 0x1a50000 end_va = 0x1b60fff monitored = 0 entry_point = 0x1b41bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1614 start_va = 0x580000 end_va = 0x589fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1615 start_va = 0x1a50000 end_va = 0x1b60fff monitored = 0 entry_point = 0x1b41bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1616 start_va = 0x580000 end_va = 0x589fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1617 start_va = 0x1a50000 end_va = 0x1b60fff monitored = 0 entry_point = 0x1b41bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1618 start_va = 0x580000 end_va = 0x589fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1619 start_va = 0x1a50000 end_va = 0x1b60fff monitored = 0 entry_point = 0x1b41bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1620 start_va = 0x580000 end_va = 0x58ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 1621 start_va = 0x590000 end_va = 0x59dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 1622 start_va = 0x580000 end_va = 0x58ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 1623 start_va = 0x590000 end_va = 0x59dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 1624 start_va = 0x580000 end_va = 0x58ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 1625 start_va = 0x590000 end_va = 0x59dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 1626 start_va = 0x580000 end_va = 0x591fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1627 start_va = 0x1590000 end_va = 0x163efff monitored = 0 entry_point = 0x1607000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1628 start_va = 0x580000 end_va = 0x591fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1629 start_va = 0x1590000 end_va = 0x163efff monitored = 0 entry_point = 0x1607000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1630 start_va = 0x580000 end_va = 0x591fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1631 start_va = 0x1590000 end_va = 0x163efff monitored = 0 entry_point = 0x1607000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1632 start_va = 0x580000 end_va = 0x591fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1633 start_va = 0x1590000 end_va = 0x163efff monitored = 0 entry_point = 0x1607000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1634 start_va = 0x1a50000 end_va = 0x1c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a50000" filename = "" Region: id = 1635 start_va = 0x580000 end_va = 0x591fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1636 start_va = 0x1590000 end_va = 0x163efff monitored = 0 entry_point = 0x1607000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1637 start_va = 0x580000 end_va = 0x591fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1638 start_va = 0x1590000 end_va = 0x163efff monitored = 0 entry_point = 0x1607000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1639 start_va = 0x580000 end_va = 0x5e0fff monitored = 0 entry_point = 0x590770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1640 start_va = 0xd10000 end_va = 0xd13fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1641 start_va = 0x580000 end_va = 0x5e0fff monitored = 0 entry_point = 0x590770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1642 start_va = 0xd10000 end_va = 0xd13fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1643 start_va = 0x580000 end_va = 0x5e0fff monitored = 0 entry_point = 0x590770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1644 start_va = 0xd10000 end_va = 0xd13fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1645 start_va = 0x580000 end_va = 0x5e0fff monitored = 0 entry_point = 0x590770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1646 start_va = 0xd10000 end_va = 0xd13fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1647 start_va = 0x580000 end_va = 0x5e0fff monitored = 0 entry_point = 0x590770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1648 start_va = 0xd10000 end_va = 0xd13fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1649 start_va = 0x580000 end_va = 0x5e0fff monitored = 0 entry_point = 0x590770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1650 start_va = 0xd10000 end_va = 0xd13fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1651 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1652 start_va = 0x1c50000 end_va = 0x1d6ffff monitored = 0 entry_point = 0x1d4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1653 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1654 start_va = 0x1c50000 end_va = 0x1d6ffff monitored = 0 entry_point = 0x1d4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1655 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1656 start_va = 0x1c50000 end_va = 0x1d6ffff monitored = 0 entry_point = 0x1d4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1657 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1658 start_va = 0x1c50000 end_va = 0x1d6ffff monitored = 0 entry_point = 0x1d4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1659 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1660 start_va = 0x1c50000 end_va = 0x1d6ffff monitored = 0 entry_point = 0x1d4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1661 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1662 start_va = 0x1c50000 end_va = 0x1d6ffff monitored = 0 entry_point = 0x1d4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1663 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1664 start_va = 0x1c50000 end_va = 0x1d6ffff monitored = 0 entry_point = 0x1d4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1665 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1666 start_va = 0x1c50000 end_va = 0x1d6ffff monitored = 0 entry_point = 0x1d4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1667 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1668 start_va = 0x1c50000 end_va = 0x1d6ffff monitored = 0 entry_point = 0x1d4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1669 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1670 start_va = 0x1c50000 end_va = 0x1d6ffff monitored = 0 entry_point = 0x1d4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1671 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1672 start_va = 0x1c50000 end_va = 0x1d6ffff monitored = 0 entry_point = 0x1d4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1673 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1674 start_va = 0x1c50000 end_va = 0x1d6ffff monitored = 0 entry_point = 0x1d4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1675 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1676 start_va = 0x1c50000 end_va = 0x1d6ffff monitored = 0 entry_point = 0x1d4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1677 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1678 start_va = 0x1c50000 end_va = 0x1d6ffff monitored = 0 entry_point = 0x1d4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1679 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1680 start_va = 0x1c50000 end_va = 0x1d6ffff monitored = 0 entry_point = 0x1d4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1681 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1682 start_va = 0x1c50000 end_va = 0x1d6ffff monitored = 0 entry_point = 0x1d4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1683 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1684 start_va = 0x1c50000 end_va = 0x1d6ffff monitored = 0 entry_point = 0x1d4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1685 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1686 start_va = 0x1c50000 end_va = 0x1d6ffff monitored = 0 entry_point = 0x1d4c040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1687 start_va = 0x580000 end_va = 0x582fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1688 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1689 start_va = 0x580000 end_va = 0x582fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1690 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1691 start_va = 0x580000 end_va = 0x582fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1692 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1693 start_va = 0x580000 end_va = 0x582fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1694 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1695 start_va = 0x580000 end_va = 0x582fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1696 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1697 start_va = 0x580000 end_va = 0x582fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1698 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1699 start_va = 0x580000 end_va = 0x582fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1700 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1701 start_va = 0x580000 end_va = 0x582fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1702 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1703 start_va = 0x580000 end_va = 0x582fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1704 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1705 start_va = 0x580000 end_va = 0x582fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1706 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1707 start_va = 0x580000 end_va = 0x582fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1708 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1709 start_va = 0x580000 end_va = 0x582fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1710 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1711 start_va = 0x580000 end_va = 0x582fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1712 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1713 start_va = 0x580000 end_va = 0x582fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1714 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1715 start_va = 0x580000 end_va = 0x582fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1716 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1717 start_va = 0x580000 end_va = 0x58ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mrxsmb.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\mrxsmb.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\mrxsmb.sys.mui") Region: id = 1718 start_va = 0xd10000 end_va = 0xd81fff monitored = 0 entry_point = 0xd67000 region_type = mapped_file name = "mrxsmb.sys" filename = "\\Windows\\System32\\drivers\\mrxsmb.sys" (normalized: "c:\\windows\\system32\\drivers\\mrxsmb.sys") Region: id = 1719 start_va = 0x580000 end_va = 0x58ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mrxsmb.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\mrxsmb.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\mrxsmb.sys.mui") Region: id = 1720 start_va = 0xd10000 end_va = 0xd81fff monitored = 0 entry_point = 0xd67000 region_type = mapped_file name = "mrxsmb.sys" filename = "\\Windows\\System32\\drivers\\mrxsmb.sys" (normalized: "c:\\windows\\system32\\drivers\\mrxsmb.sys") Region: id = 1721 start_va = 0x7ffda0db0000 end_va = 0x7ffda0dbdfff monitored = 0 entry_point = 0x7ffda0db2b10 region_type = mapped_file name = "perfos.dll" filename = "\\Windows\\System32\\perfos.dll" (normalized: "c:\\windows\\system32\\perfos.dll") Region: id = 1732 start_va = 0x580000 end_va = 0x582fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000580000" filename = "" Region: id = 1733 start_va = 0x7ffda17d0000 end_va = 0x7ffda1807fff monitored = 0 entry_point = 0x7ffda17e8cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1734 start_va = 0x7ffda8b90000 end_va = 0x7ffda8b97fff monitored = 0 entry_point = 0x7ffda8b91ea0 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1735 start_va = 0x1590000 end_va = 0x160ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001590000" filename = "" Region: id = 1736 start_va = 0x7ffda17b0000 end_va = 0x7ffda17c5fff monitored = 0 entry_point = 0x7ffda17b19f0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1737 start_va = 0x7ffda1790000 end_va = 0x7ffda17a9fff monitored = 0 entry_point = 0x7ffda1792430 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1739 start_va = 0x7ffda6620000 end_va = 0x7ffda66c9fff monitored = 0 entry_point = 0x7ffda6647910 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2153 start_va = 0x590000 end_va = 0x593fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000590000" filename = "" Thread: id = 119 os_tid = 0x13e4 Thread: id = 120 os_tid = 0x1390 Thread: id = 121 os_tid = 0xde8 Thread: id = 122 os_tid = 0xe3c Thread: id = 123 os_tid = 0xe34 [0256.059] DllCanUnloadNow () returned 0x1 Thread: id = 124 os_tid = 0xe30 Thread: id = 125 os_tid = 0xe28 [0205.343] LoadStringW (in: hInstance=0x7ffd8ecc0000, uID=0x3e, lpBuffer=0xf0d6c0, cchBufferMax=256 | out: lpBuffer="Base Board") returned 0xa [0205.343] lstrlenW (lpString="Dell Inc.") returned 9 [0205.343] lstrlenW (lpString="0G3HR7") returned 6 [0205.343] lstrlenW (lpString="A00") returned 3 [0205.343] lstrlenW (lpString="..XXXXXXXXXXXXX.") returned 16 [0207.938] malloc (_Size=0x600) returned 0xde10a0 [0207.938] GetLogicalProcessorInformationEx (in: RelationshipType=0xffff, Buffer=0x0, ReturnedLength=0xf0d7f8 | out: Buffer=0x0, ReturnedLength=0xf0d7f8) returned 0 [0207.938] GetLastError () returned 0x7a [0207.938] malloc (_Size=0x250) returned 0xdb3ab0 [0207.938] GetLogicalProcessorInformationEx (in: RelationshipType=0xffff, Buffer=0xdb3ab0, ReturnedLength=0xf0d7f8 | out: Buffer=0xdb3ab0, ReturnedLength=0xf0d7f8) returned 1 [0207.938] GetActiveProcessorCount (GroupNumber=0xffff) returned 0x4 [0207.939] GetMaximumProcessorGroupCount () returned 0x1 [0207.939] malloc (_Size=0x40) returned 0xddfc40 [0207.939] malloc (_Size=0x40) returned 0xddffb0 [0207.939] malloc (_Size=0x8) returned 0xdb3980 [0207.939] memcpy (in: _Dst=0xddfc40, _Src=0xdb3ad0, _Size=0x10 | out: _Dst=0xddfc40) returned 0xddfc40 [0207.949] GetActiveProcessorCount (GroupNumber=0x0) returned 0x4 [0207.950] NtPowerInformation (in: InformationLevel=0x2e, InputBuffer=0xf0d7f0, InputBufferLength=0x2, OutputBuffer=0xde10a0, OutputBufferLength=0x60 | out: OutputBuffer=0xde10a0) returned 0x0 [0207.950] _vsnwprintf (in: _Buffer=0xf0d690, _BufferCount=0x63, _Format="CPU%d", _ArgList=0xf0cf88 | out: _Buffer="CPU0") returned 4 [0207.950] GetCurrentThread () returned 0xfffffffffffffffe [0207.950] SetThreadGroupAffinity (in: hThread=0xfffffffffffffffe, GroupAffinity=0xf0cee0, PreviousGroupAffinity=0xf0cef0 | out: PreviousGroupAffinity=0xf0cef0) returned 1 [0207.952] GetSystemInfo (in: lpSystemInfo=0xf0d020 | out: lpSystemInfo=0xf0d020*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0207.952] mbstowcs (in: _Dest=0xf0d2a8, _Source="GenuineIntel", _MaxCount=0x28 | out: _Dest="GenuineIntel") returned 0xc [0207.952] _wcsicmp (_String1="GenuineIntel", _String2="GenuineIntel") returned 0 [0207.954] mbstowcs (in: _Dest=0xf0d118, _Source="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", _MaxCount=0x28 | out: _Dest="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x27 [0207.954] GetCurrentThread () returned 0xfffffffffffffffe [0207.954] SetThreadGroupAffinity (in: hThread=0xfffffffffffffffe, GroupAffinity=0xf0cef0, PreviousGroupAffinity=0x0 | out: PreviousGroupAffinity=0x0) returned 1 [0207.955] LoadStringW (in: hInstance=0x7ffd8ecc0000, uID=0x2c, lpBuffer=0xf0ccf0, cchBufferMax=256 | out: lpBuffer="CPU %d") returned 0x6 [0218.635] malloc (_Size=0x34c34) returned 0xde1fd0 [0218.655] _wtoi (_String="238") returned 238 [0218.655] _wtoi (_String="6") returned 6 [0218.655] _itow (in: _Dest=0x0, _Radix=15783360 | out: _Dest=0x0) returned="0" [0218.655] _itow (in: _Dest=0xee, _Radix=15781648 | out: _Dest=0xee) returned="238" [0218.655] malloc (_Size=0x4000) returned 0xe16c10 [0218.655] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x0, lpData=0xe16c10, lpcbData=0xf0cee4*=0x4000 | out: lpType=0x0, lpData=0xe16c10*=0x50, lpcbData=0xf0cee4*=0x600) returned 0x0 [0218.806] free (_Block=0xe16c10) [0218.806] Sleep (dwMilliseconds=0x3e8) [0219.806] _itow (in: _Dest=0xee, _Radix=15781648 | out: _Dest=0xee) returned="238" [0219.806] malloc (_Size=0x4000) returned 0xe16c10 [0219.806] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x0, lpData=0xe16c10, lpcbData=0xf0cee4*=0x4000 | out: lpType=0x0, lpData=0xe16c10*=0x50, lpcbData=0xf0cee4*=0x600) returned 0x0 [0219.878] free (_Block=0xe16c10) [0219.882] free (_Block=0xde1fd0) [0219.888] _vsnwprintf (in: _Buffer=0xf0d5c0, _BufferCount=0x40, _Format="%04X%04X%04X%04X", _ArgList=0xf0cf88 | out: _Buffer="0F8BFBFF00050654") returned 16 [0219.891] lstrlenW (lpString=" 0") returned 2 [0219.892] lstrlenW (lpString="Intel(R) Xeon(R) Gold 6126 CPU @ 2.60GHz") returned 40 [0219.892] lstrlenW (lpString="") returned 0 [0219.893] lstrlenW (lpString="") returned 0 [0219.893] lstrlenW (lpString="") returned 0 [0219.895] IsProcessorFeaturePresent (ProcessorFeature=0x14) returned 1 [0219.896] IsProcessorFeaturePresent (ProcessorFeature=0x15) returned 1 [0219.899] RtlNumberOfSetBitsUlongPtr (Target=0x1) returned 0x1 [0219.899] RtlNumberOfSetBitsUlongPtr (Target=0x2) returned 0x1 [0219.899] RtlNumberOfSetBitsUlongPtr (Target=0x4) returned 0x1 [0219.899] RtlNumberOfSetBitsUlongPtr (Target=0x8) returned 0x1 [0219.899] _vsnwprintf (in: _Buffer=0xf0d880, _BufferCount=0x63, _Format="CPU%d", _ArgList=0xf0d7c8 | out: _Buffer="CPU0") returned 4 [0219.901] free (_Block=0xdb3980) [0219.902] free (_Block=0xddffb0) [0219.902] free (_Block=0xddfc40) [0219.903] free (_Block=0xdb3ab0) [0219.903] free (_Block=0xde10a0) [0220.246] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7ffd8ee77f20 | out: lpflOldProtect=0x7ffd8ee77f20*=0x2) returned 1 [0220.246] LoadLibraryExA (lpLibFileName="IPHLPAPI.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffda17d0000 [0220.253] GetProcAddress (hModule=0x7ffda17d0000, lpProcName="GetAdaptersAddresses") returned 0x7ffda17d2a20 [0220.253] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0xf0d8e0 | out: lpflOldProtect=0xf0d8e0*=0x4) returned 1 [0220.254] GetAdaptersAddresses (in: Family=0x0, Flags=0x0, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0xf0d9b8*=0x0 | out: AdapterAddresses=0x0, SizePointer=0xf0d9b8*=0x1128) returned 0x6f [0220.286] malloc (_Size=0x1128) returned 0xdb65e0 [0220.287] GetAdaptersAddresses (in: Family=0x0, Flags=0x0, Reserved=0x0, AdapterAddresses=0xdb65e0, SizePointer=0xf0d9b8*=0x1128 | out: AdapterAddresses=0xdb65e0*(Alignment=0x7000001c0, Length=0x1c0, IfIndex=0x7, Next=0xdb6ba0, AdapterName="{E96D977E-F067-4CE9-924D-F6E0A04729E4}", FirstUnicastAddress=0xdb6850, FirstAnycastAddress=0x0, FirstMulticastAddress=0xdb6900, FirstDnsServerAddress=0xdb6b70, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #2", FriendlyName="Ethernet 2", PhysicalAddress=([0]=0xc8, [1]=0xd5, [2]=0xfe, [3]=0xbf, [4]=0x58, [5]=0xb6, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x1c5, DdnsEnabled=0x1c5, RegisterAdapterSuffix=0x1c5, Dhcpv4Enabled=0x1c5, ReceiveOnly=0x1c5, NoMulticast=0x1c5, Ipv6OtherStatefulConfig=0x1c5, NetbiosOverTcpipEnabled=0x1c5, Ipv4Enabled=0x1c5, Ipv6Enabled=0x1c5, Ipv6ManagedAddressConfigurationSupported=0x1c5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x7, ZoneIndices=([0]=0x7, [1]=0x7, [2]=0x7, [3]=0x7, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6008002000000, Dhcpv4Server.lpSockaddr=0xdb67a0*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11eb6c9dc20d55b0, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x28, [5]=0xb6, [6]=0x28, [7]=0x5e, [8]=0x0, [9]=0xf, [10]=0xf3, [11]=0xe1, [12]=0x61, [13]=0x38, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x6000ff3, FirstDnsSuffix=0x0), SizePointer=0xf0d9b8*=0x1128) returned 0x0 [0220.298] malloc (_Size=0x68) returned 0xdafe70 [0220.299] memcpy (in: _Dst=0xdafebc, _Src=0xdb6630, _Size=0x6 | out: _Dst=0xdafebc) returned 0xdafebc [0220.299] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7ffd8ee77f20 | out: lpflOldProtect=0x7ffd8ee77f20*=0x2) returned 1 [0220.299] GetProcAddress (hModule=0x7ffda17d0000, lpProcName="GetIpForwardTable2") returned 0x7ffda17da540 [0220.299] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0xf0d850 | out: lpflOldProtect=0xf0d850*=0x4) returned 1 [0220.300] GetIpForwardTable2 () returned 0x0 [0220.300] malloc (_Size=0x20) returned 0xdb6510 [0220.301] RtlIpv6AddressToStringW () returned 0xf0d810 [0220.301] malloc (_Size=0x20) returned 0xdb6240 [0220.301] RtlIpv4AddressToStringW () returned 0xf0d7fa [0220.301] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7ffd8ee77f20 | out: lpflOldProtect=0x7ffd8ee77f20*=0x2) returned 1 [0220.301] GetProcAddress (hModule=0x7ffda17d0000, lpProcName="ConvertLengthToIpv4Mask") returned 0x7ffda17d1c40 [0220.301] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0xf0d740 | out: lpflOldProtect=0xf0d740*=0x4) returned 1 [0220.302] ConvertLengthToIpv4Mask (in: MaskLength=0x18, Mask=0xf0d7c8 | out: Mask=0xf0d7c8) returned 0x0 [0220.302] RtlIpv4AddressToStringW () returned 0xf0d7fa [0220.302] malloc (_Size=0x20) returned 0xdb62d0 [0220.302] RtlIpv4AddressToStringW () returned 0xf0d7f6 [0220.302] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7ffd8ee77f20 | out: lpflOldProtect=0x7ffd8ee77f20*=0x2) returned 1 [0220.303] GetProcAddress (hModule=0x7ffda17d0000, lpProcName="FreeMibTable") returned 0x7ffda17d2840 [0220.303] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0xf0d850 | out: lpflOldProtect=0xf0d850*=0x4) returned 1 [0220.303] FreeMibTable () returned 0x1 [0220.303] malloc (_Size=0x68) returned 0xdb03b0 [0220.303] GetIpForwardTable2 () returned 0x0 [0220.304] malloc (_Size=0x20) returned 0xdb6120 [0220.306] RtlIpv6AddressToStringW () returned 0xf0d7e6 [0220.306] malloc (_Size=0x20) returned 0xdb5f70 [0220.306] RtlIpv4AddressToStringW () returned 0xf0d7f2 [0220.306] ConvertLengthToIpv4Mask (in: MaskLength=0x8, Mask=0xf0d7c8 | out: Mask=0xf0d7c8) returned 0x0 [0220.306] RtlIpv4AddressToStringW () returned 0xf0d7f2 [0220.307] FreeMibTable () returned 0x1 [0220.307] malloc (_Size=0x68) returned 0xdb0490 [0220.307] malloc (_Size=0x68) returned 0xdb7df0 [0220.307] memcpy (in: _Dst=0xdb7e3c, _Src=0xdb7378, _Size=0x8 | out: _Dst=0xdb7e3c) returned 0xdb7e3c [0220.307] GetIpForwardTable2 () returned 0x0 [0220.308] malloc (_Size=0x20) returned 0xdb63f0 [0220.308] RtlIpv6AddressToStringW () returned 0xf0d828 [0220.308] malloc (_Size=0x20) returned 0xdb6150 [0220.308] RtlIpv6AddressToStringW () returned 0xf0d812 [0220.308] malloc (_Size=0x20) returned 0xdb6420 [0220.308] RtlIpv6AddressToStringW () returned 0xf0d7e4 [0220.308] FreeMibTable () returned 0x1 [0220.309] free (_Block=0xdb65e0) [0220.311] _vsnwprintf (in: _Buffer=0xf0d6f0, _BufferCount=0x105, _Format="SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}", _ArgList=0xf0c708 | out: _Buffer="SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}") returned 77 [0220.316] _wtol (_String="0000") returned 0 [0220.323] malloc (_Size=0x48) returned 0xddf9c0 [0220.324] _wtol (_String="0001") returned 1 [0220.326] malloc (_Size=0x48) returned 0xde0000 [0220.328] _wtol (_String="0002") returned 2 [0220.329] malloc (_Size=0x48) returned 0xddfec0 [0220.330] _wtol (_String="0003") returned 3 [0220.332] malloc (_Size=0x48) returned 0xddfd80 [0220.333] _wtol (_String="0004") returned 4 [0220.335] malloc (_Size=0x48) returned 0xddf920 [0220.336] _wtol (_String="0005") returned 5 [0220.338] malloc (_Size=0x48) returned 0xddffb0 [0220.339] _wtol (_String="Configuration") returned 0 [0220.340] _wtol (_String="Properties") returned 0 [0220.355] QueryDosDeviceW (in: lpDeviceName="{017EF944-8C88-42C3-8F92-C8F7B6022F8D}", lpTargetPath=0xf0c410, ucchMax=0x200 | out: lpTargetPath="먁￿") returned 0x0 [0220.355] GetLastError () returned 0x2 [0220.356] DefineDosDeviceW (dwFlags=0x1, lpDeviceName="{017EF944-8C88-42C3-8F92-C8F7B6022F8D}", lpTargetPath="\\Device\\{017EF944-8C88-42C3-8F92-C8F7B6022F8D}") returned 1 [0220.369] CreateFileW (lpFileName="\\\\.\\{017EF944-8C88-42C3-8F92-C8F7B6022F8D}" (normalized: "{017ef944-8c88-42c3-8f92-c8f7b6022f8d}"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0xffffffffffffffff) returned 0xffffffffffffffff [0220.370] DefineDosDeviceW (dwFlags=0x7, lpDeviceName="{017EF944-8C88-42C3-8F92-C8F7B6022F8D}", lpTargetPath="\\Device\\{017EF944-8C88-42C3-8F92-C8F7B6022F8D}") returned 1 [0220.375] LoadLibraryExW (lpLibFileName="iphlpapi.dll", hFile=0x0, dwFlags=0x0) returned 0x7ffda17d0000 [0220.375] GetProcAddress (hModule=0x7ffda17d0000, lpProcName="GetAdapterIndex") returned 0x7ffda17eddb0 [0220.376] GetAdapterIndex (in: AdapterName="\\DEVICE\\TCPIP_{017EF944-8C88-42C3-8F92-C8F7B6022F8D}", IfIndex=0xf0d980 | out: IfIndex=0xf0d980) returned 0x0 [0220.376] FreeLibrary (hLibModule=0x7ffda17d0000) returned 1 [0220.377] QueryDosDeviceW (in: lpDeviceName="{E25A642B-6CEB-4194-8F83-8BC82AF94F5A}", lpTargetPath=0xf0c410, ucchMax=0x200 | out: lpTargetPath="") returned 0x0 [0220.377] GetLastError () returned 0x2 [0220.377] DefineDosDeviceW (dwFlags=0x1, lpDeviceName="{E25A642B-6CEB-4194-8F83-8BC82AF94F5A}", lpTargetPath="\\Device\\{E25A642B-6CEB-4194-8F83-8BC82AF94F5A}") returned 1 [0220.384] CreateFileW (lpFileName="\\\\.\\{E25A642B-6CEB-4194-8F83-8BC82AF94F5A}" (normalized: "{e25a642b-6ceb-4194-8f83-8bc82af94f5a}"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0xffffffffffffffff) returned 0xffffffffffffffff [0220.385] DefineDosDeviceW (dwFlags=0x7, lpDeviceName="{E25A642B-6CEB-4194-8F83-8BC82AF94F5A}", lpTargetPath="\\Device\\{E25A642B-6CEB-4194-8F83-8BC82AF94F5A}") returned 1 [0220.388] LoadLibraryExW (lpLibFileName="iphlpapi.dll", hFile=0x0, dwFlags=0x0) returned 0x7ffda17d0000 [0220.388] GetProcAddress (hModule=0x7ffda17d0000, lpProcName="GetAdapterIndex") returned 0x7ffda17eddb0 [0220.389] GetAdapterIndex (in: AdapterName="\\DEVICE\\TCPIP_{E25A642B-6CEB-4194-8F83-8BC82AF94F5A}", IfIndex=0xf0d980 | out: IfIndex=0xf0d980) returned 0x0 [0220.389] FreeLibrary (hLibModule=0x7ffda17d0000) returned 1 [0220.389] QueryDosDeviceW (in: lpDeviceName="{9E8A7ED5-49C8-421B-A782-D46C28931105}", lpTargetPath=0xf0c410, ucchMax=0x200 | out: lpTargetPath="\\Device\\NDMP7") returned 0xf [0220.390] CreateFileW (lpFileName="\\\\.\\{9E8A7ED5-49C8-421B-A782-D46C28931105}" (normalized: "\\device\\ndmp7"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0xffffffffffffffff) returned 0x458 [0220.390] DeviceIoControl (in: hDevice=0x458, dwIoControlCode=0x170002, lpInBuffer=0xf0c870*, nInBufferSize=0x4, lpOutBuffer=0xf0c8b0, nOutBufferSize=0x1000, lpBytesReturned=0xf0c874, lpOverlapped=0x0 | out: lpInBuffer=0xf0c870*, lpOutBuffer=0xf0c8b0*, lpBytesReturned=0xf0c874*=0x4, lpOverlapped=0x0) returned 1 [0220.391] DeviceIoControl (in: hDevice=0x458, dwIoControlCode=0x170002, lpInBuffer=0xf0c870*, nInBufferSize=0x4, lpOutBuffer=0xf0c8b0, nOutBufferSize=0x1000, lpBytesReturned=0xf0c874, lpOverlapped=0x0 | out: lpInBuffer=0xf0c870*, lpOutBuffer=0xf0c8b0*, lpBytesReturned=0xf0c874*=0xc, lpOverlapped=0x0) returned 1 [0220.391] CloseHandle (hObject=0x458) returned 1 [0220.393] LoadLibraryExW (lpLibFileName="iphlpapi.dll", hFile=0x0, dwFlags=0x0) returned 0x7ffda17d0000 [0220.393] GetProcAddress (hModule=0x7ffda17d0000, lpProcName="GetAdapterIndex") returned 0x7ffda17eddb0 [0220.393] GetAdapterIndex (in: AdapterName="\\DEVICE\\TCPIP_{9E8A7ED5-49C8-421B-A782-D46C28931105}", IfIndex=0xf0d980 | out: IfIndex=0xf0d980) returned 0x0 [0220.394] FreeLibrary (hLibModule=0x7ffda17d0000) returned 1 [0220.394] QueryDosDeviceW (in: lpDeviceName="{C2998852-8A8B-426B-AAB1-8880E47F8B1A}", lpTargetPath=0xf0c410, ucchMax=0x200 | out: lpTargetPath="\\Device\\NDMP6") returned 0xf [0220.394] CreateFileW (lpFileName="\\\\.\\{C2998852-8A8B-426B-AAB1-8880E47F8B1A}" (normalized: "\\device\\ndmp6"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0xffffffffffffffff) returned 0x458 [0220.394] DeviceIoControl (in: hDevice=0x458, dwIoControlCode=0x170002, lpInBuffer=0xf0c870*, nInBufferSize=0x4, lpOutBuffer=0xf0c8b0, nOutBufferSize=0x1000, lpBytesReturned=0xf0c874, lpOverlapped=0x0 | out: lpInBuffer=0xf0c870*, lpOutBuffer=0xf0c8b0*, lpBytesReturned=0xf0c874*=0x4, lpOverlapped=0x0) returned 1 [0220.395] DeviceIoControl (in: hDevice=0x458, dwIoControlCode=0x170002, lpInBuffer=0xf0c870*, nInBufferSize=0x4, lpOutBuffer=0xf0c8b0, nOutBufferSize=0x1000, lpBytesReturned=0xf0c874, lpOverlapped=0x0 | out: lpInBuffer=0xf0c870*, lpOutBuffer=0xf0c8b0*, lpBytesReturned=0xf0c874*=0x20, lpOverlapped=0x0) returned 1 [0220.395] CloseHandle (hObject=0x458) returned 1 [0220.396] LoadLibraryExW (lpLibFileName="iphlpapi.dll", hFile=0x0, dwFlags=0x0) returned 0x7ffda17d0000 [0220.397] GetProcAddress (hModule=0x7ffda17d0000, lpProcName="GetAdapterIndex") returned 0x7ffda17eddb0 [0220.397] GetAdapterIndex (in: AdapterName="\\DEVICE\\TCPIP_{C2998852-8A8B-426B-AAB1-8880E47F8B1A}", IfIndex=0xf0d980 | out: IfIndex=0xf0d980) returned 0x0 [0220.398] FreeLibrary (hLibModule=0x7ffda17d0000) returned 1 [0220.399] QueryDosDeviceW (in: lpDeviceName="{E96D977E-F067-4CE9-924D-F6E0A04729E4}", lpTargetPath=0xf0c410, ucchMax=0x200 | out: lpTargetPath="\\Device\\NDMP4") returned 0xf [0220.399] CreateFileW (lpFileName="\\\\.\\{E96D977E-F067-4CE9-924D-F6E0A04729E4}" (normalized: "\\device\\ndmp4"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0xffffffffffffffff) returned 0x458 [0220.400] DeviceIoControl (in: hDevice=0x458, dwIoControlCode=0x170002, lpInBuffer=0xf0c870*, nInBufferSize=0x4, lpOutBuffer=0xf0c8b0, nOutBufferSize=0x1000, lpBytesReturned=0xf0c874, lpOverlapped=0x0 | out: lpInBuffer=0xf0c870*, lpOutBuffer=0xf0c8b0*, lpBytesReturned=0xf0c874*=0x4, lpOverlapped=0x0) returned 1 [0220.400] DeviceIoControl (in: hDevice=0x458, dwIoControlCode=0x170002, lpInBuffer=0xf0c870*, nInBufferSize=0x4, lpOutBuffer=0xf0c8b0, nOutBufferSize=0x1000, lpBytesReturned=0xf0c874, lpOverlapped=0x0 | out: lpInBuffer=0xf0c870*, lpOutBuffer=0xf0c8b0*, lpBytesReturned=0xf0c874*=0x6, lpOverlapped=0x0) returned 1 [0220.400] CloseHandle (hObject=0x458) returned 1 [0220.402] malloc (_Size=0x18) returned 0xdb5170 [0220.403] malloc (_Size=0x18) returned 0xdb55b0 [0220.403] SafeArrayPutElement (psa=0x545960, rgIndices=0xf0d570, pv=0x49bc48) returned 0x0 [0220.403] malloc (_Size=0x18) returned 0xdb5050 [0220.403] SafeArrayPutElement (psa=0x545b20, rgIndices=0xf0d570, pv=0x545c18) returned 0x0 [0220.403] free (_Block=0xdb5050) [0220.403] free (_Block=0xdb55b0) [0220.403] malloc (_Size=0x18) returned 0xdb5250 [0220.403] SafeArrayPutElement (psa=0x545960, rgIndices=0xf0d570, pv=0x49bc48) returned 0x0 [0220.403] malloc (_Size=0x18) returned 0xdb5530 [0220.403] SafeArrayPutElement (psa=0x545b20, rgIndices=0xf0d570, pv=0x4ad048) returned 0x0 [0220.403] free (_Block=0xdb5530) [0220.403] free (_Block=0xdb5250) [0220.403] free (_Block=0xdb5170) [0220.406] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7ffd8ee77f20 | out: lpflOldProtect=0x7ffd8ee77f20*=0x2) returned 1 [0220.406] GetProcAddress (hModule=0x7ffda8cc0000, lpProcName=0x10) returned 0x7ffda8cd0e10 [0220.406] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0xf0d420 | out: lpflOldProtect=0xf0d420*=0x4) returned 1 [0220.407] malloc (_Size=0x18) returned 0xdb5090 [0220.407] SafeArrayPutElement (psa=0x5461e0, rgIndices=0xf0d570, pv=0x4ad048) returned 0x0 [0220.407] SafeArrayPutElement (psa=0x546120, rgIndices=0xf0d570, pv=0xdb62ec) returned 0x0 [0220.407] free (_Block=0xdb5090) [0220.408] _wtol (_String="1650995046") returned 1650995046 [0220.408] _wtol (_String="1650991446") returned 1650991446 [0220.412] GetProcessHeap () returned 0x470000 [0220.412] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x1c0) returned 0x11ee3b0 [0220.412] GetAdaptersAddresses (in: Family=0x0, Flags=0x6f, Reserved=0x0, AdapterAddresses=0x11ee3b0, SizePointer=0xf0d0c0*=0x1c0 | out: AdapterAddresses=0x11ee3b0*(Alignment=0x0, Length=0x0, IfIndex=0x0, Next=0x0, AdapterName=0x0, FirstUnicastAddress=0x0, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix=0x0, Description=0x0, FriendlyName=0x0, PhysicalAddress=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x0, Flags=0x0, DdnsEnabled=0x0, RegisterAdapterSuffix=0x0, Dhcpv4Enabled=0x0, ReceiveOnly=0x0, NoMulticast=0x0, Ipv6OtherStatefulConfig=0x0, NetbiosOverTcpipEnabled=0x0, Ipv4Enabled=0x0, Ipv6Enabled=0x0, Ipv6ManagedAddressConfigurationSupported=0x0, Mtu=0x0, IfType=0x0, OperStatus=0x0, Ipv6IfIndex=0x0, ZoneIndices=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0), FirstPrefix=0x0, TransmitLinkSpeed=0x0, ReceiveLinkSpeed=0x0, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0x0, Ipv6Metric=0x0, Luid=0x0, Dhcpv4Server.lpSockaddr=0x0, Dhcpv4Server.iSockaddrLength=0, CompartmentId=0x0, NetworkGuid=0x0, ConnectionType=0x0, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0x0, Dhcpv6Iaid=0x0, FirstDnsSuffix=0x0), SizePointer=0xf0d0c0*=0x9a8) returned 0x6f [0220.417] GetProcessHeap () returned 0x470000 [0220.418] RtlFreeHeap (HeapHandle=0x470000, Flags=0x0, BaseAddress=0x11ee3b0) returned 1 [0220.481] GetProcessHeap () returned 0x470000 [0220.481] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x9a8) returned 0x123da50 [0220.481] GetAdaptersAddresses (in: Family=0x0, Flags=0x6f, Reserved=0x0, AdapterAddresses=0x123da50, SizePointer=0xf0d0c0*=0x9a8 | out: AdapterAddresses=0x123da50*(Alignment=0x7000001c0, Length=0x1c0, IfIndex=0x7, Next=0x123dcc0, AdapterName="{E96D977E-F067-4CE9-924D-F6E0A04729E4}", FirstUnicastAddress=0x0, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #2", FriendlyName="Ethernet 2", PhysicalAddress=([0]=0xc8, [1]=0xd5, [2]=0xfe, [3]=0xbf, [4]=0x58, [5]=0xb6, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x1c5, DdnsEnabled=0x1c5, RegisterAdapterSuffix=0x1c5, Dhcpv4Enabled=0x1c5, ReceiveOnly=0x1c5, NoMulticast=0x1c5, Ipv6OtherStatefulConfig=0x1c5, NetbiosOverTcpipEnabled=0x1c5, Ipv4Enabled=0x1c5, Ipv6Enabled=0x1c5, Ipv6ManagedAddressConfigurationSupported=0x1c5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x7, ZoneIndices=([0]=0x7, [1]=0x7, [2]=0x7, [3]=0x7, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6008002000000, Dhcpv4Server.lpSockaddr=0x123dc10*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11eb6c9dc20d55b0, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x28, [5]=0xb6, [6]=0x28, [7]=0x5e, [8]=0x0, [9]=0xf, [10]=0xf3, [11]=0xe1, [12]=0x61, [13]=0x38, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x6000ff3, FirstDnsSuffix=0x0), SizePointer=0xf0d0c0*=0x9a8) returned 0x0 [0220.497] GetProcessHeap () returned 0x470000 [0220.498] RtlFreeHeap (HeapHandle=0x470000, Flags=0x0, BaseAddress=0x123da50) returned 1 [0220.501] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7ffd8ee77f20 | out: lpflOldProtect=0x7ffd8ee77f20*=0x2) returned 1 [0220.501] LoadLibraryExA (lpLibFileName="DNSAPI.dll", hFile=0x0, dwFlags=0x0) returned 0x7ffda6620000 [0220.510] GetProcAddress (hModule=0x7ffda6620000, lpProcName="DnsQueryConfigAllocEx") returned 0x7ffda6626cf0 [0220.511] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0xf0d4f0 | out: lpflOldProtect=0xf0d4f0*=0x4) returned 1 [0220.511] DnsQueryConfigAllocEx () returned 0x11ee3b0 [0220.519] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7ffd8ee77f20 | out: lpflOldProtect=0x7ffd8ee77f20*=0x2) returned 1 [0220.520] GetProcAddress (hModule=0x7ffda6620000, lpProcName="DnsFreeConfigStructure") returned 0x7ffda665c9a0 [0220.520] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0xf0d4f0 | out: lpflOldProtect=0xf0d4f0*=0x4) returned 1 [0220.521] DnsFreeConfigStructure () returned 0x1 [0220.522] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7ffd8ee77f20 | out: lpflOldProtect=0x7ffd8ee77f20*=0x2) returned 1 [0220.522] GetProcAddress (hModule=0x7ffda6620000, lpProcName="DnsQueryConfigDword") returned 0x7ffda6626bc0 [0220.522] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0xf0d4f0 | out: lpflOldProtect=0xf0d4f0*=0x4) returned 1 [0220.523] DnsQueryConfigDword () returned 0x1 [0220.523] DnsQueryConfigDword () returned 0x0 [0220.524] malloc (_Size=0x18) returned 0xdb51b0 [0220.524] SafeArrayPutElement (psa=0x545c60, rgIndices=0xf0d280, pv=0x4ad048) returned 0x0 [0220.524] free (_Block=0xdb51b0) [0220.528] LoadLibraryExW (lpLibFileName="iphlpapi.dll", hFile=0x0, dwFlags=0x0) returned 0x7ffda17d0000 [0220.528] GetProcAddress (hModule=0x7ffda17d0000, lpProcName="GetAdapterIndex") returned 0x7ffda17eddb0 [0220.528] GetAdapterIndex (in: AdapterName="\\DEVICE\\TCPIP_{E96D977E-F067-4CE9-924D-F6E0A04729E4}", IfIndex=0xf0d980 | out: IfIndex=0xf0d980) returned 0x0 [0220.529] FreeLibrary (hLibModule=0x7ffda17d0000) returned 1 [0220.530] QueryDosDeviceW (in: lpDeviceName="{E4D2000A-6025-4C58-8789-AF7349886E11}", lpTargetPath=0xf0c410, ucchMax=0x200 | out: lpTargetPath="") returned 0x0 [0220.530] GetLastError () returned 0x2 [0220.531] DefineDosDeviceW (dwFlags=0x1, lpDeviceName="{E4D2000A-6025-4C58-8789-AF7349886E11}", lpTargetPath="\\Device\\{E4D2000A-6025-4C58-8789-AF7349886E11}") returned 1 [0220.538] CreateFileW (lpFileName="\\\\.\\{E4D2000A-6025-4C58-8789-AF7349886E11}" (normalized: "{e4d2000a-6025-4c58-8789-af7349886e11}"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0xffffffffffffffff) returned 0xffffffffffffffff [0220.539] DefineDosDeviceW (dwFlags=0x7, lpDeviceName="{E4D2000A-6025-4C58-8789-AF7349886E11}", lpTargetPath="\\Device\\{E4D2000A-6025-4C58-8789-AF7349886E11}") returned 1 [0220.541] LoadLibraryExW (lpLibFileName="iphlpapi.dll", hFile=0x0, dwFlags=0x0) returned 0x7ffda17d0000 [0220.542] GetProcAddress (hModule=0x7ffda17d0000, lpProcName="GetAdapterIndex") returned 0x7ffda17eddb0 [0220.542] GetAdapterIndex (in: AdapterName="\\DEVICE\\TCPIP_{E4D2000A-6025-4C58-8789-AF7349886E11}", IfIndex=0xf0d980 | out: IfIndex=0xf0d980) returned 0x0 [0220.542] FreeLibrary (hLibModule=0x7ffda17d0000) returned 1 [0220.544] free (_Block=0xddf9c0) [0220.544] free (_Block=0xde0000) [0220.545] free (_Block=0xddfec0) [0220.546] free (_Block=0xddfd80) [0220.550] free (_Block=0xddf920) [0220.551] free (_Block=0xddffb0) [0220.552] free (_Block=0xdb6510) [0220.552] free (_Block=0xdb6240) [0220.553] free (_Block=0xdb62d0) [0220.554] free (_Block=0xdafe70) [0220.554] free (_Block=0xdb6120) [0220.555] free (_Block=0xdb5f70) [0220.555] free (_Block=0xdb03b0) [0220.556] free (_Block=0xdb0490) [0220.556] free (_Block=0xdb63f0) [0220.557] free (_Block=0xdb6150) [0220.557] free (_Block=0xdb6420) [0220.558] free (_Block=0xdb7df0) [0230.005] malloc (_Size=0x600) returned 0xdb65e0 [0230.005] GetLogicalProcessorInformationEx (in: RelationshipType=0xffff, Buffer=0x0, ReturnedLength=0xf0d7f8 | out: Buffer=0x0, ReturnedLength=0xf0d7f8) returned 0 [0230.005] GetLastError () returned 0x7a [0230.005] malloc (_Size=0x250) returned 0xdb3ab0 [0230.005] GetLogicalProcessorInformationEx (in: RelationshipType=0xffff, Buffer=0xdb3ab0, ReturnedLength=0xf0d7f8 | out: Buffer=0xdb3ab0, ReturnedLength=0xf0d7f8) returned 1 [0230.006] GetActiveProcessorCount (GroupNumber=0xffff) returned 0x4 [0230.006] GetMaximumProcessorGroupCount () returned 0x1 [0230.006] malloc (_Size=0x40) returned 0xddfe70 [0230.006] malloc (_Size=0x40) returned 0xddfd30 [0230.006] malloc (_Size=0x8) returned 0xdb3990 [0230.006] memcpy (in: _Dst=0xddfe70, _Src=0xdb3ad0, _Size=0x10 | out: _Dst=0xddfe70) returned 0xddfe70 [0230.006] GetActiveProcessorCount (GroupNumber=0x0) returned 0x4 [0230.006] NtPowerInformation (in: InformationLevel=0x2e, InputBuffer=0xf0d7f0, InputBufferLength=0x2, OutputBuffer=0xdb65e0, OutputBufferLength=0x60 | out: OutputBuffer=0xdb65e0) returned 0x0 [0230.007] _vsnwprintf (in: _Buffer=0xf0d690, _BufferCount=0x63, _Format="CPU%d", _ArgList=0xf0cf88 | out: _Buffer="CPU0") returned 4 [0230.007] GetCurrentThread () returned 0xfffffffffffffffe [0230.007] SetThreadGroupAffinity (in: hThread=0xfffffffffffffffe, GroupAffinity=0xf0cee0, PreviousGroupAffinity=0xf0cef0 | out: PreviousGroupAffinity=0xf0cef0) returned 1 [0230.007] GetSystemInfo (in: lpSystemInfo=0xf0d020 | out: lpSystemInfo=0xf0d020*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0230.007] mbstowcs (in: _Dest=0xf0d2a8, _Source="GenuineIntel", _MaxCount=0x28 | out: _Dest="GenuineIntel") returned 0xc [0230.007] _wcsicmp (_String1="GenuineIntel", _String2="GenuineIntel") returned 0 [0230.009] mbstowcs (in: _Dest=0xf0d118, _Source="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", _MaxCount=0x28 | out: _Dest="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x27 [0230.009] GetCurrentThread () returned 0xfffffffffffffffe [0230.009] SetThreadGroupAffinity (in: hThread=0xfffffffffffffffe, GroupAffinity=0xf0cef0, PreviousGroupAffinity=0x0 | out: PreviousGroupAffinity=0x0) returned 1 [0230.009] LoadStringW (in: hInstance=0x7ffd8ecc0000, uID=0x2c, lpBuffer=0xf0ccf0, cchBufferMax=256 | out: lpBuffer="CPU %d") returned 0x6 [0230.053] malloc (_Size=0x34c34) returned 0xde0090 [0230.064] _wtoi (_String="238") returned 238 [0230.064] _wtoi (_String="6") returned 6 [0230.064] _itow (in: _Dest=0x0, _Radix=15783360 | out: _Dest=0x0) returned="0" [0230.064] _itow (in: _Dest=0xee, _Radix=15781648 | out: _Dest=0xee) returned="238" [0230.064] malloc (_Size=0x4000) returned 0xe14cd0 [0230.064] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x0, lpData=0xe14cd0, lpcbData=0xf0cee4*=0x4000 | out: lpType=0x0, lpData=0xe14cd0*=0x50, lpcbData=0xf0cee4*=0x600) returned 0x0 [0230.068] free (_Block=0xe14cd0) [0230.069] Sleep (dwMilliseconds=0x3e8) [0231.069] _itow (in: _Dest=0xee, _Radix=15781648 | out: _Dest=0xee) returned="238" [0231.069] malloc (_Size=0x4000) returned 0xe14cd0 [0231.069] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x0, lpData=0xe14cd0, lpcbData=0xf0cee4*=0x4000 | out: lpType=0x0, lpData=0xe14cd0*=0x50, lpcbData=0xf0cee4*=0x600) returned 0x0 [0231.071] free (_Block=0xe14cd0) [0231.072] free (_Block=0xde0090) [0231.073] _vsnwprintf (in: _Buffer=0xf0d5c0, _BufferCount=0x40, _Format="%04X%04X%04X%04X", _ArgList=0xf0cf88 | out: _Buffer="0F8BFBFF00050654") returned 16 [0231.073] lstrlenW (lpString=" 0") returned 2 [0231.073] lstrlenW (lpString="Intel(R) Xeon(R) Gold 6126 CPU @ 2.60GHz") returned 40 [0231.073] lstrlenW (lpString="") returned 0 [0231.073] lstrlenW (lpString="") returned 0 [0231.073] lstrlenW (lpString="") returned 0 [0231.073] IsProcessorFeaturePresent (ProcessorFeature=0x14) returned 1 [0231.073] IsProcessorFeaturePresent (ProcessorFeature=0x15) returned 1 [0231.073] RtlNumberOfSetBitsUlongPtr (Target=0x1) returned 0x1 [0231.073] RtlNumberOfSetBitsUlongPtr (Target=0x2) returned 0x1 [0231.074] RtlNumberOfSetBitsUlongPtr (Target=0x4) returned 0x1 [0231.074] RtlNumberOfSetBitsUlongPtr (Target=0x8) returned 0x1 [0231.074] _vsnwprintf (in: _Buffer=0xf0d880, _BufferCount=0x63, _Format="CPU%d", _ArgList=0xf0d7c8 | out: _Buffer="CPU0") returned 4 [0231.074] free (_Block=0xdb3990) [0231.074] free (_Block=0xddfd30) [0231.074] free (_Block=0xddfe70) [0231.074] free (_Block=0xdb3ab0) [0231.075] free (_Block=0xdb65e0) Thread: id = 126 os_tid = 0xe1c Thread: id = 139 os_tid = 0xeac