# Flog Txt Version 1 # Analyzer Version: 4.5.0 # Analyzer Build Date: Apr 22 2022 21:04:16 # Log Creation Date: 05.05.2022 06:22:54.147 Process: id = "1" image_name = "c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe" filename = "c:\\users\\rdhj0cnfevzx\\desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe" page_root = "0x72d4b000" os_pid = "0x1204" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x78c" cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe\" " cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fe14" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 121 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 122 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 123 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 124 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 125 start_va = 0xa0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 126 start_va = 0x1a0000 end_va = 0x1a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 127 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 128 start_va = 0x400000 end_va = 0x49ffff monitored = 1 entry_point = 0x49e00a region_type = mapped_file name = "c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe") Region: id = 129 start_va = 0x77830000 end_va = 0x779aafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 130 start_va = 0x7ffb0000 end_va = 0x7ffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 131 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 132 start_va = 0x7fff0000 end_va = 0x7ffdab58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 133 start_va = 0x7ffdab590000 end_va = 0x7ffdab750fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 134 start_va = 0x7ffdab751000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffdab751000" filename = "" Region: id = 273 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 274 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 275 start_va = 0x639e0000 end_va = 0x63a2ffff monitored = 0 entry_point = 0x639f8180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 276 start_va = 0x63a40000 end_va = 0x63ab9fff monitored = 0 entry_point = 0x63a53290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 277 start_va = 0x74580000 end_va = 0x7465ffff monitored = 0 entry_point = 0x74593980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 278 start_va = 0x63a30000 end_va = 0x63a37fff monitored = 0 entry_point = 0x63a317c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 279 start_va = 0x560000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 280 start_va = 0x6cba0000 end_va = 0x6cbf8fff monitored = 1 entry_point = 0x6cbb0780 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 281 start_va = 0x74580000 end_va = 0x7465ffff monitored = 0 entry_point = 0x74593980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 282 start_va = 0x77420000 end_va = 0x7759dfff monitored = 0 entry_point = 0x774d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 283 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 284 start_va = 0x7feb0000 end_va = 0x7ffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 285 start_va = 0x560000 end_va = 0x61dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 286 start_va = 0x6e0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006e0000" filename = "" Region: id = 287 start_va = 0x7e0000 end_va = 0x99ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007e0000" filename = "" Region: id = 288 start_va = 0x744b0000 end_va = 0x74541fff monitored = 0 entry_point = 0x744f0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 289 start_va = 0x7fb00000 end_va = 0x7fea0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 290 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 291 start_va = 0x6c320000 end_va = 0x6c583fff monitored = 0 entry_point = 0x6c350d00 region_type = mapped_file name = "acgenral.dll" filename = "\\Windows\\AppPatch\\AcGenral.dll" (normalized: "c:\\windows\\apppatch\\acgenral.dll") Region: id = 292 start_va = 0x74db0000 end_va = 0x74e6dfff monitored = 0 entry_point = 0x74de5630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 293 start_va = 0x757e0000 end_va = 0x75823fff monitored = 0 entry_point = 0x757f9d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 294 start_va = 0x759b0000 end_va = 0x75a5cfff monitored = 0 entry_point = 0x759c4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 295 start_va = 0x74560000 end_va = 0x7457dfff monitored = 0 entry_point = 0x7456b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 296 start_va = 0x74550000 end_va = 0x74559fff monitored = 0 entry_point = 0x74552a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 297 start_va = 0x777d0000 end_va = 0x77827fff monitored = 0 entry_point = 0x778125c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 298 start_va = 0x77680000 end_va = 0x776c4fff monitored = 0 entry_point = 0x7769de90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 299 start_va = 0x75bf0000 end_va = 0x75dacfff monitored = 0 entry_point = 0x75cd2a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 300 start_va = 0x771b0000 end_va = 0x772fefff monitored = 0 entry_point = 0x77266820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 301 start_va = 0x75640000 end_va = 0x75786fff monitored = 0 entry_point = 0x75651cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 302 start_va = 0x753d0000 end_va = 0x754bafff monitored = 0 entry_point = 0x7540d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 303 start_va = 0x74660000 end_va = 0x746f1fff monitored = 0 entry_point = 0x74698cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 304 start_va = 0x75db0000 end_va = 0x771aefff monitored = 0 entry_point = 0x75f6b990 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 305 start_va = 0x77640000 end_va = 0x77676fff monitored = 0 entry_point = 0x77643b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 306 start_va = 0x74ed0000 end_va = 0x753c8fff monitored = 0 entry_point = 0x750d7610 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 307 start_va = 0x74810000 end_va = 0x7488afff monitored = 0 entry_point = 0x7482e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 308 start_va = 0x77730000 end_va = 0x7773bfff monitored = 0 entry_point = 0x77733930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 309 start_va = 0x77390000 end_va = 0x7741cfff monitored = 0 entry_point = 0x773d9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 310 start_va = 0x74e70000 end_va = 0x74eb3fff monitored = 0 entry_point = 0x74e77410 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 311 start_va = 0x77320000 end_va = 0x7732efff monitored = 0 entry_point = 0x77322e40 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 312 start_va = 0x70610000 end_va = 0x70684fff monitored = 0 entry_point = 0x70649a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 313 start_va = 0x6cb10000 end_va = 0x6cb33fff monitored = 0 entry_point = 0x6cb14820 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\SysWOW64\\winmm.dll" (normalized: "c:\\windows\\syswow64\\winmm.dll") Region: id = 314 start_va = 0x6caf0000 end_va = 0x6cb04fff monitored = 0 entry_point = 0x6caf5210 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\SysWOW64\\samcli.dll" (normalized: "c:\\windows\\syswow64\\samcli.dll") Region: id = 315 start_va = 0x6cad0000 end_va = 0x6cae7fff monitored = 0 entry_point = 0x6cad3f70 region_type = mapped_file name = "msacm32.dll" filename = "\\Windows\\SysWOW64\\msacm32.dll" (normalized: "c:\\windows\\syswow64\\msacm32.dll") Region: id = 316 start_va = 0x6cb90000 end_va = 0x6cb97fff monitored = 0 entry_point = 0x6cb917b0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 317 start_va = 0x705f0000 end_va = 0x70608fff monitored = 0 entry_point = 0x705f47e0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll") Region: id = 318 start_va = 0x6fef0000 end_va = 0x6ff0cfff monitored = 0 entry_point = 0x6fef3b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 319 start_va = 0x717f0000 end_va = 0x7196dfff monitored = 0 entry_point = 0x7186c630 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 320 start_va = 0x6ca60000 end_va = 0x6cac6fff monitored = 0 entry_point = 0x6ca75a00 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\SysWOW64\\winspool.drv" (normalized: "c:\\windows\\syswow64\\winspool.drv") Region: id = 321 start_va = 0x6ca40000 end_va = 0x6ca55fff monitored = 0 entry_point = 0x6ca421d0 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 322 start_va = 0x6ca10000 end_va = 0x6ca32fff monitored = 0 entry_point = 0x6ca18940 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\SysWOW64\\winmmbase.dll" (normalized: "c:\\windows\\syswow64\\winmmbase.dll") Region: id = 323 start_va = 0x720c0000 end_va = 0x7238afff monitored = 0 entry_point = 0x722fc4c0 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 324 start_va = 0x74200000 end_va = 0x7421afff monitored = 0 entry_point = 0x74209050 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 325 start_va = 0x7e0000 end_va = 0x97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007e0000" filename = "" Region: id = 326 start_va = 0x990000 end_va = 0x99ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 327 start_va = 0x6c790000 end_va = 0x6ca07fff monitored = 0 entry_point = 0x6c7a5e90 region_type = mapped_file name = "aclayers.dll" filename = "\\Windows\\AppPatch\\AcLayers.dll" (normalized: "c:\\windows\\apppatch\\aclayers.dll") Region: id = 328 start_va = 0x74890000 end_va = 0x74c9afff monitored = 0 entry_point = 0x748badf0 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 329 start_va = 0x66680000 end_va = 0x66682fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sfc.dll" filename = "\\Windows\\SysWOW64\\sfc.dll" (normalized: "c:\\windows\\syswow64\\sfc.dll") Region: id = 330 start_va = 0x6c780000 end_va = 0x6c78efff monitored = 0 entry_point = 0x6c7863e0 region_type = mapped_file name = "sfc_os.dll" filename = "\\Windows\\SysWOW64\\sfc_os.dll" (normalized: "c:\\windows\\syswow64\\sfc_os.dll") Region: id = 331 start_va = 0x1c0000 end_va = 0x1e9fff monitored = 0 entry_point = 0x1c5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 332 start_va = 0x7e0000 end_va = 0x967fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007e0000" filename = "" Region: id = 333 start_va = 0x970000 end_va = 0x97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000970000" filename = "" Region: id = 334 start_va = 0x77740000 end_va = 0x7776afff monitored = 0 entry_point = 0x77745680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 335 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 336 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 337 start_va = 0x9a0000 end_va = 0xb20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009a0000" filename = "" Region: id = 338 start_va = 0xb30000 end_va = 0x1f2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b30000" filename = "" Region: id = 339 start_va = 0x4a0000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 340 start_va = 0x1d0000 end_va = 0x1d3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 341 start_va = 0x6c700000 end_va = 0x6c778fff monitored = 1 entry_point = 0x6c70f82a region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 342 start_va = 0x620000 end_va = 0x6b8fff monitored = 1 entry_point = 0x6be00a region_type = mapped_file name = "c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe") Region: id = 343 start_va = 0x6bc60000 end_va = 0x6c310fff monitored = 1 entry_point = 0x6bc75d20 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 344 start_va = 0x4a0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 345 start_va = 0x500000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 346 start_va = 0x1f30000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f30000" filename = "" Region: id = 347 start_va = 0x6c600000 end_va = 0x6c6f4fff monitored = 0 entry_point = 0x6c654160 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll") Region: id = 348 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 349 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 350 start_va = 0x4e0000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 351 start_va = 0x4f0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 352 start_va = 0x510000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 353 start_va = 0x520000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 354 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 355 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 356 start_va = 0x620000 end_va = 0x620fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 357 start_va = 0x2030000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002030000" filename = "" Region: id = 358 start_va = 0x2110000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002110000" filename = "" Region: id = 359 start_va = 0x630000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 360 start_va = 0x2110000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002110000" filename = "" Region: id = 361 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 362 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 363 start_va = 0x2280000 end_va = 0x427ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 364 start_va = 0x2030000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002030000" filename = "" Region: id = 365 start_va = 0x2100000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 366 start_va = 0x670000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 367 start_va = 0x4280000 end_va = 0x437ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004280000" filename = "" Region: id = 368 start_va = 0x4380000 end_va = 0x46b6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 369 start_va = 0x6aa30000 end_va = 0x6bc57fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\8062d427acd64e37f4fded7b00f4a869\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\8062d427acd64e37f4fded7b00f4a869\\mscorlib.ni.dll") Region: id = 370 start_va = 0x6b0000 end_va = 0x6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006b0000" filename = "" Region: id = 371 start_va = 0x6a9b0000 end_va = 0x6aa2dfff monitored = 1 entry_point = 0x6a9b1140 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 372 start_va = 0x6c0000 end_va = 0x6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006c0000" filename = "" Region: id = 373 start_va = 0x6a000000 end_va = 0x6a9abfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\cc4e5d110dd318e8b7d61a9ed184ab74\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\cc4e5d110dd318e8b7d61a9ed184ab74\\system.ni.dll") Region: id = 374 start_va = 0x6d0000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 375 start_va = 0x980000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 376 start_va = 0x20d0000 end_va = 0x20dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020d0000" filename = "" Region: id = 377 start_va = 0x6d0000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 378 start_va = 0x980000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 379 start_va = 0x6d0000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 380 start_va = 0x980000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 381 start_va = 0x20d0000 end_va = 0x20dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020d0000" filename = "" Region: id = 382 start_va = 0x20e0000 end_va = 0x20effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 383 start_va = 0x980000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 384 start_va = 0x2210000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 385 start_va = 0x46c0000 end_va = 0x47bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000046c0000" filename = "" Region: id = 386 start_va = 0x47c0000 end_va = 0x57bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000047c0000" filename = "" Region: id = 387 start_va = 0x57c0000 end_va = 0x58effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000057c0000" filename = "" Region: id = 388 start_va = 0x58f0000 end_va = 0x68effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000058f0000" filename = "" Region: id = 389 start_va = 0x68f0000 end_va = 0x6b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000068f0000" filename = "" Region: id = 390 start_va = 0x69e70000 end_va = 0x69ffcfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\9b645a48c9bcfc95aaadf6a069bb4ebe\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\9b645a48c9bcfc95aaadf6a069bb4ebe\\system.drawing.ni.dll") Region: id = 391 start_va = 0x69210000 end_va = 0x69e68fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\8cd2187094ba6cade0ca0fab4f932654\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\8cd2187094ba6cade0ca0fab4f932654\\system.windows.forms.ni.dll") Region: id = 392 start_va = 0x980000 end_va = 0x980fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000980000" filename = "" Region: id = 393 start_va = 0x980000 end_va = 0x981fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000980000" filename = "" Region: id = 394 start_va = 0x6b40000 end_va = 0x6bcefff monitored = 0 entry_point = 0x6b4dd60 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll") Region: id = 395 start_va = 0x69170000 end_va = 0x69201fff monitored = 0 entry_point = 0x6917dd60 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll") Region: id = 396 start_va = 0x6b40000 end_va = 0x6d1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006b40000" filename = "" Region: id = 397 start_va = 0x20d0000 end_va = 0x20d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000020d0000" filename = "" Region: id = 398 start_va = 0x6b40000 end_va = 0x6bfbfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006b40000" filename = "" Region: id = 399 start_va = 0x6d10000 end_va = 0x6d1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006d10000" filename = "" Region: id = 400 start_va = 0x20d0000 end_va = 0x20d3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000020d0000" filename = "" Region: id = 401 start_va = 0x20e0000 end_va = 0x20e3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 402 start_va = 0x6d20000 end_va = 0x6f2afff monitored = 0 entry_point = 0x6dcb0a0 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll") Region: id = 403 start_va = 0x6f140000 end_va = 0x6f34efff monitored = 0 entry_point = 0x6f1eb0a0 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll") Region: id = 404 start_va = 0x20f0000 end_va = 0x20f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 405 start_va = 0x2250000 end_va = 0x2251fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002250000" filename = "" Region: id = 406 start_va = 0x6d20000 end_va = 0x6e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006d20000" filename = "" Region: id = 407 start_va = 0x20f0000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020f0000" filename = "" Region: id = 408 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 409 start_va = 0x6c00000 end_va = 0x6c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006c00000" filename = "" Region: id = 410 start_va = 0x6c10000 end_va = 0x6c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006c10000" filename = "" Region: id = 411 start_va = 0x69000000 end_va = 0x6916afff monitored = 0 entry_point = 0x6906e360 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\gdiplus.dll") Region: id = 412 start_va = 0x6c00000 end_va = 0x6c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006c00000" filename = "" Region: id = 413 start_va = 0x6c00000 end_va = 0x6c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006c00000" filename = "" Region: id = 414 start_va = 0x6c80000 end_va = 0x6c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006c80000" filename = "" Region: id = 415 start_va = 0x6d20000 end_va = 0x6e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006d20000" filename = "" Region: id = 416 start_va = 0x6e30000 end_va = 0x6e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006e30000" filename = "" Region: id = 417 start_va = 0x75a70000 end_va = 0x75b8efff monitored = 0 entry_point = 0x75ab5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 418 start_va = 0x6d4e0000 end_va = 0x6d6d0fff monitored = 0 entry_point = 0x6d5c3cd0 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\SysWOW64\\DWrite.dll" (normalized: "c:\\windows\\syswow64\\dwrite.dll") Region: id = 419 start_va = 0x6c90000 end_va = 0x6cd8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "~fontcache-system.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-system.dat") Region: id = 420 start_va = 0x6e40000 end_va = 0x7e3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "~fontcache-fontface.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-fontface.dat") Region: id = 421 start_va = 0x7e40000 end_va = 0x7f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007e40000" filename = "" Region: id = 422 start_va = 0x20f0000 end_va = 0x20f3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020f0000" filename = "" Region: id = 423 start_va = 0x7f40000 end_va = 0x803ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007f40000" filename = "" Region: id = 424 start_va = 0x8040000 end_va = 0x8531fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008040000" filename = "" Region: id = 425 start_va = 0x8540000 end_va = 0x85fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "micross.ttf" filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf") Region: id = 426 start_va = 0x8600000 end_va = 0x89fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008600000" filename = "" Region: id = 427 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 428 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 429 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 430 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 431 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 432 start_va = 0x8a00000 end_va = 0x9a3ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 433 start_va = 0x2260000 end_va = 0x2260fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 434 start_va = 0x9a40000 end_va = 0x9aa1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll") Region: id = 435 start_va = 0x6c40000 end_va = 0x6c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006c40000" filename = "" Region: id = 436 start_va = 0x6c50000 end_va = 0x6c5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006c50000" filename = "" Region: id = 437 start_va = 0x6c60000 end_va = 0x6c6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006c60000" filename = "" Region: id = 438 start_va = 0x6c70000 end_va = 0x6c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006c70000" filename = "" Region: id = 439 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 440 start_va = 0x6cf0000 end_va = 0x6cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006cf0000" filename = "" Region: id = 441 start_va = 0x6d00000 end_va = 0x6d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006d00000" filename = "" Region: id = 442 start_va = 0x6e20000 end_va = 0x6e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006e20000" filename = "" Region: id = 443 start_va = 0x9ab0000 end_va = 0x9abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009ab0000" filename = "" Region: id = 444 start_va = 0x6c40000 end_va = 0x6c51fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006c40000" filename = "" Region: id = 445 start_va = 0x5e430000 end_va = 0x5e4cbfff monitored = 1 entry_point = 0x5e4be9b2 region_type = mapped_file name = "microsoft.visualbasic.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\microsoft.visualbasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\microsoft.visualbasic.dll") Region: id = 446 start_va = 0x9ab0000 end_va = 0x9b4bfff monitored = 1 entry_point = 0x9b3e9b2 region_type = mapped_file name = "microsoft.visualbasic.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\microsoft.visualbasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\microsoft.visualbasic.dll") Region: id = 447 start_va = 0x6c60000 end_va = 0x6c6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006c60000" filename = "" Region: id = 448 start_va = 0x6c70000 end_va = 0x6c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006c70000" filename = "" Region: id = 449 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 450 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 451 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 452 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 453 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 454 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 455 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 456 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 457 start_va = 0x6cf0000 end_va = 0x6cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006cf0000" filename = "" Region: id = 458 start_va = 0x6d00000 end_va = 0x6d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006d00000" filename = "" Region: id = 459 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 460 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 461 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 462 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 463 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 464 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 465 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 466 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 467 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 468 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 469 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 470 start_va = 0x6d00000 end_va = 0x6d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006d00000" filename = "" Region: id = 471 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 472 start_va = 0x6d00000 end_va = 0x6d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006d00000" filename = "" Region: id = 473 start_va = 0x6e20000 end_va = 0x6e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006e20000" filename = "" Region: id = 474 start_va = 0x6e20000 end_va = 0x6e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006e20000" filename = "" Region: id = 475 start_va = 0x9b50000 end_va = 0x9b5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009b50000" filename = "" Region: id = 476 start_va = 0x9b50000 end_va = 0x9b5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009b50000" filename = "" Region: id = 477 start_va = 0x9b60000 end_va = 0x9b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009b60000" filename = "" Region: id = 478 start_va = 0x9b60000 end_va = 0x9b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009b60000" filename = "" Region: id = 479 start_va = 0x9b60000 end_va = 0x9b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009b60000" filename = "" Region: id = 480 start_va = 0x9b70000 end_va = 0x9b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009b70000" filename = "" Region: id = 481 start_va = 0x9b70000 end_va = 0x9b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009b70000" filename = "" Region: id = 482 start_va = 0x9b80000 end_va = 0x9b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009b80000" filename = "" Region: id = 483 start_va = 0x9b90000 end_va = 0x9b9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009b90000" filename = "" Region: id = 484 start_va = 0x9ba0000 end_va = 0x9baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009ba0000" filename = "" Region: id = 485 start_va = 0x9bb0000 end_va = 0x9bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009bb0000" filename = "" Region: id = 486 start_va = 0x9bc0000 end_va = 0x9bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009bc0000" filename = "" Region: id = 487 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 488 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 489 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 490 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 491 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 492 start_va = 0x6d00000 end_va = 0x6d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006d00000" filename = "" Region: id = 493 start_va = 0x6e20000 end_va = 0x6e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006e20000" filename = "" Region: id = 494 start_va = 0x9b50000 end_va = 0x9b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009b50000" filename = "" Region: id = 495 start_va = 0x9b90000 end_va = 0x9c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009b90000" filename = "" Region: id = 496 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 497 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 498 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 499 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 500 start_va = 0x1f30000 end_va = 0x1f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f30000" filename = "" Region: id = 501 start_va = 0x1f40000 end_va = 0x1f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f40000" filename = "" Region: id = 502 start_va = 0x1f50000 end_va = 0x1f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f50000" filename = "" Region: id = 503 start_va = 0x1f60000 end_va = 0x1f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f60000" filename = "" Region: id = 504 start_va = 0x1f70000 end_va = 0x1f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 505 start_va = 0x1f80000 end_va = 0x1f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f80000" filename = "" Region: id = 506 start_va = 0x1f90000 end_va = 0x1f9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f90000" filename = "" Region: id = 507 start_va = 0x1fa0000 end_va = 0x1faffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fa0000" filename = "" Region: id = 508 start_va = 0x1fb0000 end_va = 0x1fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fb0000" filename = "" Region: id = 509 start_va = 0x1fc0000 end_va = 0x1fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fc0000" filename = "" Region: id = 510 start_va = 0x1fd0000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 511 start_va = 0x1fe0000 end_va = 0x1feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fe0000" filename = "" Region: id = 512 start_va = 0x1ff0000 end_va = 0x1ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ff0000" filename = "" Region: id = 513 start_va = 0x2000000 end_va = 0x200ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002000000" filename = "" Region: id = 514 start_va = 0x688e0000 end_va = 0x68ff1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\abad45b9cc652ba7e38c4c837234c0ab\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\abad45b9cc652ba7e38c4c837234c0ab\\system.core.ni.dll") Region: id = 515 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 516 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 517 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 518 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 519 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 520 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 521 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 522 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 523 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 524 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 525 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 526 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 527 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 528 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 529 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 530 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 531 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 532 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 533 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 534 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 535 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 536 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 537 start_va = 0x70410000 end_va = 0x70422fff monitored = 0 entry_point = 0x70419950 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 538 start_va = 0x1f30000 end_va = 0x1f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f30000" filename = "" Region: id = 539 start_va = 0x9c90000 end_va = 0x9d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009c90000" filename = "" Region: id = 540 start_va = 0x703e0000 end_va = 0x7040efff monitored = 0 entry_point = 0x703f95e0 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 541 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 542 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 543 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 544 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 545 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 546 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 547 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 548 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 549 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 550 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 551 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 552 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 553 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 554 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 555 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 556 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 557 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 558 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 559 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 560 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 561 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 562 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 563 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 564 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 565 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 566 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 567 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 568 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 569 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 570 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 571 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 572 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 573 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 574 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 575 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 576 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 577 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 578 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 579 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 580 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 581 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 582 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 583 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 584 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 585 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 586 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 587 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 588 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 589 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 590 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 591 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 592 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 593 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 594 start_va = 0x1f70000 end_va = 0x1f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 595 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 596 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 597 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 598 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 599 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 600 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 601 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 602 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 603 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 604 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 605 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 606 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 607 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 608 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 609 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 610 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 611 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 612 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 613 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 614 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 615 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 616 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 617 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 618 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 619 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 620 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 621 start_va = 0x1f70000 end_va = 0x1f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 622 start_va = 0x1f70000 end_va = 0x1f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 623 start_va = 0x1f70000 end_va = 0x1f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 624 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 625 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 626 start_va = 0x1f70000 end_va = 0x1feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 627 start_va = 0x9d90000 end_va = 0x9e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009d90000" filename = "" Region: id = 628 start_va = 0x68760000 end_va = 0x688d2fff monitored = 0 entry_point = 0x6880d220 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\SysWOW64\\WindowsCodecs.dll" (normalized: "c:\\windows\\syswow64\\windowscodecs.dll") Region: id = 629 start_va = 0x9e90000 end_va = 0x9f07fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009e90000" filename = "" Region: id = 630 start_va = 0x1ff0000 end_va = 0x201ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ff0000" filename = "" Region: id = 631 start_va = 0x1ff0000 end_va = 0x1ffffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ff0000" filename = "" Region: id = 632 start_va = 0x2000000 end_va = 0x200ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002000000" filename = "" Region: id = 633 start_va = 0x2010000 end_va = 0x201ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002010000" filename = "" Region: id = 634 start_va = 0x2020000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 635 start_va = 0x2020000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 636 start_va = 0x2020000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 637 start_va = 0x2020000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 638 start_va = 0x2020000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 639 start_va = 0x2020000 end_va = 0x2096fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002020000" filename = "" Region: id = 640 start_va = 0x20a0000 end_va = 0x20affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020a0000" filename = "" Region: id = 641 start_va = 0x20b0000 end_va = 0x20bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020b0000" filename = "" Region: id = 642 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 643 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 644 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 645 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 646 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 647 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 648 start_va = 0x6d00000 end_va = 0x6d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006d00000" filename = "" Region: id = 649 start_va = 0x6e20000 end_va = 0x6e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006e20000" filename = "" Region: id = 650 start_va = 0x9f10000 end_va = 0x9f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009f10000" filename = "" Region: id = 651 start_va = 0x9f20000 end_va = 0x9f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009f20000" filename = "" Region: id = 652 start_va = 0x9f30000 end_va = 0x9f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009f30000" filename = "" Region: id = 653 start_va = 0x9f40000 end_va = 0x9f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009f40000" filename = "" Region: id = 654 start_va = 0x9f50000 end_va = 0x9f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009f50000" filename = "" Region: id = 655 start_va = 0x9f60000 end_va = 0x9f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009f60000" filename = "" Region: id = 656 start_va = 0x9f70000 end_va = 0x9f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009f70000" filename = "" Region: id = 657 start_va = 0x9f80000 end_va = 0x9f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009f80000" filename = "" Region: id = 658 start_va = 0x9f90000 end_va = 0x9f9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009f90000" filename = "" Region: id = 659 start_va = 0x9fa0000 end_va = 0x9faffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009fa0000" filename = "" Region: id = 660 start_va = 0x9fb0000 end_va = 0x9fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009fb0000" filename = "" Region: id = 661 start_va = 0x9fc0000 end_va = 0x9fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009fc0000" filename = "" Region: id = 662 start_va = 0x9fd0000 end_va = 0x9fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009fd0000" filename = "" Region: id = 663 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 664 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 665 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 666 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 667 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 668 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 669 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 670 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 671 start_va = 0x6d00000 end_va = 0x6d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006d00000" filename = "" Region: id = 672 start_va = 0x68640000 end_va = 0x6875bfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\d2f554a0c84513cd793fdcd77a86dab1\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.management\\d2f554a0c84513cd793fdcd77a86dab1\\system.management.ni.dll") Region: id = 673 start_va = 0x6ce0000 end_va = 0x6ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ce0000" filename = "" Region: id = 674 start_va = 0x6d00000 end_va = 0x6d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006d00000" filename = "" Region: id = 675 start_va = 0x6e20000 end_va = 0x6e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006e20000" filename = "" Region: id = 676 start_va = 0x9f10000 end_va = 0x9f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009f10000" filename = "" Region: id = 677 start_va = 0x9f20000 end_va = 0x9f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009f20000" filename = "" Region: id = 678 start_va = 0x9f30000 end_va = 0x9f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009f30000" filename = "" Region: id = 679 start_va = 0x9f40000 end_va = 0x9f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009f40000" filename = "" Region: id = 680 start_va = 0x9f50000 end_va = 0x9f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009f50000" filename = "" Region: id = 681 start_va = 0x9f60000 end_va = 0x9f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009f60000" filename = "" Region: id = 682 start_va = 0x9f70000 end_va = 0x9f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009f70000" filename = "" Region: id = 683 start_va = 0x9f80000 end_va = 0x9f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009f80000" filename = "" Region: id = 684 start_va = 0x9f90000 end_va = 0x9f9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009f90000" filename = "" Region: id = 685 start_va = 0x9fa0000 end_va = 0x9faffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009fa0000" filename = "" Region: id = 686 start_va = 0x9fb0000 end_va = 0x9fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009fb0000" filename = "" Region: id = 687 start_va = 0x9fc0000 end_va = 0x9fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009fc0000" filename = "" Region: id = 688 start_va = 0x9fd0000 end_va = 0x9fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009fd0000" filename = "" Region: id = 689 start_va = 0x9fe0000 end_va = 0x9feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009fe0000" filename = "" Region: id = 690 start_va = 0x9ff0000 end_va = 0x9ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009ff0000" filename = "" Region: id = 691 start_va = 0x9f10000 end_va = 0x9f46fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000009f10000" filename = "" Region: id = 692 start_va = 0x6d00000 end_va = 0x6d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006d00000" filename = "" Region: id = 693 start_va = 0x6e20000 end_va = 0x6e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006e20000" filename = "" Region: id = 694 start_va = 0x9f50000 end_va = 0x9f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009f50000" filename = "" Region: id = 695 start_va = 0x7fb00000 end_va = 0x7fea0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 719 start_va = 0x9f50000 end_va = 0x9f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009f50000" filename = "" Region: id = 720 start_va = 0x9f90000 end_va = 0xa08ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009f90000" filename = "" Region: id = 751 start_va = 0x9e90000 end_va = 0x9ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009e90000" filename = "" Region: id = 752 start_va = 0xa090000 end_va = 0xa18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a090000" filename = "" Thread: id = 1 os_tid = 0xb98 [0118.806] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0118.863] RoInitialize () returned 0x1 [0118.863] RoUninitialize () returned 0x0 [0119.886] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe", nBufferLength=0x105, lpBuffer=0x19e574, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe", lpFilePart=0x0) returned 0x62 [0119.897] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe", nBufferLength=0x105, lpBuffer=0x19e4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe", lpFilePart=0x0) returned 0x62 [0119.925] GetCurrentProcessId () returned 0x1204 [0119.946] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x19e344 | out: lpLuid=0x19e344*(LowPart=0x14, HighPart=0)) returned 1 [0119.949] GetCurrentProcess () returned 0xffffffff [0119.949] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x19e340 | out: TokenHandle=0x19e340*=0x378) returned 1 [0119.950] AdjustTokenPrivileges (in: TokenHandle=0x378, DisableAllPrivileges=0, NewState=0x2282648*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0119.951] CloseHandle (hObject=0x378) returned 1 [0119.952] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x378 [0119.955] GetExitCodeProcess (in: hProcess=0x378, lpExitCode=0x22825d4 | out: lpExitCode=0x22825d4*=0x103) returned 1 [0119.969] CheckRemoteDebuggerPresent (in: hProcess=0x378, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0119.970] GetCurrentProcessId () returned 0x1204 [0119.970] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x37c [0119.970] GetExitCodeProcess (in: hProcess=0x37c, lpExitCode=0x22826e8 | out: lpExitCode=0x22826e8*=0x103) returned 1 [0119.970] CheckRemoteDebuggerPresent (in: hProcess=0x37c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0119.974] GetCurrentProcessId () returned 0x1204 [0119.974] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x380 [0119.974] GetExitCodeProcess (in: hProcess=0x380, lpExitCode=0x2282838 | out: lpExitCode=0x2282838*=0x103) returned 1 [0119.974] CheckRemoteDebuggerPresent (in: hProcess=0x380, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0119.974] GetCurrentProcessId () returned 0x1204 [0119.974] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x384 [0119.974] GetExitCodeProcess (in: hProcess=0x384, lpExitCode=0x22828f0 | out: lpExitCode=0x22828f0*=0x103) returned 1 [0119.974] CheckRemoteDebuggerPresent (in: hProcess=0x384, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0119.974] GetCurrentProcessId () returned 0x1204 [0119.974] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x388 [0119.975] GetExitCodeProcess (in: hProcess=0x388, lpExitCode=0x22829a8 | out: lpExitCode=0x22829a8*=0x103) returned 1 [0119.975] CheckRemoteDebuggerPresent (in: hProcess=0x388, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0119.975] GetCurrentProcessId () returned 0x1204 [0119.975] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x38c [0119.975] GetExitCodeProcess (in: hProcess=0x38c, lpExitCode=0x2282a60 | out: lpExitCode=0x2282a60*=0x103) returned 1 [0119.975] CheckRemoteDebuggerPresent (in: hProcess=0x38c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0119.975] GetCurrentProcessId () returned 0x1204 [0119.975] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x390 [0119.975] GetExitCodeProcess (in: hProcess=0x390, lpExitCode=0x2282b18 | out: lpExitCode=0x2282b18*=0x103) returned 1 [0119.975] CheckRemoteDebuggerPresent (in: hProcess=0x390, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0119.975] GetCurrentProcessId () returned 0x1204 [0119.975] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x394 [0119.976] GetExitCodeProcess (in: hProcess=0x394, lpExitCode=0x2282bd0 | out: lpExitCode=0x2282bd0*=0x103) returned 1 [0119.976] CheckRemoteDebuggerPresent (in: hProcess=0x394, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0119.976] GetCurrentProcessId () returned 0x1204 [0119.976] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x398 [0119.976] GetExitCodeProcess (in: hProcess=0x398, lpExitCode=0x2282c88 | out: lpExitCode=0x2282c88*=0x103) returned 1 [0119.976] CheckRemoteDebuggerPresent (in: hProcess=0x398, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0119.976] GetCurrentProcessId () returned 0x1204 [0119.976] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x39c [0119.976] GetExitCodeProcess (in: hProcess=0x39c, lpExitCode=0x2282d40 | out: lpExitCode=0x2282d40*=0x103) returned 1 [0119.976] CheckRemoteDebuggerPresent (in: hProcess=0x39c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0119.976] GetCurrentProcessId () returned 0x1204 [0119.976] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3a0 [0119.977] GetExitCodeProcess (in: hProcess=0x3a0, lpExitCode=0x2282df8 | out: lpExitCode=0x2282df8*=0x103) returned 1 [0119.977] CheckRemoteDebuggerPresent (in: hProcess=0x3a0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0119.977] GetCurrentProcessId () returned 0x1204 [0119.977] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3a4 [0119.977] GetExitCodeProcess (in: hProcess=0x3a4, lpExitCode=0x2282eb0 | out: lpExitCode=0x2282eb0*=0x103) returned 1 [0119.977] CheckRemoteDebuggerPresent (in: hProcess=0x3a4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0119.977] GetCurrentProcessId () returned 0x1204 [0119.977] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3a8 [0119.977] GetExitCodeProcess (in: hProcess=0x3a8, lpExitCode=0x2282f68 | out: lpExitCode=0x2282f68*=0x103) returned 1 [0119.977] CheckRemoteDebuggerPresent (in: hProcess=0x3a8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0119.977] GetCurrentProcessId () returned 0x1204 [0119.977] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3ac [0119.978] GetExitCodeProcess (in: hProcess=0x3ac, lpExitCode=0x2283020 | out: lpExitCode=0x2283020*=0x103) returned 1 [0119.978] CheckRemoteDebuggerPresent (in: hProcess=0x3ac, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0119.978] GetCurrentProcessId () returned 0x1204 [0119.978] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3b0 [0119.978] GetExitCodeProcess (in: hProcess=0x3b0, lpExitCode=0x22830d8 | out: lpExitCode=0x22830d8*=0x103) returned 1 [0119.978] CheckRemoteDebuggerPresent (in: hProcess=0x3b0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0119.978] GetCurrentProcessId () returned 0x1204 [0119.978] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3b4 [0119.978] GetExitCodeProcess (in: hProcess=0x3b4, lpExitCode=0x2283190 | out: lpExitCode=0x2283190*=0x103) returned 1 [0119.978] CheckRemoteDebuggerPresent (in: hProcess=0x3b4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0119.978] GetCurrentProcessId () returned 0x1204 [0119.978] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3b8 [0119.979] GetExitCodeProcess (in: hProcess=0x3b8, lpExitCode=0x2283248 | out: lpExitCode=0x2283248*=0x103) returned 1 [0119.979] CheckRemoteDebuggerPresent (in: hProcess=0x3b8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0119.979] GetCurrentProcessId () returned 0x1204 [0119.979] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3bc [0119.979] GetExitCodeProcess (in: hProcess=0x3bc, lpExitCode=0x2283300 | out: lpExitCode=0x2283300*=0x103) returned 1 [0119.979] CheckRemoteDebuggerPresent (in: hProcess=0x3bc, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0119.990] VirtualProtect (in: lpAddress=0x402000, dwSize=0xbb14, flNewProtect=0x40, lpflOldProtect=0x19ec28 | out: lpflOldProtect=0x19ec28*=0x2) returned 1 [0119.991] GetCurrentProcessId () returned 0x1204 [0119.991] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3c0 [0119.991] GetExitCodeProcess (in: hProcess=0x3c0, lpExitCode=0x22833b8 | out: lpExitCode=0x22833b8*=0x103) returned 1 [0119.991] CheckRemoteDebuggerPresent (in: hProcess=0x3c0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0119.992] GetCurrentProcessId () returned 0x1204 [0119.992] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3c4 [0119.992] GetExitCodeProcess (in: hProcess=0x3c4, lpExitCode=0x2283470 | out: lpExitCode=0x2283470*=0x103) returned 1 [0119.992] CheckRemoteDebuggerPresent (in: hProcess=0x3c4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0119.992] GetCurrentProcessId () returned 0x1204 [0119.992] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3c8 [0119.992] GetExitCodeProcess (in: hProcess=0x3c8, lpExitCode=0x2283528 | out: lpExitCode=0x2283528*=0x103) returned 1 [0119.992] CheckRemoteDebuggerPresent (in: hProcess=0x3c8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0119.992] GetCurrentProcessId () returned 0x1204 [0119.992] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3cc [0119.992] GetExitCodeProcess (in: hProcess=0x3cc, lpExitCode=0x22835e0 | out: lpExitCode=0x22835e0*=0x103) returned 1 [0119.992] CheckRemoteDebuggerPresent (in: hProcess=0x3cc, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0119.993] GetCurrentProcessId () returned 0x1204 [0119.993] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3d0 [0119.993] GetExitCodeProcess (in: hProcess=0x3d0, lpExitCode=0x2283698 | out: lpExitCode=0x2283698*=0x103) returned 1 [0119.993] CheckRemoteDebuggerPresent (in: hProcess=0x3d0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0119.993] GetCurrentProcessId () returned 0x1204 [0119.993] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3d4 [0119.993] GetExitCodeProcess (in: hProcess=0x3d4, lpExitCode=0x2283750 | out: lpExitCode=0x2283750*=0x103) returned 1 [0119.993] CheckRemoteDebuggerPresent (in: hProcess=0x3d4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0119.993] GetCurrentProcessId () returned 0x1204 [0119.993] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3d8 [0119.993] GetExitCodeProcess (in: hProcess=0x3d8, lpExitCode=0x2283808 | out: lpExitCode=0x2283808*=0x103) returned 1 [0119.994] CheckRemoteDebuggerPresent (in: hProcess=0x3d8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0119.994] GetCurrentProcessId () returned 0x1204 [0119.994] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3dc [0119.994] GetExitCodeProcess (in: hProcess=0x3dc, lpExitCode=0x22838c0 | out: lpExitCode=0x22838c0*=0x103) returned 1 [0119.994] CheckRemoteDebuggerPresent (in: hProcess=0x3dc, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0119.999] GetCurrentProcessId () returned 0x1204 [0119.999] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3e0 [0120.000] GetExitCodeProcess (in: hProcess=0x3e0, lpExitCode=0x2283978 | out: lpExitCode=0x2283978*=0x103) returned 1 [0120.000] CheckRemoteDebuggerPresent (in: hProcess=0x3e0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.000] GetCurrentProcessId () returned 0x1204 [0120.000] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3e4 [0120.000] GetExitCodeProcess (in: hProcess=0x3e4, lpExitCode=0x2283a30 | out: lpExitCode=0x2283a30*=0x103) returned 1 [0120.000] CheckRemoteDebuggerPresent (in: hProcess=0x3e4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.000] GetCurrentProcessId () returned 0x1204 [0120.000] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3e8 [0120.000] GetExitCodeProcess (in: hProcess=0x3e8, lpExitCode=0x2283ae8 | out: lpExitCode=0x2283ae8*=0x103) returned 1 [0120.000] CheckRemoteDebuggerPresent (in: hProcess=0x3e8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.000] GetCurrentProcessId () returned 0x1204 [0120.001] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3ec [0120.001] GetExitCodeProcess (in: hProcess=0x3ec, lpExitCode=0x2283ba0 | out: lpExitCode=0x2283ba0*=0x103) returned 1 [0120.001] CheckRemoteDebuggerPresent (in: hProcess=0x3ec, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.001] GetCurrentProcessId () returned 0x1204 [0120.001] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3f0 [0120.001] GetExitCodeProcess (in: hProcess=0x3f0, lpExitCode=0x2283c58 | out: lpExitCode=0x2283c58*=0x103) returned 1 [0120.001] CheckRemoteDebuggerPresent (in: hProcess=0x3f0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.001] GetCurrentProcessId () returned 0x1204 [0120.001] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3f4 [0120.001] GetExitCodeProcess (in: hProcess=0x3f4, lpExitCode=0x2283d10 | out: lpExitCode=0x2283d10*=0x103) returned 1 [0120.001] CheckRemoteDebuggerPresent (in: hProcess=0x3f4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.002] GetCurrentProcessId () returned 0x1204 [0120.002] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3f8 [0120.002] GetExitCodeProcess (in: hProcess=0x3f8, lpExitCode=0x2283dc8 | out: lpExitCode=0x2283dc8*=0x103) returned 1 [0120.002] CheckRemoteDebuggerPresent (in: hProcess=0x3f8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.002] GetCurrentProcessId () returned 0x1204 [0120.002] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3fc [0120.002] GetExitCodeProcess (in: hProcess=0x3fc, lpExitCode=0x2283e80 | out: lpExitCode=0x2283e80*=0x103) returned 1 [0120.002] CheckRemoteDebuggerPresent (in: hProcess=0x3fc, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.002] GetCurrentProcessId () returned 0x1204 [0120.002] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x404 [0120.003] GetExitCodeProcess (in: hProcess=0x404, lpExitCode=0x2283f38 | out: lpExitCode=0x2283f38*=0x103) returned 1 [0120.003] CheckRemoteDebuggerPresent (in: hProcess=0x404, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.003] GetCurrentProcessId () returned 0x1204 [0120.003] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x408 [0120.003] GetExitCodeProcess (in: hProcess=0x408, lpExitCode=0x2283ff0 | out: lpExitCode=0x2283ff0*=0x103) returned 1 [0120.003] CheckRemoteDebuggerPresent (in: hProcess=0x408, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.003] GetCurrentProcessId () returned 0x1204 [0120.003] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x40c [0120.003] GetExitCodeProcess (in: hProcess=0x40c, lpExitCode=0x22840a8 | out: lpExitCode=0x22840a8*=0x103) returned 1 [0120.004] CheckRemoteDebuggerPresent (in: hProcess=0x40c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.004] GetCurrentProcessId () returned 0x1204 [0120.004] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x410 [0120.004] GetExitCodeProcess (in: hProcess=0x410, lpExitCode=0x2284160 | out: lpExitCode=0x2284160*=0x103) returned 1 [0120.004] CheckRemoteDebuggerPresent (in: hProcess=0x410, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.004] GetCurrentProcessId () returned 0x1204 [0120.004] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x414 [0120.004] GetExitCodeProcess (in: hProcess=0x414, lpExitCode=0x2284218 | out: lpExitCode=0x2284218*=0x103) returned 1 [0120.004] CheckRemoteDebuggerPresent (in: hProcess=0x414, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.004] GetCurrentProcessId () returned 0x1204 [0120.004] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x418 [0120.004] GetExitCodeProcess (in: hProcess=0x418, lpExitCode=0x22842d0 | out: lpExitCode=0x22842d0*=0x103) returned 1 [0120.004] CheckRemoteDebuggerPresent (in: hProcess=0x418, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.004] GetCurrentProcessId () returned 0x1204 [0120.004] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x41c [0120.004] GetExitCodeProcess (in: hProcess=0x41c, lpExitCode=0x2284388 | out: lpExitCode=0x2284388*=0x103) returned 1 [0120.005] CheckRemoteDebuggerPresent (in: hProcess=0x41c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.005] GetCurrentProcessId () returned 0x1204 [0120.005] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x420 [0120.005] GetExitCodeProcess (in: hProcess=0x420, lpExitCode=0x2284440 | out: lpExitCode=0x2284440*=0x103) returned 1 [0120.005] CheckRemoteDebuggerPresent (in: hProcess=0x420, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.005] GetCurrentProcessId () returned 0x1204 [0120.005] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x424 [0120.005] GetExitCodeProcess (in: hProcess=0x424, lpExitCode=0x22844f8 | out: lpExitCode=0x22844f8*=0x103) returned 1 [0120.005] CheckRemoteDebuggerPresent (in: hProcess=0x424, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.005] GetCurrentProcessId () returned 0x1204 [0120.005] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x428 [0120.005] GetExitCodeProcess (in: hProcess=0x428, lpExitCode=0x22845b0 | out: lpExitCode=0x22845b0*=0x103) returned 1 [0120.005] CheckRemoteDebuggerPresent (in: hProcess=0x428, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.006] GetCurrentProcessId () returned 0x1204 [0120.006] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x42c [0120.006] GetExitCodeProcess (in: hProcess=0x42c, lpExitCode=0x2284668 | out: lpExitCode=0x2284668*=0x103) returned 1 [0120.006] CheckRemoteDebuggerPresent (in: hProcess=0x42c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.006] GetCurrentProcessId () returned 0x1204 [0120.006] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x430 [0120.006] GetExitCodeProcess (in: hProcess=0x430, lpExitCode=0x2284720 | out: lpExitCode=0x2284720*=0x103) returned 1 [0120.006] CheckRemoteDebuggerPresent (in: hProcess=0x430, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.006] GetCurrentProcessId () returned 0x1204 [0120.006] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x434 [0120.006] GetExitCodeProcess (in: hProcess=0x434, lpExitCode=0x22847d8 | out: lpExitCode=0x22847d8*=0x103) returned 1 [0120.006] CheckRemoteDebuggerPresent (in: hProcess=0x434, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.006] GetCurrentProcessId () returned 0x1204 [0120.007] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x438 [0120.007] GetExitCodeProcess (in: hProcess=0x438, lpExitCode=0x2284890 | out: lpExitCode=0x2284890*=0x103) returned 1 [0120.007] CheckRemoteDebuggerPresent (in: hProcess=0x438, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.007] GetCurrentProcessId () returned 0x1204 [0120.007] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x43c [0120.007] GetExitCodeProcess (in: hProcess=0x43c, lpExitCode=0x2284948 | out: lpExitCode=0x2284948*=0x103) returned 1 [0120.007] CheckRemoteDebuggerPresent (in: hProcess=0x43c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.007] GetCurrentProcessId () returned 0x1204 [0120.007] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x440 [0120.007] GetExitCodeProcess (in: hProcess=0x440, lpExitCode=0x2284a00 | out: lpExitCode=0x2284a00*=0x103) returned 1 [0120.007] CheckRemoteDebuggerPresent (in: hProcess=0x440, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.008] GetCurrentProcessId () returned 0x1204 [0120.008] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x444 [0120.008] GetExitCodeProcess (in: hProcess=0x444, lpExitCode=0x2284ab8 | out: lpExitCode=0x2284ab8*=0x103) returned 1 [0120.008] CheckRemoteDebuggerPresent (in: hProcess=0x444, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.008] GetCurrentProcessId () returned 0x1204 [0120.008] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x448 [0120.008] GetExitCodeProcess (in: hProcess=0x448, lpExitCode=0x2284b70 | out: lpExitCode=0x2284b70*=0x103) returned 1 [0120.008] CheckRemoteDebuggerPresent (in: hProcess=0x448, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.008] GetCurrentProcessId () returned 0x1204 [0120.008] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x44c [0120.008] GetExitCodeProcess (in: hProcess=0x44c, lpExitCode=0x2284c28 | out: lpExitCode=0x2284c28*=0x103) returned 1 [0120.008] CheckRemoteDebuggerPresent (in: hProcess=0x44c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.009] GetCurrentProcessId () returned 0x1204 [0120.009] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x450 [0120.009] GetExitCodeProcess (in: hProcess=0x450, lpExitCode=0x2284ce0 | out: lpExitCode=0x2284ce0*=0x103) returned 1 [0120.009] CheckRemoteDebuggerPresent (in: hProcess=0x450, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.009] GetCurrentProcessId () returned 0x1204 [0120.009] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x454 [0120.009] GetExitCodeProcess (in: hProcess=0x454, lpExitCode=0x2284d98 | out: lpExitCode=0x2284d98*=0x103) returned 1 [0120.009] CheckRemoteDebuggerPresent (in: hProcess=0x454, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.009] GetCurrentProcessId () returned 0x1204 [0120.009] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x458 [0120.009] GetExitCodeProcess (in: hProcess=0x458, lpExitCode=0x2284e50 | out: lpExitCode=0x2284e50*=0x103) returned 1 [0120.009] CheckRemoteDebuggerPresent (in: hProcess=0x458, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.009] GetCurrentProcessId () returned 0x1204 [0120.009] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x45c [0120.010] GetExitCodeProcess (in: hProcess=0x45c, lpExitCode=0x2284f08 | out: lpExitCode=0x2284f08*=0x103) returned 1 [0120.010] CheckRemoteDebuggerPresent (in: hProcess=0x45c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.010] GetCurrentProcessId () returned 0x1204 [0120.010] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x460 [0120.010] GetExitCodeProcess (in: hProcess=0x460, lpExitCode=0x2284fc0 | out: lpExitCode=0x2284fc0*=0x103) returned 1 [0120.010] CheckRemoteDebuggerPresent (in: hProcess=0x460, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.010] GetCurrentProcessId () returned 0x1204 [0120.010] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x464 [0120.010] GetExitCodeProcess (in: hProcess=0x464, lpExitCode=0x2285078 | out: lpExitCode=0x2285078*=0x103) returned 1 [0120.010] CheckRemoteDebuggerPresent (in: hProcess=0x464, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.010] GetCurrentProcessId () returned 0x1204 [0120.011] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x468 [0120.011] GetExitCodeProcess (in: hProcess=0x468, lpExitCode=0x2285130 | out: lpExitCode=0x2285130*=0x103) returned 1 [0120.011] CheckRemoteDebuggerPresent (in: hProcess=0x468, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.011] GetCurrentProcessId () returned 0x1204 [0120.011] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x46c [0120.011] GetExitCodeProcess (in: hProcess=0x46c, lpExitCode=0x22851e8 | out: lpExitCode=0x22851e8*=0x103) returned 1 [0120.011] CheckRemoteDebuggerPresent (in: hProcess=0x46c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.011] GetCurrentProcessId () returned 0x1204 [0120.011] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x470 [0120.011] GetExitCodeProcess (in: hProcess=0x470, lpExitCode=0x22852a0 | out: lpExitCode=0x22852a0*=0x103) returned 1 [0120.012] CheckRemoteDebuggerPresent (in: hProcess=0x470, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.012] GetCurrentProcessId () returned 0x1204 [0120.012] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x474 [0120.012] GetExitCodeProcess (in: hProcess=0x474, lpExitCode=0x2285358 | out: lpExitCode=0x2285358*=0x103) returned 1 [0120.012] CheckRemoteDebuggerPresent (in: hProcess=0x474, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.012] GetCurrentProcessId () returned 0x1204 [0120.012] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x478 [0120.012] GetExitCodeProcess (in: hProcess=0x478, lpExitCode=0x2285410 | out: lpExitCode=0x2285410*=0x103) returned 1 [0120.012] CheckRemoteDebuggerPresent (in: hProcess=0x478, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.012] GetCurrentProcessId () returned 0x1204 [0120.012] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x47c [0120.013] GetExitCodeProcess (in: hProcess=0x47c, lpExitCode=0x22854c8 | out: lpExitCode=0x22854c8*=0x103) returned 1 [0120.013] CheckRemoteDebuggerPresent (in: hProcess=0x47c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.013] GetCurrentProcessId () returned 0x1204 [0120.013] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x480 [0120.013] GetExitCodeProcess (in: hProcess=0x480, lpExitCode=0x2285580 | out: lpExitCode=0x2285580*=0x103) returned 1 [0120.013] CheckRemoteDebuggerPresent (in: hProcess=0x480, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.013] GetCurrentProcessId () returned 0x1204 [0120.013] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x484 [0120.013] GetExitCodeProcess (in: hProcess=0x484, lpExitCode=0x2285638 | out: lpExitCode=0x2285638*=0x103) returned 1 [0120.014] CheckRemoteDebuggerPresent (in: hProcess=0x484, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.014] GetCurrentProcessId () returned 0x1204 [0120.014] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x488 [0120.014] GetExitCodeProcess (in: hProcess=0x488, lpExitCode=0x22856f0 | out: lpExitCode=0x22856f0*=0x103) returned 1 [0120.014] CheckRemoteDebuggerPresent (in: hProcess=0x488, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.014] GetCurrentProcessId () returned 0x1204 [0120.014] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x48c [0120.014] GetExitCodeProcess (in: hProcess=0x48c, lpExitCode=0x22857a8 | out: lpExitCode=0x22857a8*=0x103) returned 1 [0120.014] CheckRemoteDebuggerPresent (in: hProcess=0x48c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.014] GetCurrentProcessId () returned 0x1204 [0120.014] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x490 [0120.014] GetExitCodeProcess (in: hProcess=0x490, lpExitCode=0x2285860 | out: lpExitCode=0x2285860*=0x103) returned 1 [0120.015] CheckRemoteDebuggerPresent (in: hProcess=0x490, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.015] GetCurrentProcessId () returned 0x1204 [0120.015] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x494 [0120.015] GetExitCodeProcess (in: hProcess=0x494, lpExitCode=0x2285918 | out: lpExitCode=0x2285918*=0x103) returned 1 [0120.015] CheckRemoteDebuggerPresent (in: hProcess=0x494, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.015] GetCurrentProcessId () returned 0x1204 [0120.015] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x498 [0120.015] GetExitCodeProcess (in: hProcess=0x498, lpExitCode=0x22859d0 | out: lpExitCode=0x22859d0*=0x103) returned 1 [0120.015] CheckRemoteDebuggerPresent (in: hProcess=0x498, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.015] GetCurrentProcessId () returned 0x1204 [0120.015] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x49c [0120.015] GetExitCodeProcess (in: hProcess=0x49c, lpExitCode=0x2285a88 | out: lpExitCode=0x2285a88*=0x103) returned 1 [0120.016] CheckRemoteDebuggerPresent (in: hProcess=0x49c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.016] GetCurrentProcessId () returned 0x1204 [0120.016] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4a0 [0120.016] GetExitCodeProcess (in: hProcess=0x4a0, lpExitCode=0x2285b40 | out: lpExitCode=0x2285b40*=0x103) returned 1 [0120.016] CheckRemoteDebuggerPresent (in: hProcess=0x4a0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.016] GetCurrentProcessId () returned 0x1204 [0120.016] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4a4 [0120.016] GetExitCodeProcess (in: hProcess=0x4a4, lpExitCode=0x2285bf8 | out: lpExitCode=0x2285bf8*=0x103) returned 1 [0120.016] CheckRemoteDebuggerPresent (in: hProcess=0x4a4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.016] GetCurrentProcessId () returned 0x1204 [0120.016] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4a8 [0120.016] GetExitCodeProcess (in: hProcess=0x4a8, lpExitCode=0x2285cb0 | out: lpExitCode=0x2285cb0*=0x103) returned 1 [0120.017] CheckRemoteDebuggerPresent (in: hProcess=0x4a8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.017] GetCurrentProcessId () returned 0x1204 [0120.017] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4ac [0120.017] GetExitCodeProcess (in: hProcess=0x4ac, lpExitCode=0x2285d68 | out: lpExitCode=0x2285d68*=0x103) returned 1 [0120.017] CheckRemoteDebuggerPresent (in: hProcess=0x4ac, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.017] GetCurrentProcessId () returned 0x1204 [0120.017] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4b0 [0120.017] GetExitCodeProcess (in: hProcess=0x4b0, lpExitCode=0x2285e20 | out: lpExitCode=0x2285e20*=0x103) returned 1 [0120.017] CheckRemoteDebuggerPresent (in: hProcess=0x4b0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.017] GetCurrentProcessId () returned 0x1204 [0120.017] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4b4 [0120.017] GetExitCodeProcess (in: hProcess=0x4b4, lpExitCode=0x2285ed8 | out: lpExitCode=0x2285ed8*=0x103) returned 1 [0120.017] CheckRemoteDebuggerPresent (in: hProcess=0x4b4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.018] GetCurrentProcessId () returned 0x1204 [0120.018] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4b8 [0120.018] GetExitCodeProcess (in: hProcess=0x4b8, lpExitCode=0x2285f90 | out: lpExitCode=0x2285f90*=0x103) returned 1 [0120.018] CheckRemoteDebuggerPresent (in: hProcess=0x4b8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.018] GetCurrentProcessId () returned 0x1204 [0120.018] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4bc [0120.018] GetExitCodeProcess (in: hProcess=0x4bc, lpExitCode=0x2286048 | out: lpExitCode=0x2286048*=0x103) returned 1 [0120.018] CheckRemoteDebuggerPresent (in: hProcess=0x4bc, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.018] GetCurrentProcessId () returned 0x1204 [0120.018] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4c0 [0120.018] GetExitCodeProcess (in: hProcess=0x4c0, lpExitCode=0x2286100 | out: lpExitCode=0x2286100*=0x103) returned 1 [0120.019] CheckRemoteDebuggerPresent (in: hProcess=0x4c0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.019] GetCurrentProcessId () returned 0x1204 [0120.019] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4c4 [0120.019] GetExitCodeProcess (in: hProcess=0x4c4, lpExitCode=0x22861b8 | out: lpExitCode=0x22861b8*=0x103) returned 1 [0120.019] CheckRemoteDebuggerPresent (in: hProcess=0x4c4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.019] GetCurrentProcessId () returned 0x1204 [0120.019] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4c8 [0120.019] GetExitCodeProcess (in: hProcess=0x4c8, lpExitCode=0x2286270 | out: lpExitCode=0x2286270*=0x103) returned 1 [0120.019] CheckRemoteDebuggerPresent (in: hProcess=0x4c8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.019] GetCurrentProcessId () returned 0x1204 [0120.019] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4cc [0120.019] GetExitCodeProcess (in: hProcess=0x4cc, lpExitCode=0x2286328 | out: lpExitCode=0x2286328*=0x103) returned 1 [0120.019] CheckRemoteDebuggerPresent (in: hProcess=0x4cc, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.020] GetCurrentProcessId () returned 0x1204 [0120.020] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4d0 [0120.020] GetExitCodeProcess (in: hProcess=0x4d0, lpExitCode=0x22863e0 | out: lpExitCode=0x22863e0*=0x103) returned 1 [0120.020] CheckRemoteDebuggerPresent (in: hProcess=0x4d0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.020] GetCurrentProcessId () returned 0x1204 [0120.020] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4d4 [0120.020] GetExitCodeProcess (in: hProcess=0x4d4, lpExitCode=0x2286498 | out: lpExitCode=0x2286498*=0x103) returned 1 [0120.020] CheckRemoteDebuggerPresent (in: hProcess=0x4d4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.020] GetCurrentProcessId () returned 0x1204 [0120.020] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4d8 [0120.020] GetExitCodeProcess (in: hProcess=0x4d8, lpExitCode=0x2286550 | out: lpExitCode=0x2286550*=0x103) returned 1 [0120.021] CheckRemoteDebuggerPresent (in: hProcess=0x4d8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.021] GetCurrentProcessId () returned 0x1204 [0120.021] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4dc [0120.021] GetExitCodeProcess (in: hProcess=0x4dc, lpExitCode=0x2286608 | out: lpExitCode=0x2286608*=0x103) returned 1 [0120.021] CheckRemoteDebuggerPresent (in: hProcess=0x4dc, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.021] GetCurrentProcessId () returned 0x1204 [0120.021] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4e0 [0120.021] GetExitCodeProcess (in: hProcess=0x4e0, lpExitCode=0x22866c0 | out: lpExitCode=0x22866c0*=0x103) returned 1 [0120.021] CheckRemoteDebuggerPresent (in: hProcess=0x4e0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.021] GetCurrentProcessId () returned 0x1204 [0120.022] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4e4 [0120.022] GetExitCodeProcess (in: hProcess=0x4e4, lpExitCode=0x2286778 | out: lpExitCode=0x2286778*=0x103) returned 1 [0120.022] CheckRemoteDebuggerPresent (in: hProcess=0x4e4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.022] GetCurrentProcessId () returned 0x1204 [0120.022] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4e8 [0120.022] GetExitCodeProcess (in: hProcess=0x4e8, lpExitCode=0x2286830 | out: lpExitCode=0x2286830*=0x103) returned 1 [0120.022] CheckRemoteDebuggerPresent (in: hProcess=0x4e8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.022] GetCurrentProcessId () returned 0x1204 [0120.022] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4ec [0120.022] GetExitCodeProcess (in: hProcess=0x4ec, lpExitCode=0x22868e8 | out: lpExitCode=0x22868e8*=0x103) returned 1 [0120.022] CheckRemoteDebuggerPresent (in: hProcess=0x4ec, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.023] GetCurrentProcessId () returned 0x1204 [0120.023] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4f0 [0120.023] GetExitCodeProcess (in: hProcess=0x4f0, lpExitCode=0x22869a0 | out: lpExitCode=0x22869a0*=0x103) returned 1 [0120.023] CheckRemoteDebuggerPresent (in: hProcess=0x4f0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.023] GetCurrentProcessId () returned 0x1204 [0120.023] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4f4 [0120.023] GetExitCodeProcess (in: hProcess=0x4f4, lpExitCode=0x2286a58 | out: lpExitCode=0x2286a58*=0x103) returned 1 [0120.023] CheckRemoteDebuggerPresent (in: hProcess=0x4f4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.023] GetCurrentProcessId () returned 0x1204 [0120.023] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4f8 [0120.023] GetExitCodeProcess (in: hProcess=0x4f8, lpExitCode=0x2286b10 | out: lpExitCode=0x2286b10*=0x103) returned 1 [0120.023] CheckRemoteDebuggerPresent (in: hProcess=0x4f8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.024] GetCurrentProcessId () returned 0x1204 [0120.024] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4fc [0120.024] GetExitCodeProcess (in: hProcess=0x4fc, lpExitCode=0x2286bc8 | out: lpExitCode=0x2286bc8*=0x103) returned 1 [0120.024] CheckRemoteDebuggerPresent (in: hProcess=0x4fc, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.024] GetCurrentProcessId () returned 0x1204 [0120.024] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x500 [0120.024] GetExitCodeProcess (in: hProcess=0x500, lpExitCode=0x2286c80 | out: lpExitCode=0x2286c80*=0x103) returned 1 [0120.024] CheckRemoteDebuggerPresent (in: hProcess=0x500, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.024] GetCurrentProcessId () returned 0x1204 [0120.024] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x504 [0120.024] GetExitCodeProcess (in: hProcess=0x504, lpExitCode=0x2286d38 | out: lpExitCode=0x2286d38*=0x103) returned 1 [0120.024] CheckRemoteDebuggerPresent (in: hProcess=0x504, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.024] GetCurrentProcessId () returned 0x1204 [0120.025] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x508 [0120.025] GetExitCodeProcess (in: hProcess=0x508, lpExitCode=0x2286df0 | out: lpExitCode=0x2286df0*=0x103) returned 1 [0120.025] CheckRemoteDebuggerPresent (in: hProcess=0x508, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.025] GetCurrentProcessId () returned 0x1204 [0120.025] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x50c [0120.025] GetExitCodeProcess (in: hProcess=0x50c, lpExitCode=0x2286ea8 | out: lpExitCode=0x2286ea8*=0x103) returned 1 [0120.025] CheckRemoteDebuggerPresent (in: hProcess=0x50c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.025] GetCurrentProcessId () returned 0x1204 [0120.025] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x510 [0120.025] GetExitCodeProcess (in: hProcess=0x510, lpExitCode=0x2286f60 | out: lpExitCode=0x2286f60*=0x103) returned 1 [0120.025] CheckRemoteDebuggerPresent (in: hProcess=0x510, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.025] GetCurrentProcessId () returned 0x1204 [0120.025] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x514 [0120.025] GetExitCodeProcess (in: hProcess=0x514, lpExitCode=0x2287018 | out: lpExitCode=0x2287018*=0x103) returned 1 [0120.025] CheckRemoteDebuggerPresent (in: hProcess=0x514, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.026] GetCurrentProcessId () returned 0x1204 [0120.026] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x518 [0120.026] GetExitCodeProcess (in: hProcess=0x518, lpExitCode=0x22870d0 | out: lpExitCode=0x22870d0*=0x103) returned 1 [0120.026] CheckRemoteDebuggerPresent (in: hProcess=0x518, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.026] GetCurrentProcessId () returned 0x1204 [0120.026] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x51c [0120.026] GetExitCodeProcess (in: hProcess=0x51c, lpExitCode=0x2287188 | out: lpExitCode=0x2287188*=0x103) returned 1 [0120.026] CheckRemoteDebuggerPresent (in: hProcess=0x51c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.026] GetCurrentProcessId () returned 0x1204 [0120.026] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x520 [0120.026] GetExitCodeProcess (in: hProcess=0x520, lpExitCode=0x2287240 | out: lpExitCode=0x2287240*=0x103) returned 1 [0120.026] CheckRemoteDebuggerPresent (in: hProcess=0x520, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.026] GetCurrentProcessId () returned 0x1204 [0120.026] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x524 [0120.026] GetExitCodeProcess (in: hProcess=0x524, lpExitCode=0x22872f8 | out: lpExitCode=0x22872f8*=0x103) returned 1 [0120.026] CheckRemoteDebuggerPresent (in: hProcess=0x524, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.027] GetCurrentProcessId () returned 0x1204 [0120.027] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x528 [0120.027] GetExitCodeProcess (in: hProcess=0x528, lpExitCode=0x22873b0 | out: lpExitCode=0x22873b0*=0x103) returned 1 [0120.027] CheckRemoteDebuggerPresent (in: hProcess=0x528, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.027] GetCurrentProcessId () returned 0x1204 [0120.027] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x52c [0120.027] GetExitCodeProcess (in: hProcess=0x52c, lpExitCode=0x2287468 | out: lpExitCode=0x2287468*=0x103) returned 1 [0120.027] CheckRemoteDebuggerPresent (in: hProcess=0x52c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.027] GetCurrentProcessId () returned 0x1204 [0120.027] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x530 [0120.027] GetExitCodeProcess (in: hProcess=0x530, lpExitCode=0x2287520 | out: lpExitCode=0x2287520*=0x103) returned 1 [0120.027] CheckRemoteDebuggerPresent (in: hProcess=0x530, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.027] GetCurrentProcessId () returned 0x1204 [0120.027] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x534 [0120.027] GetExitCodeProcess (in: hProcess=0x534, lpExitCode=0x22875d8 | out: lpExitCode=0x22875d8*=0x103) returned 1 [0120.028] CheckRemoteDebuggerPresent (in: hProcess=0x534, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.028] GetCurrentProcessId () returned 0x1204 [0120.028] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x538 [0120.028] GetExitCodeProcess (in: hProcess=0x538, lpExitCode=0x2287690 | out: lpExitCode=0x2287690*=0x103) returned 1 [0120.028] CheckRemoteDebuggerPresent (in: hProcess=0x538, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.028] GetCurrentProcessId () returned 0x1204 [0120.028] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x53c [0120.028] GetExitCodeProcess (in: hProcess=0x53c, lpExitCode=0x2287748 | out: lpExitCode=0x2287748*=0x103) returned 1 [0120.028] CheckRemoteDebuggerPresent (in: hProcess=0x53c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.028] GetCurrentProcessId () returned 0x1204 [0120.028] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x540 [0120.028] GetExitCodeProcess (in: hProcess=0x540, lpExitCode=0x2287800 | out: lpExitCode=0x2287800*=0x103) returned 1 [0120.028] CheckRemoteDebuggerPresent (in: hProcess=0x540, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.029] GetCurrentProcessId () returned 0x1204 [0120.029] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x544 [0120.029] GetExitCodeProcess (in: hProcess=0x544, lpExitCode=0x22878b8 | out: lpExitCode=0x22878b8*=0x103) returned 1 [0120.029] CheckRemoteDebuggerPresent (in: hProcess=0x544, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.029] GetCurrentProcessId () returned 0x1204 [0120.029] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x548 [0120.029] GetExitCodeProcess (in: hProcess=0x548, lpExitCode=0x2287970 | out: lpExitCode=0x2287970*=0x103) returned 1 [0120.029] CheckRemoteDebuggerPresent (in: hProcess=0x548, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.029] GetCurrentProcessId () returned 0x1204 [0120.029] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x54c [0120.029] GetExitCodeProcess (in: hProcess=0x54c, lpExitCode=0x2287a28 | out: lpExitCode=0x2287a28*=0x103) returned 1 [0120.029] CheckRemoteDebuggerPresent (in: hProcess=0x54c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.029] GetCurrentProcessId () returned 0x1204 [0120.029] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x550 [0120.030] GetExitCodeProcess (in: hProcess=0x550, lpExitCode=0x2287ae0 | out: lpExitCode=0x2287ae0*=0x103) returned 1 [0120.030] CheckRemoteDebuggerPresent (in: hProcess=0x550, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.030] GetCurrentProcessId () returned 0x1204 [0120.030] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x554 [0120.030] GetExitCodeProcess (in: hProcess=0x554, lpExitCode=0x2287b98 | out: lpExitCode=0x2287b98*=0x103) returned 1 [0120.030] CheckRemoteDebuggerPresent (in: hProcess=0x554, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.030] GetCurrentProcessId () returned 0x1204 [0120.030] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x558 [0120.030] GetExitCodeProcess (in: hProcess=0x558, lpExitCode=0x2287c50 | out: lpExitCode=0x2287c50*=0x103) returned 1 [0120.030] CheckRemoteDebuggerPresent (in: hProcess=0x558, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.030] GetCurrentProcessId () returned 0x1204 [0120.030] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x55c [0120.032] GetExitCodeProcess (in: hProcess=0x55c, lpExitCode=0x2287d08 | out: lpExitCode=0x2287d08*=0x103) returned 1 [0120.032] CheckRemoteDebuggerPresent (in: hProcess=0x55c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.032] GetCurrentProcessId () returned 0x1204 [0120.032] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x560 [0120.032] GetExitCodeProcess (in: hProcess=0x560, lpExitCode=0x2287dc0 | out: lpExitCode=0x2287dc0*=0x103) returned 1 [0120.032] CheckRemoteDebuggerPresent (in: hProcess=0x560, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.032] GetCurrentProcessId () returned 0x1204 [0120.032] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x564 [0120.033] GetExitCodeProcess (in: hProcess=0x564, lpExitCode=0x2287e78 | out: lpExitCode=0x2287e78*=0x103) returned 1 [0120.033] CheckRemoteDebuggerPresent (in: hProcess=0x564, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.033] GetCurrentProcessId () returned 0x1204 [0120.033] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x568 [0120.033] GetExitCodeProcess (in: hProcess=0x568, lpExitCode=0x2287f30 | out: lpExitCode=0x2287f30*=0x103) returned 1 [0120.033] CheckRemoteDebuggerPresent (in: hProcess=0x568, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.033] GetCurrentProcessId () returned 0x1204 [0120.033] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x56c [0120.033] GetExitCodeProcess (in: hProcess=0x56c, lpExitCode=0x2287fe8 | out: lpExitCode=0x2287fe8*=0x103) returned 1 [0120.034] CheckRemoteDebuggerPresent (in: hProcess=0x56c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.034] GetCurrentProcessId () returned 0x1204 [0120.034] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x570 [0120.034] GetExitCodeProcess (in: hProcess=0x570, lpExitCode=0x22880a0 | out: lpExitCode=0x22880a0*=0x103) returned 1 [0120.034] CheckRemoteDebuggerPresent (in: hProcess=0x570, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.034] GetCurrentProcessId () returned 0x1204 [0120.034] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x574 [0120.034] GetExitCodeProcess (in: hProcess=0x574, lpExitCode=0x2288158 | out: lpExitCode=0x2288158*=0x103) returned 1 [0120.034] CheckRemoteDebuggerPresent (in: hProcess=0x574, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.034] GetCurrentProcessId () returned 0x1204 [0120.034] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x578 [0120.034] GetExitCodeProcess (in: hProcess=0x578, lpExitCode=0x2288210 | out: lpExitCode=0x2288210*=0x103) returned 1 [0120.034] CheckRemoteDebuggerPresent (in: hProcess=0x578, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.035] GetCurrentProcessId () returned 0x1204 [0120.035] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x57c [0120.035] GetExitCodeProcess (in: hProcess=0x57c, lpExitCode=0x22882c8 | out: lpExitCode=0x22882c8*=0x103) returned 1 [0120.035] CheckRemoteDebuggerPresent (in: hProcess=0x57c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.035] GetCurrentProcessId () returned 0x1204 [0120.035] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x580 [0120.047] GetExitCodeProcess (in: hProcess=0x580, lpExitCode=0x2288380 | out: lpExitCode=0x2288380*=0x103) returned 1 [0120.047] CheckRemoteDebuggerPresent (in: hProcess=0x580, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.047] GetCurrentProcessId () returned 0x1204 [0120.047] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x584 [0120.047] GetExitCodeProcess (in: hProcess=0x584, lpExitCode=0x2288438 | out: lpExitCode=0x2288438*=0x103) returned 1 [0120.047] CheckRemoteDebuggerPresent (in: hProcess=0x584, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.047] GetCurrentProcessId () returned 0x1204 [0120.047] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x588 [0120.048] GetExitCodeProcess (in: hProcess=0x588, lpExitCode=0x22884f0 | out: lpExitCode=0x22884f0*=0x103) returned 1 [0120.048] CheckRemoteDebuggerPresent (in: hProcess=0x588, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.048] GetCurrentProcessId () returned 0x1204 [0120.048] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x58c [0120.048] GetExitCodeProcess (in: hProcess=0x58c, lpExitCode=0x22885a8 | out: lpExitCode=0x22885a8*=0x103) returned 1 [0120.048] CheckRemoteDebuggerPresent (in: hProcess=0x58c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.048] GetCurrentProcessId () returned 0x1204 [0120.048] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x590 [0120.048] GetExitCodeProcess (in: hProcess=0x590, lpExitCode=0x2288660 | out: lpExitCode=0x2288660*=0x103) returned 1 [0120.048] CheckRemoteDebuggerPresent (in: hProcess=0x590, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.048] GetCurrentProcessId () returned 0x1204 [0120.048] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x594 [0120.048] GetExitCodeProcess (in: hProcess=0x594, lpExitCode=0x2288718 | out: lpExitCode=0x2288718*=0x103) returned 1 [0120.049] CheckRemoteDebuggerPresent (in: hProcess=0x594, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.049] GetCurrentProcessId () returned 0x1204 [0120.049] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x598 [0120.049] GetExitCodeProcess (in: hProcess=0x598, lpExitCode=0x22887d0 | out: lpExitCode=0x22887d0*=0x103) returned 1 [0120.049] CheckRemoteDebuggerPresent (in: hProcess=0x598, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.049] GetCurrentProcessId () returned 0x1204 [0120.049] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x59c [0120.049] GetExitCodeProcess (in: hProcess=0x59c, lpExitCode=0x2288888 | out: lpExitCode=0x2288888*=0x103) returned 1 [0120.049] CheckRemoteDebuggerPresent (in: hProcess=0x59c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.049] GetCurrentProcessId () returned 0x1204 [0120.049] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5a0 [0120.049] GetExitCodeProcess (in: hProcess=0x5a0, lpExitCode=0x2288940 | out: lpExitCode=0x2288940*=0x103) returned 1 [0120.049] CheckRemoteDebuggerPresent (in: hProcess=0x5a0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.050] GetCurrentProcessId () returned 0x1204 [0120.050] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5a4 [0120.050] GetExitCodeProcess (in: hProcess=0x5a4, lpExitCode=0x22889f8 | out: lpExitCode=0x22889f8*=0x103) returned 1 [0120.050] CheckRemoteDebuggerPresent (in: hProcess=0x5a4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.050] GetCurrentProcessId () returned 0x1204 [0120.050] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5a8 [0120.050] GetExitCodeProcess (in: hProcess=0x5a8, lpExitCode=0x2288ab0 | out: lpExitCode=0x2288ab0*=0x103) returned 1 [0120.050] CheckRemoteDebuggerPresent (in: hProcess=0x5a8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.050] GetCurrentProcessId () returned 0x1204 [0120.050] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5ac [0120.050] GetExitCodeProcess (in: hProcess=0x5ac, lpExitCode=0x2288b68 | out: lpExitCode=0x2288b68*=0x103) returned 1 [0120.050] CheckRemoteDebuggerPresent (in: hProcess=0x5ac, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.050] GetCurrentProcessId () returned 0x1204 [0120.050] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5b0 [0120.051] GetExitCodeProcess (in: hProcess=0x5b0, lpExitCode=0x2288c20 | out: lpExitCode=0x2288c20*=0x103) returned 1 [0120.051] CheckRemoteDebuggerPresent (in: hProcess=0x5b0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.051] GetCurrentProcessId () returned 0x1204 [0120.051] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5b4 [0120.051] GetExitCodeProcess (in: hProcess=0x5b4, lpExitCode=0x2288cd8 | out: lpExitCode=0x2288cd8*=0x103) returned 1 [0120.051] CheckRemoteDebuggerPresent (in: hProcess=0x5b4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.051] GetCurrentProcessId () returned 0x1204 [0120.051] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5b8 [0120.051] GetExitCodeProcess (in: hProcess=0x5b8, lpExitCode=0x2288d90 | out: lpExitCode=0x2288d90*=0x103) returned 1 [0120.051] CheckRemoteDebuggerPresent (in: hProcess=0x5b8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.052] GetCurrentProcessId () returned 0x1204 [0120.052] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5bc [0120.052] GetExitCodeProcess (in: hProcess=0x5bc, lpExitCode=0x2288e48 | out: lpExitCode=0x2288e48*=0x103) returned 1 [0120.052] CheckRemoteDebuggerPresent (in: hProcess=0x5bc, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.052] GetCurrentProcessId () returned 0x1204 [0120.052] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5c0 [0120.052] GetExitCodeProcess (in: hProcess=0x5c0, lpExitCode=0x2288f00 | out: lpExitCode=0x2288f00*=0x103) returned 1 [0120.052] CheckRemoteDebuggerPresent (in: hProcess=0x5c0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.052] GetCurrentProcessId () returned 0x1204 [0120.052] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5c4 [0120.052] GetExitCodeProcess (in: hProcess=0x5c4, lpExitCode=0x2288fb8 | out: lpExitCode=0x2288fb8*=0x103) returned 1 [0120.052] CheckRemoteDebuggerPresent (in: hProcess=0x5c4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.052] GetCurrentProcessId () returned 0x1204 [0120.053] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5c8 [0120.053] GetExitCodeProcess (in: hProcess=0x5c8, lpExitCode=0x2289070 | out: lpExitCode=0x2289070*=0x103) returned 1 [0120.053] CheckRemoteDebuggerPresent (in: hProcess=0x5c8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.053] GetCurrentProcessId () returned 0x1204 [0120.053] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5cc [0120.053] GetExitCodeProcess (in: hProcess=0x5cc, lpExitCode=0x2289128 | out: lpExitCode=0x2289128*=0x103) returned 1 [0120.053] CheckRemoteDebuggerPresent (in: hProcess=0x5cc, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.053] GetCurrentProcessId () returned 0x1204 [0120.053] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d0 [0120.053] GetExitCodeProcess (in: hProcess=0x5d0, lpExitCode=0x22891e0 | out: lpExitCode=0x22891e0*=0x103) returned 1 [0120.054] CheckRemoteDebuggerPresent (in: hProcess=0x5d0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.054] GetCurrentProcessId () returned 0x1204 [0120.054] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d4 [0120.054] GetExitCodeProcess (in: hProcess=0x5d4, lpExitCode=0x2289298 | out: lpExitCode=0x2289298*=0x103) returned 1 [0120.054] CheckRemoteDebuggerPresent (in: hProcess=0x5d4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.054] GetCurrentProcessId () returned 0x1204 [0120.054] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d8 [0120.054] GetExitCodeProcess (in: hProcess=0x5d8, lpExitCode=0x2289350 | out: lpExitCode=0x2289350*=0x103) returned 1 [0120.054] CheckRemoteDebuggerPresent (in: hProcess=0x5d8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.054] GetCurrentProcessId () returned 0x1204 [0120.054] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5dc [0120.054] GetExitCodeProcess (in: hProcess=0x5dc, lpExitCode=0x2289408 | out: lpExitCode=0x2289408*=0x103) returned 1 [0120.054] CheckRemoteDebuggerPresent (in: hProcess=0x5dc, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.055] GetCurrentProcessId () returned 0x1204 [0120.055] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5e0 [0120.055] GetExitCodeProcess (in: hProcess=0x5e0, lpExitCode=0x22894c0 | out: lpExitCode=0x22894c0*=0x103) returned 1 [0120.055] CheckRemoteDebuggerPresent (in: hProcess=0x5e0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.055] GetCurrentProcessId () returned 0x1204 [0120.055] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5e4 [0120.055] GetExitCodeProcess (in: hProcess=0x5e4, lpExitCode=0x2289578 | out: lpExitCode=0x2289578*=0x103) returned 1 [0120.055] CheckRemoteDebuggerPresent (in: hProcess=0x5e4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.055] GetCurrentProcessId () returned 0x1204 [0120.055] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5e8 [0120.055] GetExitCodeProcess (in: hProcess=0x5e8, lpExitCode=0x2289630 | out: lpExitCode=0x2289630*=0x103) returned 1 [0120.055] CheckRemoteDebuggerPresent (in: hProcess=0x5e8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.055] GetCurrentProcessId () returned 0x1204 [0120.055] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5ec [0120.056] GetExitCodeProcess (in: hProcess=0x5ec, lpExitCode=0x22896e8 | out: lpExitCode=0x22896e8*=0x103) returned 1 [0120.056] CheckRemoteDebuggerPresent (in: hProcess=0x5ec, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.056] GetCurrentProcessId () returned 0x1204 [0120.056] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5f0 [0120.056] GetExitCodeProcess (in: hProcess=0x5f0, lpExitCode=0x22897a0 | out: lpExitCode=0x22897a0*=0x103) returned 1 [0120.056] CheckRemoteDebuggerPresent (in: hProcess=0x5f0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.056] GetCurrentProcessId () returned 0x1204 [0120.056] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5f4 [0120.056] GetExitCodeProcess (in: hProcess=0x5f4, lpExitCode=0x2289858 | out: lpExitCode=0x2289858*=0x103) returned 1 [0120.056] CheckRemoteDebuggerPresent (in: hProcess=0x5f4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.056] GetCurrentProcessId () returned 0x1204 [0120.056] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5f8 [0120.057] GetExitCodeProcess (in: hProcess=0x5f8, lpExitCode=0x2289910 | out: lpExitCode=0x2289910*=0x103) returned 1 [0120.057] CheckRemoteDebuggerPresent (in: hProcess=0x5f8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.057] GetCurrentProcessId () returned 0x1204 [0120.057] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5fc [0120.058] GetExitCodeProcess (in: hProcess=0x5fc, lpExitCode=0x22899c8 | out: lpExitCode=0x22899c8*=0x103) returned 1 [0120.058] CheckRemoteDebuggerPresent (in: hProcess=0x5fc, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.058] GetCurrentProcessId () returned 0x1204 [0120.058] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x600 [0120.058] GetExitCodeProcess (in: hProcess=0x600, lpExitCode=0x2289a80 | out: lpExitCode=0x2289a80*=0x103) returned 1 [0120.058] CheckRemoteDebuggerPresent (in: hProcess=0x600, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.058] GetCurrentProcessId () returned 0x1204 [0120.058] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x604 [0120.058] GetExitCodeProcess (in: hProcess=0x604, lpExitCode=0x2289b38 | out: lpExitCode=0x2289b38*=0x103) returned 1 [0120.058] CheckRemoteDebuggerPresent (in: hProcess=0x604, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.058] GetCurrentProcessId () returned 0x1204 [0120.058] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x608 [0120.058] GetExitCodeProcess (in: hProcess=0x608, lpExitCode=0x2289bf0 | out: lpExitCode=0x2289bf0*=0x103) returned 1 [0120.059] CheckRemoteDebuggerPresent (in: hProcess=0x608, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.059] GetCurrentProcessId () returned 0x1204 [0120.059] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x60c [0120.059] GetExitCodeProcess (in: hProcess=0x60c, lpExitCode=0x2289ca8 | out: lpExitCode=0x2289ca8*=0x103) returned 1 [0120.059] CheckRemoteDebuggerPresent (in: hProcess=0x60c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.059] GetCurrentProcessId () returned 0x1204 [0120.059] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x610 [0120.059] GetExitCodeProcess (in: hProcess=0x610, lpExitCode=0x2289d60 | out: lpExitCode=0x2289d60*=0x103) returned 1 [0120.059] CheckRemoteDebuggerPresent (in: hProcess=0x610, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.059] GetCurrentProcessId () returned 0x1204 [0120.059] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x614 [0120.059] GetExitCodeProcess (in: hProcess=0x614, lpExitCode=0x2289e18 | out: lpExitCode=0x2289e18*=0x103) returned 1 [0120.072] CheckRemoteDebuggerPresent (in: hProcess=0x614, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.073] GetCurrentProcessId () returned 0x1204 [0120.073] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x618 [0120.073] GetExitCodeProcess (in: hProcess=0x618, lpExitCode=0x2289ed0 | out: lpExitCode=0x2289ed0*=0x103) returned 1 [0120.073] CheckRemoteDebuggerPresent (in: hProcess=0x618, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.073] GetCurrentProcessId () returned 0x1204 [0120.073] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x61c [0120.073] GetExitCodeProcess (in: hProcess=0x61c, lpExitCode=0x2289f88 | out: lpExitCode=0x2289f88*=0x103) returned 1 [0120.073] CheckRemoteDebuggerPresent (in: hProcess=0x61c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.074] GetCurrentProcessId () returned 0x1204 [0120.074] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x620 [0120.074] GetExitCodeProcess (in: hProcess=0x620, lpExitCode=0x228a040 | out: lpExitCode=0x228a040*=0x103) returned 1 [0120.074] CheckRemoteDebuggerPresent (in: hProcess=0x620, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.074] GetCurrentProcessId () returned 0x1204 [0120.074] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x624 [0120.074] GetExitCodeProcess (in: hProcess=0x624, lpExitCode=0x228a0f8 | out: lpExitCode=0x228a0f8*=0x103) returned 1 [0120.074] CheckRemoteDebuggerPresent (in: hProcess=0x624, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.075] GetCurrentProcessId () returned 0x1204 [0120.075] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x628 [0120.075] GetExitCodeProcess (in: hProcess=0x628, lpExitCode=0x228a1b0 | out: lpExitCode=0x228a1b0*=0x103) returned 1 [0120.075] CheckRemoteDebuggerPresent (in: hProcess=0x628, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.075] GetCurrentProcessId () returned 0x1204 [0120.075] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x62c [0120.075] GetExitCodeProcess (in: hProcess=0x62c, lpExitCode=0x228a268 | out: lpExitCode=0x228a268*=0x103) returned 1 [0120.075] CheckRemoteDebuggerPresent (in: hProcess=0x62c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.075] GetCurrentProcessId () returned 0x1204 [0120.075] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x630 [0120.075] GetExitCodeProcess (in: hProcess=0x630, lpExitCode=0x228a320 | out: lpExitCode=0x228a320*=0x103) returned 1 [0120.075] CheckRemoteDebuggerPresent (in: hProcess=0x630, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.075] GetCurrentProcessId () returned 0x1204 [0120.075] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x634 [0120.076] GetExitCodeProcess (in: hProcess=0x634, lpExitCode=0x228a3d8 | out: lpExitCode=0x228a3d8*=0x103) returned 1 [0120.076] CheckRemoteDebuggerPresent (in: hProcess=0x634, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.076] GetCurrentProcessId () returned 0x1204 [0120.076] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x638 [0120.076] GetExitCodeProcess (in: hProcess=0x638, lpExitCode=0x228a490 | out: lpExitCode=0x228a490*=0x103) returned 1 [0120.076] CheckRemoteDebuggerPresent (in: hProcess=0x638, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.076] GetCurrentProcessId () returned 0x1204 [0120.076] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x63c [0120.076] GetExitCodeProcess (in: hProcess=0x63c, lpExitCode=0x228a548 | out: lpExitCode=0x228a548*=0x103) returned 1 [0120.076] CheckRemoteDebuggerPresent (in: hProcess=0x63c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.077] GetCurrentProcessId () returned 0x1204 [0120.077] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x640 [0120.077] GetExitCodeProcess (in: hProcess=0x640, lpExitCode=0x228a600 | out: lpExitCode=0x228a600*=0x103) returned 1 [0120.077] CheckRemoteDebuggerPresent (in: hProcess=0x640, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.077] GetCurrentProcessId () returned 0x1204 [0120.077] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x644 [0120.077] GetExitCodeProcess (in: hProcess=0x644, lpExitCode=0x228a6b8 | out: lpExitCode=0x228a6b8*=0x103) returned 1 [0120.077] CheckRemoteDebuggerPresent (in: hProcess=0x644, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.077] GetCurrentProcessId () returned 0x1204 [0120.077] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x648 [0120.077] GetExitCodeProcess (in: hProcess=0x648, lpExitCode=0x228a770 | out: lpExitCode=0x228a770*=0x103) returned 1 [0120.077] CheckRemoteDebuggerPresent (in: hProcess=0x648, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.077] GetCurrentProcessId () returned 0x1204 [0120.077] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x64c [0120.077] GetExitCodeProcess (in: hProcess=0x64c, lpExitCode=0x228a828 | out: lpExitCode=0x228a828*=0x103) returned 1 [0120.078] CheckRemoteDebuggerPresent (in: hProcess=0x64c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.078] GetCurrentProcessId () returned 0x1204 [0120.078] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x650 [0120.078] GetExitCodeProcess (in: hProcess=0x650, lpExitCode=0x228a8e0 | out: lpExitCode=0x228a8e0*=0x103) returned 1 [0120.078] CheckRemoteDebuggerPresent (in: hProcess=0x650, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.078] GetCurrentProcessId () returned 0x1204 [0120.078] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x654 [0120.078] GetExitCodeProcess (in: hProcess=0x654, lpExitCode=0x228a998 | out: lpExitCode=0x228a998*=0x103) returned 1 [0120.078] CheckRemoteDebuggerPresent (in: hProcess=0x654, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.078] GetCurrentProcessId () returned 0x1204 [0120.078] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x658 [0120.078] GetExitCodeProcess (in: hProcess=0x658, lpExitCode=0x228aa50 | out: lpExitCode=0x228aa50*=0x103) returned 1 [0120.078] CheckRemoteDebuggerPresent (in: hProcess=0x658, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.078] GetCurrentProcessId () returned 0x1204 [0120.078] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x65c [0120.078] GetExitCodeProcess (in: hProcess=0x65c, lpExitCode=0x228ab08 | out: lpExitCode=0x228ab08*=0x103) returned 1 [0120.078] CheckRemoteDebuggerPresent (in: hProcess=0x65c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.078] GetCurrentProcessId () returned 0x1204 [0120.078] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x660 [0120.078] GetExitCodeProcess (in: hProcess=0x660, lpExitCode=0x228abc0 | out: lpExitCode=0x228abc0*=0x103) returned 1 [0120.079] CheckRemoteDebuggerPresent (in: hProcess=0x660, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.079] GetCurrentProcessId () returned 0x1204 [0120.079] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x664 [0120.079] GetExitCodeProcess (in: hProcess=0x664, lpExitCode=0x228ac78 | out: lpExitCode=0x228ac78*=0x103) returned 1 [0120.079] CheckRemoteDebuggerPresent (in: hProcess=0x664, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.079] GetCurrentProcessId () returned 0x1204 [0120.079] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x668 [0120.079] GetExitCodeProcess (in: hProcess=0x668, lpExitCode=0x228ad30 | out: lpExitCode=0x228ad30*=0x103) returned 1 [0120.079] CheckRemoteDebuggerPresent (in: hProcess=0x668, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.079] GetCurrentProcessId () returned 0x1204 [0120.079] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x66c [0120.079] GetExitCodeProcess (in: hProcess=0x66c, lpExitCode=0x228ade8 | out: lpExitCode=0x228ade8*=0x103) returned 1 [0120.079] CheckRemoteDebuggerPresent (in: hProcess=0x66c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.079] GetCurrentProcessId () returned 0x1204 [0120.079] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x670 [0120.079] GetExitCodeProcess (in: hProcess=0x670, lpExitCode=0x228aea0 | out: lpExitCode=0x228aea0*=0x103) returned 1 [0120.079] CheckRemoteDebuggerPresent (in: hProcess=0x670, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.079] GetCurrentProcessId () returned 0x1204 [0120.079] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x674 [0120.079] GetExitCodeProcess (in: hProcess=0x674, lpExitCode=0x228af58 | out: lpExitCode=0x228af58*=0x103) returned 1 [0120.080] CheckRemoteDebuggerPresent (in: hProcess=0x674, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.080] GetCurrentProcessId () returned 0x1204 [0120.080] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x678 [0120.080] GetExitCodeProcess (in: hProcess=0x678, lpExitCode=0x228b010 | out: lpExitCode=0x228b010*=0x103) returned 1 [0120.080] CheckRemoteDebuggerPresent (in: hProcess=0x678, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.080] GetCurrentProcessId () returned 0x1204 [0120.080] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x67c [0120.080] GetExitCodeProcess (in: hProcess=0x67c, lpExitCode=0x228b0c8 | out: lpExitCode=0x228b0c8*=0x103) returned 1 [0120.080] CheckRemoteDebuggerPresent (in: hProcess=0x67c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.080] GetCurrentProcessId () returned 0x1204 [0120.080] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x680 [0120.080] GetExitCodeProcess (in: hProcess=0x680, lpExitCode=0x228b180 | out: lpExitCode=0x228b180*=0x103) returned 1 [0120.080] CheckRemoteDebuggerPresent (in: hProcess=0x680, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.080] GetCurrentProcessId () returned 0x1204 [0120.080] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x684 [0120.080] GetExitCodeProcess (in: hProcess=0x684, lpExitCode=0x228b238 | out: lpExitCode=0x228b238*=0x103) returned 1 [0120.080] CheckRemoteDebuggerPresent (in: hProcess=0x684, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.080] GetCurrentProcessId () returned 0x1204 [0120.080] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x688 [0120.080] GetExitCodeProcess (in: hProcess=0x688, lpExitCode=0x228b2f0 | out: lpExitCode=0x228b2f0*=0x103) returned 1 [0120.081] CheckRemoteDebuggerPresent (in: hProcess=0x688, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.081] GetCurrentProcessId () returned 0x1204 [0120.081] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x68c [0120.081] GetExitCodeProcess (in: hProcess=0x68c, lpExitCode=0x228b3a8 | out: lpExitCode=0x228b3a8*=0x103) returned 1 [0120.081] CheckRemoteDebuggerPresent (in: hProcess=0x68c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.081] GetCurrentProcessId () returned 0x1204 [0120.081] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x690 [0120.081] GetExitCodeProcess (in: hProcess=0x690, lpExitCode=0x228b460 | out: lpExitCode=0x228b460*=0x103) returned 1 [0120.081] CheckRemoteDebuggerPresent (in: hProcess=0x690, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.081] GetCurrentProcessId () returned 0x1204 [0120.081] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x694 [0120.081] GetExitCodeProcess (in: hProcess=0x694, lpExitCode=0x228b518 | out: lpExitCode=0x228b518*=0x103) returned 1 [0120.081] CheckRemoteDebuggerPresent (in: hProcess=0x694, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.081] GetCurrentProcessId () returned 0x1204 [0120.081] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x698 [0120.081] GetExitCodeProcess (in: hProcess=0x698, lpExitCode=0x228b5d0 | out: lpExitCode=0x228b5d0*=0x103) returned 1 [0120.081] CheckRemoteDebuggerPresent (in: hProcess=0x698, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.081] GetCurrentProcessId () returned 0x1204 [0120.081] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x69c [0120.081] GetExitCodeProcess (in: hProcess=0x69c, lpExitCode=0x228b688 | out: lpExitCode=0x228b688*=0x103) returned 1 [0120.082] CheckRemoteDebuggerPresent (in: hProcess=0x69c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.082] GetCurrentProcessId () returned 0x1204 [0120.082] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x6a0 [0120.082] GetExitCodeProcess (in: hProcess=0x6a0, lpExitCode=0x228b740 | out: lpExitCode=0x228b740*=0x103) returned 1 [0120.082] CheckRemoteDebuggerPresent (in: hProcess=0x6a0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.082] GetCurrentProcessId () returned 0x1204 [0120.082] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x6a4 [0120.082] GetExitCodeProcess (in: hProcess=0x6a4, lpExitCode=0x228b7f8 | out: lpExitCode=0x228b7f8*=0x103) returned 1 [0120.082] CheckRemoteDebuggerPresent (in: hProcess=0x6a4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.082] GetCurrentProcessId () returned 0x1204 [0120.082] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x6a8 [0120.082] GetExitCodeProcess (in: hProcess=0x6a8, lpExitCode=0x228b8b0 | out: lpExitCode=0x228b8b0*=0x103) returned 1 [0120.082] CheckRemoteDebuggerPresent (in: hProcess=0x6a8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.082] GetCurrentProcessId () returned 0x1204 [0120.082] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x6ac [0120.082] GetExitCodeProcess (in: hProcess=0x6ac, lpExitCode=0x228b968 | out: lpExitCode=0x228b968*=0x103) returned 1 [0120.082] CheckRemoteDebuggerPresent (in: hProcess=0x6ac, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.082] GetCurrentProcessId () returned 0x1204 [0120.082] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x6b0 [0120.083] GetExitCodeProcess (in: hProcess=0x6b0, lpExitCode=0x228ba20 | out: lpExitCode=0x228ba20*=0x103) returned 1 [0120.083] CheckRemoteDebuggerPresent (in: hProcess=0x6b0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.083] GetCurrentProcessId () returned 0x1204 [0120.083] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x6b4 [0120.083] GetExitCodeProcess (in: hProcess=0x6b4, lpExitCode=0x228bad8 | out: lpExitCode=0x228bad8*=0x103) returned 1 [0120.083] CheckRemoteDebuggerPresent (in: hProcess=0x6b4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.083] GetCurrentProcessId () returned 0x1204 [0120.083] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x6b8 [0120.083] GetExitCodeProcess (in: hProcess=0x6b8, lpExitCode=0x228bb90 | out: lpExitCode=0x228bb90*=0x103) returned 1 [0120.083] CheckRemoteDebuggerPresent (in: hProcess=0x6b8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.083] GetCurrentProcessId () returned 0x1204 [0120.083] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x6bc [0120.083] GetExitCodeProcess (in: hProcess=0x6bc, lpExitCode=0x228bc48 | out: lpExitCode=0x228bc48*=0x103) returned 1 [0120.083] CheckRemoteDebuggerPresent (in: hProcess=0x6bc, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.083] GetCurrentProcessId () returned 0x1204 [0120.083] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x6c0 [0120.083] GetExitCodeProcess (in: hProcess=0x6c0, lpExitCode=0x228bd00 | out: lpExitCode=0x228bd00*=0x103) returned 1 [0120.083] CheckRemoteDebuggerPresent (in: hProcess=0x6c0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.083] GetCurrentProcessId () returned 0x1204 [0120.083] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x6c4 [0120.084] GetExitCodeProcess (in: hProcess=0x6c4, lpExitCode=0x228bdb8 | out: lpExitCode=0x228bdb8*=0x103) returned 1 [0120.084] CheckRemoteDebuggerPresent (in: hProcess=0x6c4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.084] GetCurrentProcessId () returned 0x1204 [0120.084] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x6c8 [0120.084] GetExitCodeProcess (in: hProcess=0x6c8, lpExitCode=0x228be70 | out: lpExitCode=0x228be70*=0x103) returned 1 [0120.084] CheckRemoteDebuggerPresent (in: hProcess=0x6c8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.084] GetCurrentProcessId () returned 0x1204 [0120.084] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x6cc [0120.084] GetExitCodeProcess (in: hProcess=0x6cc, lpExitCode=0x228bf28 | out: lpExitCode=0x228bf28*=0x103) returned 1 [0120.084] CheckRemoteDebuggerPresent (in: hProcess=0x6cc, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.084] GetCurrentProcessId () returned 0x1204 [0120.084] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x6d0 [0120.084] GetExitCodeProcess (in: hProcess=0x6d0, lpExitCode=0x228bfe0 | out: lpExitCode=0x228bfe0*=0x103) returned 1 [0120.084] CheckRemoteDebuggerPresent (in: hProcess=0x6d0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.084] GetCurrentProcessId () returned 0x1204 [0120.084] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x6d4 [0120.085] GetExitCodeProcess (in: hProcess=0x6d4, lpExitCode=0x228c098 | out: lpExitCode=0x228c098*=0x103) returned 1 [0120.085] CheckRemoteDebuggerPresent (in: hProcess=0x6d4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.085] GetCurrentProcessId () returned 0x1204 [0120.085] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x6d8 [0120.085] GetExitCodeProcess (in: hProcess=0x6d8, lpExitCode=0x228c150 | out: lpExitCode=0x228c150*=0x103) returned 1 [0120.085] CheckRemoteDebuggerPresent (in: hProcess=0x6d8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.085] GetCurrentProcessId () returned 0x1204 [0120.085] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x6dc [0120.085] GetExitCodeProcess (in: hProcess=0x6dc, lpExitCode=0x228c208 | out: lpExitCode=0x228c208*=0x103) returned 1 [0120.085] CheckRemoteDebuggerPresent (in: hProcess=0x6dc, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.085] GetCurrentProcessId () returned 0x1204 [0120.085] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x6e0 [0120.085] GetExitCodeProcess (in: hProcess=0x6e0, lpExitCode=0x228c2c0 | out: lpExitCode=0x228c2c0*=0x103) returned 1 [0120.085] CheckRemoteDebuggerPresent (in: hProcess=0x6e0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.085] GetCurrentProcessId () returned 0x1204 [0120.085] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x6e4 [0120.085] GetExitCodeProcess (in: hProcess=0x6e4, lpExitCode=0x228c378 | out: lpExitCode=0x228c378*=0x103) returned 1 [0120.085] CheckRemoteDebuggerPresent (in: hProcess=0x6e4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.085] GetCurrentProcessId () returned 0x1204 [0120.085] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x6e8 [0120.086] GetExitCodeProcess (in: hProcess=0x6e8, lpExitCode=0x228c430 | out: lpExitCode=0x228c430*=0x103) returned 1 [0120.086] CheckRemoteDebuggerPresent (in: hProcess=0x6e8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.086] GetCurrentProcessId () returned 0x1204 [0120.086] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x6ec [0120.086] GetExitCodeProcess (in: hProcess=0x6ec, lpExitCode=0x228c4e8 | out: lpExitCode=0x228c4e8*=0x103) returned 1 [0120.086] CheckRemoteDebuggerPresent (in: hProcess=0x6ec, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.086] GetCurrentProcessId () returned 0x1204 [0120.086] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x6f0 [0120.086] GetExitCodeProcess (in: hProcess=0x6f0, lpExitCode=0x228c5a0 | out: lpExitCode=0x228c5a0*=0x103) returned 1 [0120.086] CheckRemoteDebuggerPresent (in: hProcess=0x6f0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.086] GetCurrentProcessId () returned 0x1204 [0120.086] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x6f4 [0120.086] GetExitCodeProcess (in: hProcess=0x6f4, lpExitCode=0x228c658 | out: lpExitCode=0x228c658*=0x103) returned 1 [0120.086] CheckRemoteDebuggerPresent (in: hProcess=0x6f4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.086] GetCurrentProcessId () returned 0x1204 [0120.086] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x6f8 [0120.086] GetExitCodeProcess (in: hProcess=0x6f8, lpExitCode=0x228c710 | out: lpExitCode=0x228c710*=0x103) returned 1 [0120.086] CheckRemoteDebuggerPresent (in: hProcess=0x6f8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.086] GetCurrentProcessId () returned 0x1204 [0120.086] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x6fc [0120.087] GetExitCodeProcess (in: hProcess=0x6fc, lpExitCode=0x228c7c8 | out: lpExitCode=0x228c7c8*=0x103) returned 1 [0120.087] CheckRemoteDebuggerPresent (in: hProcess=0x6fc, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.087] GetCurrentProcessId () returned 0x1204 [0120.087] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x700 [0120.087] GetExitCodeProcess (in: hProcess=0x700, lpExitCode=0x228c880 | out: lpExitCode=0x228c880*=0x103) returned 1 [0120.087] CheckRemoteDebuggerPresent (in: hProcess=0x700, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.087] GetCurrentProcessId () returned 0x1204 [0120.087] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x704 [0120.087] GetExitCodeProcess (in: hProcess=0x704, lpExitCode=0x228c938 | out: lpExitCode=0x228c938*=0x103) returned 1 [0120.087] CheckRemoteDebuggerPresent (in: hProcess=0x704, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.087] GetCurrentProcessId () returned 0x1204 [0120.087] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x708 [0120.087] GetExitCodeProcess (in: hProcess=0x708, lpExitCode=0x228c9f0 | out: lpExitCode=0x228c9f0*=0x103) returned 1 [0120.087] CheckRemoteDebuggerPresent (in: hProcess=0x708, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.087] GetCurrentProcessId () returned 0x1204 [0120.087] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x70c [0120.087] GetExitCodeProcess (in: hProcess=0x70c, lpExitCode=0x228caa8 | out: lpExitCode=0x228caa8*=0x103) returned 1 [0120.087] CheckRemoteDebuggerPresent (in: hProcess=0x70c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.087] GetCurrentProcessId () returned 0x1204 [0120.087] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x710 [0120.088] GetExitCodeProcess (in: hProcess=0x710, lpExitCode=0x228cb60 | out: lpExitCode=0x228cb60*=0x103) returned 1 [0120.088] CheckRemoteDebuggerPresent (in: hProcess=0x710, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.088] GetCurrentProcessId () returned 0x1204 [0120.088] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x714 [0120.088] GetExitCodeProcess (in: hProcess=0x714, lpExitCode=0x228cc18 | out: lpExitCode=0x228cc18*=0x103) returned 1 [0120.088] CheckRemoteDebuggerPresent (in: hProcess=0x714, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.088] GetCurrentProcessId () returned 0x1204 [0120.088] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x718 [0120.088] GetExitCodeProcess (in: hProcess=0x718, lpExitCode=0x228ccd0 | out: lpExitCode=0x228ccd0*=0x103) returned 1 [0120.088] CheckRemoteDebuggerPresent (in: hProcess=0x718, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.088] GetCurrentProcessId () returned 0x1204 [0120.088] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x71c [0120.088] GetExitCodeProcess (in: hProcess=0x71c, lpExitCode=0x228cd88 | out: lpExitCode=0x228cd88*=0x103) returned 1 [0120.088] CheckRemoteDebuggerPresent (in: hProcess=0x71c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.088] GetCurrentProcessId () returned 0x1204 [0120.088] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x720 [0120.088] GetExitCodeProcess (in: hProcess=0x720, lpExitCode=0x228ce40 | out: lpExitCode=0x228ce40*=0x103) returned 1 [0120.088] CheckRemoteDebuggerPresent (in: hProcess=0x720, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.088] GetCurrentProcessId () returned 0x1204 [0120.088] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x724 [0120.088] GetExitCodeProcess (in: hProcess=0x724, lpExitCode=0x228cef8 | out: lpExitCode=0x228cef8*=0x103) returned 1 [0120.089] CheckRemoteDebuggerPresent (in: hProcess=0x724, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.089] GetCurrentProcessId () returned 0x1204 [0120.089] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x728 [0120.089] GetExitCodeProcess (in: hProcess=0x728, lpExitCode=0x228cfb0 | out: lpExitCode=0x228cfb0*=0x103) returned 1 [0120.089] CheckRemoteDebuggerPresent (in: hProcess=0x728, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.089] GetCurrentProcessId () returned 0x1204 [0120.089] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x72c [0120.089] GetExitCodeProcess (in: hProcess=0x72c, lpExitCode=0x228d068 | out: lpExitCode=0x228d068*=0x103) returned 1 [0120.089] CheckRemoteDebuggerPresent (in: hProcess=0x72c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.089] GetCurrentProcessId () returned 0x1204 [0120.089] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x730 [0120.089] GetExitCodeProcess (in: hProcess=0x730, lpExitCode=0x228d120 | out: lpExitCode=0x228d120*=0x103) returned 1 [0120.089] CheckRemoteDebuggerPresent (in: hProcess=0x730, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.089] GetCurrentProcessId () returned 0x1204 [0120.089] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x734 [0120.089] GetExitCodeProcess (in: hProcess=0x734, lpExitCode=0x228d1d8 | out: lpExitCode=0x228d1d8*=0x103) returned 1 [0120.089] CheckRemoteDebuggerPresent (in: hProcess=0x734, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.089] GetCurrentProcessId () returned 0x1204 [0120.089] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x738 [0120.089] GetExitCodeProcess (in: hProcess=0x738, lpExitCode=0x228d290 | out: lpExitCode=0x228d290*=0x103) returned 1 [0120.090] CheckRemoteDebuggerPresent (in: hProcess=0x738, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.090] GetCurrentProcessId () returned 0x1204 [0120.090] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x73c [0120.090] GetExitCodeProcess (in: hProcess=0x73c, lpExitCode=0x228d348 | out: lpExitCode=0x228d348*=0x103) returned 1 [0120.090] CheckRemoteDebuggerPresent (in: hProcess=0x73c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.090] GetCurrentProcessId () returned 0x1204 [0120.090] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x740 [0120.090] GetExitCodeProcess (in: hProcess=0x740, lpExitCode=0x228d400 | out: lpExitCode=0x228d400*=0x103) returned 1 [0120.090] CheckRemoteDebuggerPresent (in: hProcess=0x740, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.090] GetCurrentProcessId () returned 0x1204 [0120.090] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x744 [0120.090] GetExitCodeProcess (in: hProcess=0x744, lpExitCode=0x228d4b8 | out: lpExitCode=0x228d4b8*=0x103) returned 1 [0120.090] CheckRemoteDebuggerPresent (in: hProcess=0x744, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.090] GetCurrentProcessId () returned 0x1204 [0120.090] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x748 [0120.090] GetExitCodeProcess (in: hProcess=0x748, lpExitCode=0x228d570 | out: lpExitCode=0x228d570*=0x103) returned 1 [0120.090] CheckRemoteDebuggerPresent (in: hProcess=0x748, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.090] GetCurrentProcessId () returned 0x1204 [0120.090] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x74c [0120.090] GetExitCodeProcess (in: hProcess=0x74c, lpExitCode=0x228d628 | out: lpExitCode=0x228d628*=0x103) returned 1 [0120.091] CheckRemoteDebuggerPresent (in: hProcess=0x74c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.091] GetCurrentProcessId () returned 0x1204 [0120.091] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x750 [0120.091] GetExitCodeProcess (in: hProcess=0x750, lpExitCode=0x228d6e0 | out: lpExitCode=0x228d6e0*=0x103) returned 1 [0120.091] CheckRemoteDebuggerPresent (in: hProcess=0x750, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.091] GetCurrentProcessId () returned 0x1204 [0120.091] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x754 [0120.091] GetExitCodeProcess (in: hProcess=0x754, lpExitCode=0x228d798 | out: lpExitCode=0x228d798*=0x103) returned 1 [0120.091] CheckRemoteDebuggerPresent (in: hProcess=0x754, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.091] GetCurrentProcessId () returned 0x1204 [0120.091] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x758 [0120.091] GetExitCodeProcess (in: hProcess=0x758, lpExitCode=0x228d850 | out: lpExitCode=0x228d850*=0x103) returned 1 [0120.091] CheckRemoteDebuggerPresent (in: hProcess=0x758, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.091] GetCurrentProcessId () returned 0x1204 [0120.091] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x75c [0120.096] GetExitCodeProcess (in: hProcess=0x75c, lpExitCode=0x228d908 | out: lpExitCode=0x228d908*=0x103) returned 1 [0120.096] CheckRemoteDebuggerPresent (in: hProcess=0x75c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.096] GetCurrentProcessId () returned 0x1204 [0120.096] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x760 [0120.096] GetExitCodeProcess (in: hProcess=0x760, lpExitCode=0x228d9c0 | out: lpExitCode=0x228d9c0*=0x103) returned 1 [0120.096] CheckRemoteDebuggerPresent (in: hProcess=0x760, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.096] GetCurrentProcessId () returned 0x1204 [0120.096] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x764 [0120.097] GetExitCodeProcess (in: hProcess=0x764, lpExitCode=0x228da78 | out: lpExitCode=0x228da78*=0x103) returned 1 [0120.097] CheckRemoteDebuggerPresent (in: hProcess=0x764, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.097] GetCurrentProcessId () returned 0x1204 [0120.097] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x768 [0120.097] GetExitCodeProcess (in: hProcess=0x768, lpExitCode=0x228db30 | out: lpExitCode=0x228db30*=0x103) returned 1 [0120.097] CheckRemoteDebuggerPresent (in: hProcess=0x768, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.097] GetCurrentProcessId () returned 0x1204 [0120.097] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x76c [0120.097] GetExitCodeProcess (in: hProcess=0x76c, lpExitCode=0x228dbe8 | out: lpExitCode=0x228dbe8*=0x103) returned 1 [0120.097] CheckRemoteDebuggerPresent (in: hProcess=0x76c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.098] GetCurrentProcessId () returned 0x1204 [0120.098] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x770 [0120.098] GetExitCodeProcess (in: hProcess=0x770, lpExitCode=0x228dca0 | out: lpExitCode=0x228dca0*=0x103) returned 1 [0120.098] CheckRemoteDebuggerPresent (in: hProcess=0x770, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.103] GetCurrentProcessId () returned 0x1204 [0120.103] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x774 [0120.103] GetExitCodeProcess (in: hProcess=0x774, lpExitCode=0x228dd58 | out: lpExitCode=0x228dd58*=0x103) returned 1 [0120.103] CheckRemoteDebuggerPresent (in: hProcess=0x774, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.103] GetCurrentProcessId () returned 0x1204 [0120.103] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x778 [0120.103] GetExitCodeProcess (in: hProcess=0x778, lpExitCode=0x228de10 | out: lpExitCode=0x228de10*=0x103) returned 1 [0120.103] CheckRemoteDebuggerPresent (in: hProcess=0x778, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.104] GetCurrentProcessId () returned 0x1204 [0120.104] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x77c [0120.104] GetExitCodeProcess (in: hProcess=0x77c, lpExitCode=0x228dec8 | out: lpExitCode=0x228dec8*=0x103) returned 1 [0120.104] CheckRemoteDebuggerPresent (in: hProcess=0x77c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.104] GetCurrentProcessId () returned 0x1204 [0120.104] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x780 [0120.104] GetExitCodeProcess (in: hProcess=0x780, lpExitCode=0x228df80 | out: lpExitCode=0x228df80*=0x103) returned 1 [0120.104] CheckRemoteDebuggerPresent (in: hProcess=0x780, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.104] GetCurrentProcessId () returned 0x1204 [0120.104] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x784 [0120.105] GetExitCodeProcess (in: hProcess=0x784, lpExitCode=0x228e038 | out: lpExitCode=0x228e038*=0x103) returned 1 [0120.105] CheckRemoteDebuggerPresent (in: hProcess=0x784, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.105] GetCurrentProcessId () returned 0x1204 [0120.105] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x788 [0120.105] GetExitCodeProcess (in: hProcess=0x788, lpExitCode=0x228e0f0 | out: lpExitCode=0x228e0f0*=0x103) returned 1 [0120.105] CheckRemoteDebuggerPresent (in: hProcess=0x788, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.105] GetCurrentProcessId () returned 0x1204 [0120.105] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x78c [0120.105] GetExitCodeProcess (in: hProcess=0x78c, lpExitCode=0x228e1a8 | out: lpExitCode=0x228e1a8*=0x103) returned 1 [0120.105] CheckRemoteDebuggerPresent (in: hProcess=0x78c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.105] GetCurrentProcessId () returned 0x1204 [0120.107] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x790 [0120.107] GetExitCodeProcess (in: hProcess=0x790, lpExitCode=0x228e260 | out: lpExitCode=0x228e260*=0x103) returned 1 [0120.107] CheckRemoteDebuggerPresent (in: hProcess=0x790, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.107] GetCurrentProcessId () returned 0x1204 [0120.107] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x794 [0120.107] GetExitCodeProcess (in: hProcess=0x794, lpExitCode=0x228e318 | out: lpExitCode=0x228e318*=0x103) returned 1 [0120.107] CheckRemoteDebuggerPresent (in: hProcess=0x794, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.107] GetCurrentProcessId () returned 0x1204 [0120.107] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x798 [0120.107] GetExitCodeProcess (in: hProcess=0x798, lpExitCode=0x228e3d0 | out: lpExitCode=0x228e3d0*=0x103) returned 1 [0120.108] CheckRemoteDebuggerPresent (in: hProcess=0x798, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.108] GetCurrentProcessId () returned 0x1204 [0120.108] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x79c [0120.108] GetExitCodeProcess (in: hProcess=0x79c, lpExitCode=0x228e488 | out: lpExitCode=0x228e488*=0x103) returned 1 [0120.108] CheckRemoteDebuggerPresent (in: hProcess=0x79c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.108] GetCurrentProcessId () returned 0x1204 [0120.108] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x7a0 [0120.108] GetExitCodeProcess (in: hProcess=0x7a0, lpExitCode=0x228e540 | out: lpExitCode=0x228e540*=0x103) returned 1 [0120.108] CheckRemoteDebuggerPresent (in: hProcess=0x7a0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.108] GetCurrentProcessId () returned 0x1204 [0120.108] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x7a4 [0120.108] GetExitCodeProcess (in: hProcess=0x7a4, lpExitCode=0x228e5f8 | out: lpExitCode=0x228e5f8*=0x103) returned 1 [0120.108] CheckRemoteDebuggerPresent (in: hProcess=0x7a4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0120.286] GetCurrentProcessId () returned 0x1204 [0120.286] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0xb5c8 [0121.292] GetExitCodeProcess (in: hProcess=0xb5c8, lpExitCode=0x24810dc | out: lpExitCode=0x24810dc*=0x103) returned 1 [0121.292] CheckRemoteDebuggerPresent (in: hProcess=0xb5c8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.292] GetCurrentProcessId () returned 0x1204 [0121.292] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5ca8 [0121.293] GetExitCodeProcess (in: hProcess=0x5ca8, lpExitCode=0x2481194 | out: lpExitCode=0x2481194*=0x103) returned 1 [0121.293] CheckRemoteDebuggerPresent (in: hProcess=0x5ca8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.293] GetCurrentProcessId () returned 0x1204 [0121.293] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x384 [0121.293] GetExitCodeProcess (in: hProcess=0x384, lpExitCode=0x248124c | out: lpExitCode=0x248124c*=0x103) returned 1 [0121.293] CheckRemoteDebuggerPresent (in: hProcess=0x384, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.293] GetCurrentProcessId () returned 0x1204 [0121.293] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x8938 [0121.293] GetExitCodeProcess (in: hProcess=0x8938, lpExitCode=0x2481304 | out: lpExitCode=0x2481304*=0x103) returned 1 [0121.293] CheckRemoteDebuggerPresent (in: hProcess=0x8938, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.293] GetCurrentProcessId () returned 0x1204 [0121.293] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x388 [0121.293] GetExitCodeProcess (in: hProcess=0x388, lpExitCode=0x24813bc | out: lpExitCode=0x24813bc*=0x103) returned 1 [0121.293] CheckRemoteDebuggerPresent (in: hProcess=0x388, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.293] GetCurrentProcessId () returned 0x1204 [0121.293] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5cac [0121.294] GetExitCodeProcess (in: hProcess=0x5cac, lpExitCode=0x2481474 | out: lpExitCode=0x2481474*=0x103) returned 1 [0121.294] CheckRemoteDebuggerPresent (in: hProcess=0x5cac, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.294] GetCurrentProcessId () returned 0x1204 [0121.294] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x38c [0121.294] GetExitCodeProcess (in: hProcess=0x38c, lpExitCode=0x248152c | out: lpExitCode=0x248152c*=0x103) returned 1 [0121.294] CheckRemoteDebuggerPresent (in: hProcess=0x38c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.294] GetCurrentProcessId () returned 0x1204 [0121.294] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0xb2fc [0121.294] GetExitCodeProcess (in: hProcess=0xb2fc, lpExitCode=0x24815e4 | out: lpExitCode=0x24815e4*=0x103) returned 1 [0121.294] CheckRemoteDebuggerPresent (in: hProcess=0xb2fc, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.294] GetCurrentProcessId () returned 0x1204 [0121.294] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x390 [0121.294] GetExitCodeProcess (in: hProcess=0x390, lpExitCode=0x248169c | out: lpExitCode=0x248169c*=0x103) returned 1 [0121.294] CheckRemoteDebuggerPresent (in: hProcess=0x390, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.294] GetCurrentProcessId () returned 0x1204 [0121.295] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5cb0 [0121.295] GetExitCodeProcess (in: hProcess=0x5cb0, lpExitCode=0x2481754 | out: lpExitCode=0x2481754*=0x103) returned 1 [0121.295] CheckRemoteDebuggerPresent (in: hProcess=0x5cb0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.295] GetCurrentProcessId () returned 0x1204 [0121.295] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x394 [0121.295] GetExitCodeProcess (in: hProcess=0x394, lpExitCode=0x248180c | out: lpExitCode=0x248180c*=0x103) returned 1 [0121.295] CheckRemoteDebuggerPresent (in: hProcess=0x394, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.295] GetCurrentProcessId () returned 0x1204 [0121.295] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x893c [0121.295] GetExitCodeProcess (in: hProcess=0x893c, lpExitCode=0x24818c4 | out: lpExitCode=0x24818c4*=0x103) returned 1 [0121.295] CheckRemoteDebuggerPresent (in: hProcess=0x893c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.295] GetCurrentProcessId () returned 0x1204 [0121.295] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x398 [0121.295] GetExitCodeProcess (in: hProcess=0x398, lpExitCode=0x248197c | out: lpExitCode=0x248197c*=0x103) returned 1 [0121.296] CheckRemoteDebuggerPresent (in: hProcess=0x398, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.296] GetCurrentProcessId () returned 0x1204 [0121.296] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5cb4 [0121.296] GetExitCodeProcess (in: hProcess=0x5cb4, lpExitCode=0x2481a34 | out: lpExitCode=0x2481a34*=0x103) returned 1 [0121.296] CheckRemoteDebuggerPresent (in: hProcess=0x5cb4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.296] GetCurrentProcessId () returned 0x1204 [0121.296] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x39c [0121.296] GetExitCodeProcess (in: hProcess=0x39c, lpExitCode=0x2481aec | out: lpExitCode=0x2481aec*=0x103) returned 1 [0121.296] CheckRemoteDebuggerPresent (in: hProcess=0x39c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.296] GetCurrentProcessId () returned 0x1204 [0121.296] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x9f80 [0121.296] GetExitCodeProcess (in: hProcess=0x9f80, lpExitCode=0x2481ba4 | out: lpExitCode=0x2481ba4*=0x103) returned 1 [0121.296] CheckRemoteDebuggerPresent (in: hProcess=0x9f80, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.297] GetCurrentProcessId () returned 0x1204 [0121.297] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3a0 [0121.297] GetExitCodeProcess (in: hProcess=0x3a0, lpExitCode=0x2481c5c | out: lpExitCode=0x2481c5c*=0x103) returned 1 [0121.297] CheckRemoteDebuggerPresent (in: hProcess=0x3a0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.297] GetCurrentProcessId () returned 0x1204 [0121.297] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5cb8 [0121.297] GetExitCodeProcess (in: hProcess=0x5cb8, lpExitCode=0x2481d14 | out: lpExitCode=0x2481d14*=0x103) returned 1 [0121.297] CheckRemoteDebuggerPresent (in: hProcess=0x5cb8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.297] GetCurrentProcessId () returned 0x1204 [0121.297] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3a4 [0121.297] GetExitCodeProcess (in: hProcess=0x3a4, lpExitCode=0x2481dcc | out: lpExitCode=0x2481dcc*=0x103) returned 1 [0121.297] CheckRemoteDebuggerPresent (in: hProcess=0x3a4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.298] GetCurrentProcessId () returned 0x1204 [0121.298] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x8940 [0121.298] GetExitCodeProcess (in: hProcess=0x8940, lpExitCode=0x2481e84 | out: lpExitCode=0x2481e84*=0x103) returned 1 [0121.298] CheckRemoteDebuggerPresent (in: hProcess=0x8940, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.298] GetCurrentProcessId () returned 0x1204 [0121.298] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3a8 [0121.298] GetExitCodeProcess (in: hProcess=0x3a8, lpExitCode=0x2481f3c | out: lpExitCode=0x2481f3c*=0x103) returned 1 [0121.298] CheckRemoteDebuggerPresent (in: hProcess=0x3a8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.299] GetCurrentProcessId () returned 0x1204 [0121.299] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5cbc [0121.299] GetExitCodeProcess (in: hProcess=0x5cbc, lpExitCode=0x2481ff4 | out: lpExitCode=0x2481ff4*=0x103) returned 1 [0121.299] CheckRemoteDebuggerPresent (in: hProcess=0x5cbc, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.300] GetCurrentProcessId () returned 0x1204 [0121.300] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3ac [0121.300] GetExitCodeProcess (in: hProcess=0x3ac, lpExitCode=0x24820ac | out: lpExitCode=0x24820ac*=0x103) returned 1 [0121.300] CheckRemoteDebuggerPresent (in: hProcess=0x3ac, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.300] GetCurrentProcessId () returned 0x1204 [0121.300] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0xaaa4 [0121.300] GetExitCodeProcess (in: hProcess=0xaaa4, lpExitCode=0x2482164 | out: lpExitCode=0x2482164*=0x103) returned 1 [0121.300] CheckRemoteDebuggerPresent (in: hProcess=0xaaa4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.300] GetCurrentProcessId () returned 0x1204 [0121.300] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3b0 [0121.300] GetExitCodeProcess (in: hProcess=0x3b0, lpExitCode=0x248221c | out: lpExitCode=0x248221c*=0x103) returned 1 [0121.300] CheckRemoteDebuggerPresent (in: hProcess=0x3b0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.300] GetCurrentProcessId () returned 0x1204 [0121.300] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5cc0 [0121.300] GetExitCodeProcess (in: hProcess=0x5cc0, lpExitCode=0x24822d4 | out: lpExitCode=0x24822d4*=0x103) returned 1 [0121.301] CheckRemoteDebuggerPresent (in: hProcess=0x5cc0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.301] GetCurrentProcessId () returned 0x1204 [0121.301] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3b4 [0121.301] GetExitCodeProcess (in: hProcess=0x3b4, lpExitCode=0x248238c | out: lpExitCode=0x248238c*=0x103) returned 1 [0121.301] CheckRemoteDebuggerPresent (in: hProcess=0x3b4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.301] GetCurrentProcessId () returned 0x1204 [0121.301] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x8944 [0121.301] GetExitCodeProcess (in: hProcess=0x8944, lpExitCode=0x2482444 | out: lpExitCode=0x2482444*=0x103) returned 1 [0121.301] CheckRemoteDebuggerPresent (in: hProcess=0x8944, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.301] GetCurrentProcessId () returned 0x1204 [0121.301] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3b8 [0121.302] GetExitCodeProcess (in: hProcess=0x3b8, lpExitCode=0x24824fc | out: lpExitCode=0x24824fc*=0x103) returned 1 [0121.302] CheckRemoteDebuggerPresent (in: hProcess=0x3b8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.302] GetCurrentProcessId () returned 0x1204 [0121.302] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5cc4 [0121.302] GetExitCodeProcess (in: hProcess=0x5cc4, lpExitCode=0x24825b4 | out: lpExitCode=0x24825b4*=0x103) returned 1 [0121.302] CheckRemoteDebuggerPresent (in: hProcess=0x5cc4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.302] GetCurrentProcessId () returned 0x1204 [0121.302] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3c0 [0121.302] GetExitCodeProcess (in: hProcess=0x3c0, lpExitCode=0x248266c | out: lpExitCode=0x248266c*=0x103) returned 1 [0121.302] CheckRemoteDebuggerPresent (in: hProcess=0x3c0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.302] GetCurrentProcessId () returned 0x1204 [0121.302] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x9f84 [0121.303] GetExitCodeProcess (in: hProcess=0x9f84, lpExitCode=0x2482724 | out: lpExitCode=0x2482724*=0x103) returned 1 [0121.303] CheckRemoteDebuggerPresent (in: hProcess=0x9f84, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.303] GetCurrentProcessId () returned 0x1204 [0121.303] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3c4 [0121.303] GetExitCodeProcess (in: hProcess=0x3c4, lpExitCode=0x24827dc | out: lpExitCode=0x24827dc*=0x103) returned 1 [0121.303] CheckRemoteDebuggerPresent (in: hProcess=0x3c4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.303] GetCurrentProcessId () returned 0x1204 [0121.303] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5cc8 [0121.303] GetExitCodeProcess (in: hProcess=0x5cc8, lpExitCode=0x2482894 | out: lpExitCode=0x2482894*=0x103) returned 1 [0121.303] CheckRemoteDebuggerPresent (in: hProcess=0x5cc8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.303] GetCurrentProcessId () returned 0x1204 [0121.303] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3c8 [0121.304] GetExitCodeProcess (in: hProcess=0x3c8, lpExitCode=0x248294c | out: lpExitCode=0x248294c*=0x103) returned 1 [0121.304] CheckRemoteDebuggerPresent (in: hProcess=0x3c8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.304] GetCurrentProcessId () returned 0x1204 [0121.304] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x8948 [0121.304] GetExitCodeProcess (in: hProcess=0x8948, lpExitCode=0x2482a04 | out: lpExitCode=0x2482a04*=0x103) returned 1 [0121.304] CheckRemoteDebuggerPresent (in: hProcess=0x8948, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.304] GetCurrentProcessId () returned 0x1204 [0121.304] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3cc [0121.304] GetExitCodeProcess (in: hProcess=0x3cc, lpExitCode=0x2482abc | out: lpExitCode=0x2482abc*=0x103) returned 1 [0121.304] CheckRemoteDebuggerPresent (in: hProcess=0x3cc, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.304] GetCurrentProcessId () returned 0x1204 [0121.305] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5ccc [0121.305] GetExitCodeProcess (in: hProcess=0x5ccc, lpExitCode=0x2482b74 | out: lpExitCode=0x2482b74*=0x103) returned 1 [0121.305] CheckRemoteDebuggerPresent (in: hProcess=0x5ccc, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.305] GetCurrentProcessId () returned 0x1204 [0121.305] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3d0 [0121.305] GetExitCodeProcess (in: hProcess=0x3d0, lpExitCode=0x2482c2c | out: lpExitCode=0x2482c2c*=0x103) returned 1 [0121.305] CheckRemoteDebuggerPresent (in: hProcess=0x3d0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.305] GetCurrentProcessId () returned 0x1204 [0121.305] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0xb038 [0121.305] GetExitCodeProcess (in: hProcess=0xb038, lpExitCode=0x2482ce4 | out: lpExitCode=0x2482ce4*=0x103) returned 1 [0121.305] CheckRemoteDebuggerPresent (in: hProcess=0xb038, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.305] GetCurrentProcessId () returned 0x1204 [0121.305] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3d4 [0121.305] GetExitCodeProcess (in: hProcess=0x3d4, lpExitCode=0x2482d9c | out: lpExitCode=0x2482d9c*=0x103) returned 1 [0121.305] CheckRemoteDebuggerPresent (in: hProcess=0x3d4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.306] GetCurrentProcessId () returned 0x1204 [0121.306] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5cd0 [0121.306] GetExitCodeProcess (in: hProcess=0x5cd0, lpExitCode=0x2482e54 | out: lpExitCode=0x2482e54*=0x103) returned 1 [0121.306] CheckRemoteDebuggerPresent (in: hProcess=0x5cd0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.306] GetCurrentProcessId () returned 0x1204 [0121.306] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3d8 [0121.306] GetExitCodeProcess (in: hProcess=0x3d8, lpExitCode=0x2482f0c | out: lpExitCode=0x2482f0c*=0x103) returned 1 [0121.306] CheckRemoteDebuggerPresent (in: hProcess=0x3d8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.306] GetCurrentProcessId () returned 0x1204 [0121.306] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x894c [0121.306] GetExitCodeProcess (in: hProcess=0x894c, lpExitCode=0x2482fc4 | out: lpExitCode=0x2482fc4*=0x103) returned 1 [0121.306] CheckRemoteDebuggerPresent (in: hProcess=0x894c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.306] GetCurrentProcessId () returned 0x1204 [0121.306] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3dc [0121.306] GetExitCodeProcess (in: hProcess=0x3dc, lpExitCode=0x248307c | out: lpExitCode=0x248307c*=0x103) returned 1 [0121.306] CheckRemoteDebuggerPresent (in: hProcess=0x3dc, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.307] GetCurrentProcessId () returned 0x1204 [0121.307] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5cd4 [0121.307] GetExitCodeProcess (in: hProcess=0x5cd4, lpExitCode=0x2483134 | out: lpExitCode=0x2483134*=0x103) returned 1 [0121.307] CheckRemoteDebuggerPresent (in: hProcess=0x5cd4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.307] GetCurrentProcessId () returned 0x1204 [0121.307] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3e0 [0121.307] GetExitCodeProcess (in: hProcess=0x3e0, lpExitCode=0x24831ec | out: lpExitCode=0x24831ec*=0x103) returned 1 [0121.307] CheckRemoteDebuggerPresent (in: hProcess=0x3e0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.307] GetCurrentProcessId () returned 0x1204 [0121.307] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x9f88 [0121.307] GetExitCodeProcess (in: hProcess=0x9f88, lpExitCode=0x24832a4 | out: lpExitCode=0x24832a4*=0x103) returned 1 [0121.307] CheckRemoteDebuggerPresent (in: hProcess=0x9f88, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.307] GetCurrentProcessId () returned 0x1204 [0121.307] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3e4 [0121.307] GetExitCodeProcess (in: hProcess=0x3e4, lpExitCode=0x248335c | out: lpExitCode=0x248335c*=0x103) returned 1 [0121.308] CheckRemoteDebuggerPresent (in: hProcess=0x3e4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.308] GetCurrentProcessId () returned 0x1204 [0121.308] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5cd8 [0121.308] GetExitCodeProcess (in: hProcess=0x5cd8, lpExitCode=0x2483414 | out: lpExitCode=0x2483414*=0x103) returned 1 [0121.308] CheckRemoteDebuggerPresent (in: hProcess=0x5cd8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.308] GetCurrentProcessId () returned 0x1204 [0121.308] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3e8 [0121.308] GetExitCodeProcess (in: hProcess=0x3e8, lpExitCode=0x24834cc | out: lpExitCode=0x24834cc*=0x103) returned 1 [0121.308] CheckRemoteDebuggerPresent (in: hProcess=0x3e8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.308] GetCurrentProcessId () returned 0x1204 [0121.308] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x8950 [0121.308] GetExitCodeProcess (in: hProcess=0x8950, lpExitCode=0x2483584 | out: lpExitCode=0x2483584*=0x103) returned 1 [0121.308] CheckRemoteDebuggerPresent (in: hProcess=0x8950, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.308] GetCurrentProcessId () returned 0x1204 [0121.308] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3ec [0121.308] GetExitCodeProcess (in: hProcess=0x3ec, lpExitCode=0x248363c | out: lpExitCode=0x248363c*=0x103) returned 1 [0121.309] CheckRemoteDebuggerPresent (in: hProcess=0x3ec, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.309] GetCurrentProcessId () returned 0x1204 [0121.309] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5cdc [0121.309] GetExitCodeProcess (in: hProcess=0x5cdc, lpExitCode=0x24836f4 | out: lpExitCode=0x24836f4*=0x103) returned 1 [0121.309] CheckRemoteDebuggerPresent (in: hProcess=0x5cdc, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.309] GetCurrentProcessId () returned 0x1204 [0121.309] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3f0 [0121.309] GetExitCodeProcess (in: hProcess=0x3f0, lpExitCode=0x24837ac | out: lpExitCode=0x24837ac*=0x103) returned 1 [0121.309] CheckRemoteDebuggerPresent (in: hProcess=0x3f0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.309] GetCurrentProcessId () returned 0x1204 [0121.309] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0xaaa8 [0121.309] GetExitCodeProcess (in: hProcess=0xaaa8, lpExitCode=0x2483864 | out: lpExitCode=0x2483864*=0x103) returned 1 [0121.309] CheckRemoteDebuggerPresent (in: hProcess=0xaaa8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.310] GetCurrentProcessId () returned 0x1204 [0121.310] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3f4 [0121.310] GetExitCodeProcess (in: hProcess=0x3f4, lpExitCode=0x248391c | out: lpExitCode=0x248391c*=0x103) returned 1 [0121.310] CheckRemoteDebuggerPresent (in: hProcess=0x3f4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.310] GetCurrentProcessId () returned 0x1204 [0121.310] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5ce0 [0121.310] GetExitCodeProcess (in: hProcess=0x5ce0, lpExitCode=0x24839d4 | out: lpExitCode=0x24839d4*=0x103) returned 1 [0121.310] CheckRemoteDebuggerPresent (in: hProcess=0x5ce0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.310] GetCurrentProcessId () returned 0x1204 [0121.310] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3f8 [0121.310] GetExitCodeProcess (in: hProcess=0x3f8, lpExitCode=0x2483a8c | out: lpExitCode=0x2483a8c*=0x103) returned 1 [0121.310] CheckRemoteDebuggerPresent (in: hProcess=0x3f8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.310] GetCurrentProcessId () returned 0x1204 [0121.310] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x8954 [0121.310] GetExitCodeProcess (in: hProcess=0x8954, lpExitCode=0x2483b44 | out: lpExitCode=0x2483b44*=0x103) returned 1 [0121.310] CheckRemoteDebuggerPresent (in: hProcess=0x8954, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.311] GetCurrentProcessId () returned 0x1204 [0121.311] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x3fc [0121.311] GetExitCodeProcess (in: hProcess=0x3fc, lpExitCode=0x2483bfc | out: lpExitCode=0x2483bfc*=0x103) returned 1 [0121.311] CheckRemoteDebuggerPresent (in: hProcess=0x3fc, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.311] GetCurrentProcessId () returned 0x1204 [0121.311] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5ce4 [0121.311] GetExitCodeProcess (in: hProcess=0x5ce4, lpExitCode=0x2483cb4 | out: lpExitCode=0x2483cb4*=0x103) returned 1 [0121.311] CheckRemoteDebuggerPresent (in: hProcess=0x5ce4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.311] GetCurrentProcessId () returned 0x1204 [0121.311] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x404 [0121.311] GetExitCodeProcess (in: hProcess=0x404, lpExitCode=0x2483d6c | out: lpExitCode=0x2483d6c*=0x103) returned 1 [0121.311] CheckRemoteDebuggerPresent (in: hProcess=0x404, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.311] GetCurrentProcessId () returned 0x1204 [0121.312] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x9f8c [0121.312] GetExitCodeProcess (in: hProcess=0x9f8c, lpExitCode=0x2483e24 | out: lpExitCode=0x2483e24*=0x103) returned 1 [0121.312] CheckRemoteDebuggerPresent (in: hProcess=0x9f8c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.312] GetCurrentProcessId () returned 0x1204 [0121.312] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x408 [0121.312] GetExitCodeProcess (in: hProcess=0x408, lpExitCode=0x2483edc | out: lpExitCode=0x2483edc*=0x103) returned 1 [0121.312] CheckRemoteDebuggerPresent (in: hProcess=0x408, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.312] GetCurrentProcessId () returned 0x1204 [0121.312] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5ce8 [0121.312] GetExitCodeProcess (in: hProcess=0x5ce8, lpExitCode=0x2483f94 | out: lpExitCode=0x2483f94*=0x103) returned 1 [0121.312] CheckRemoteDebuggerPresent (in: hProcess=0x5ce8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.313] GetCurrentProcessId () returned 0x1204 [0121.313] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x40c [0121.313] GetExitCodeProcess (in: hProcess=0x40c, lpExitCode=0x248404c | out: lpExitCode=0x248404c*=0x103) returned 1 [0121.313] CheckRemoteDebuggerPresent (in: hProcess=0x40c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.313] GetCurrentProcessId () returned 0x1204 [0121.313] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x8958 [0121.314] GetExitCodeProcess (in: hProcess=0x8958, lpExitCode=0x2484104 | out: lpExitCode=0x2484104*=0x103) returned 1 [0121.315] CheckRemoteDebuggerPresent (in: hProcess=0x8958, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.315] GetCurrentProcessId () returned 0x1204 [0121.315] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x410 [0121.315] GetExitCodeProcess (in: hProcess=0x410, lpExitCode=0x24841bc | out: lpExitCode=0x24841bc*=0x103) returned 1 [0121.315] CheckRemoteDebuggerPresent (in: hProcess=0x410, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.315] GetCurrentProcessId () returned 0x1204 [0121.315] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5cec [0121.315] GetExitCodeProcess (in: hProcess=0x5cec, lpExitCode=0x2484274 | out: lpExitCode=0x2484274*=0x103) returned 1 [0121.315] CheckRemoteDebuggerPresent (in: hProcess=0x5cec, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.315] GetCurrentProcessId () returned 0x1204 [0121.315] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x414 [0121.315] GetExitCodeProcess (in: hProcess=0x414, lpExitCode=0x248432c | out: lpExitCode=0x248432c*=0x103) returned 1 [0121.315] CheckRemoteDebuggerPresent (in: hProcess=0x414, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.315] GetCurrentProcessId () returned 0x1204 [0121.316] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0xb464 [0121.316] GetExitCodeProcess (in: hProcess=0xb464, lpExitCode=0x24843e4 | out: lpExitCode=0x24843e4*=0x103) returned 1 [0121.316] CheckRemoteDebuggerPresent (in: hProcess=0xb464, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.316] GetCurrentProcessId () returned 0x1204 [0121.316] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x418 [0121.316] GetExitCodeProcess (in: hProcess=0x418, lpExitCode=0x248449c | out: lpExitCode=0x248449c*=0x103) returned 1 [0121.316] CheckRemoteDebuggerPresent (in: hProcess=0x418, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.316] GetCurrentProcessId () returned 0x1204 [0121.316] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5cf0 [0121.316] GetExitCodeProcess (in: hProcess=0x5cf0, lpExitCode=0x2484554 | out: lpExitCode=0x2484554*=0x103) returned 1 [0121.316] CheckRemoteDebuggerPresent (in: hProcess=0x5cf0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.316] GetCurrentProcessId () returned 0x1204 [0121.316] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x41c [0121.316] GetExitCodeProcess (in: hProcess=0x41c, lpExitCode=0x248460c | out: lpExitCode=0x248460c*=0x103) returned 1 [0121.316] CheckRemoteDebuggerPresent (in: hProcess=0x41c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.316] GetCurrentProcessId () returned 0x1204 [0121.316] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x895c [0121.317] GetExitCodeProcess (in: hProcess=0x895c, lpExitCode=0x24846c4 | out: lpExitCode=0x24846c4*=0x103) returned 1 [0121.317] CheckRemoteDebuggerPresent (in: hProcess=0x895c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.317] GetCurrentProcessId () returned 0x1204 [0121.317] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x420 [0121.317] GetExitCodeProcess (in: hProcess=0x420, lpExitCode=0x248477c | out: lpExitCode=0x248477c*=0x103) returned 1 [0121.317] CheckRemoteDebuggerPresent (in: hProcess=0x420, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.317] GetCurrentProcessId () returned 0x1204 [0121.317] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5cf4 [0121.317] GetExitCodeProcess (in: hProcess=0x5cf4, lpExitCode=0x2484834 | out: lpExitCode=0x2484834*=0x103) returned 1 [0121.317] CheckRemoteDebuggerPresent (in: hProcess=0x5cf4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.317] GetCurrentProcessId () returned 0x1204 [0121.317] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x424 [0121.317] GetExitCodeProcess (in: hProcess=0x424, lpExitCode=0x24848ec | out: lpExitCode=0x24848ec*=0x103) returned 1 [0121.317] CheckRemoteDebuggerPresent (in: hProcess=0x424, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.317] GetCurrentProcessId () returned 0x1204 [0121.317] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x9f90 [0121.317] GetExitCodeProcess (in: hProcess=0x9f90, lpExitCode=0x24849a4 | out: lpExitCode=0x24849a4*=0x103) returned 1 [0121.318] CheckRemoteDebuggerPresent (in: hProcess=0x9f90, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.318] GetCurrentProcessId () returned 0x1204 [0121.318] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x428 [0121.318] GetExitCodeProcess (in: hProcess=0x428, lpExitCode=0x2484a5c | out: lpExitCode=0x2484a5c*=0x103) returned 1 [0121.318] CheckRemoteDebuggerPresent (in: hProcess=0x428, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.318] GetCurrentProcessId () returned 0x1204 [0121.318] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5cf8 [0121.318] GetExitCodeProcess (in: hProcess=0x5cf8, lpExitCode=0x2484b14 | out: lpExitCode=0x2484b14*=0x103) returned 1 [0121.318] CheckRemoteDebuggerPresent (in: hProcess=0x5cf8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.318] GetCurrentProcessId () returned 0x1204 [0121.318] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x42c [0121.318] GetExitCodeProcess (in: hProcess=0x42c, lpExitCode=0x2484bcc | out: lpExitCode=0x2484bcc*=0x103) returned 1 [0121.318] CheckRemoteDebuggerPresent (in: hProcess=0x42c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.318] GetCurrentProcessId () returned 0x1204 [0121.318] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x8960 [0121.318] GetExitCodeProcess (in: hProcess=0x8960, lpExitCode=0x2484c84 | out: lpExitCode=0x2484c84*=0x103) returned 1 [0121.319] CheckRemoteDebuggerPresent (in: hProcess=0x8960, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.319] GetCurrentProcessId () returned 0x1204 [0121.319] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x430 [0121.319] GetExitCodeProcess (in: hProcess=0x430, lpExitCode=0x2484d3c | out: lpExitCode=0x2484d3c*=0x103) returned 1 [0121.319] CheckRemoteDebuggerPresent (in: hProcess=0x430, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.319] GetCurrentProcessId () returned 0x1204 [0121.319] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5cfc [0121.319] GetExitCodeProcess (in: hProcess=0x5cfc, lpExitCode=0x2484df4 | out: lpExitCode=0x2484df4*=0x103) returned 1 [0121.319] CheckRemoteDebuggerPresent (in: hProcess=0x5cfc, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.319] GetCurrentProcessId () returned 0x1204 [0121.319] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x434 [0121.319] GetExitCodeProcess (in: hProcess=0x434, lpExitCode=0x2484eac | out: lpExitCode=0x2484eac*=0x103) returned 1 [0121.319] CheckRemoteDebuggerPresent (in: hProcess=0x434, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.320] GetCurrentProcessId () returned 0x1204 [0121.320] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0xaaac [0121.320] GetExitCodeProcess (in: hProcess=0xaaac, lpExitCode=0x2484f64 | out: lpExitCode=0x2484f64*=0x103) returned 1 [0121.320] CheckRemoteDebuggerPresent (in: hProcess=0xaaac, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.320] GetCurrentProcessId () returned 0x1204 [0121.320] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x438 [0121.320] GetExitCodeProcess (in: hProcess=0x438, lpExitCode=0x248501c | out: lpExitCode=0x248501c*=0x103) returned 1 [0121.320] CheckRemoteDebuggerPresent (in: hProcess=0x438, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.320] GetCurrentProcessId () returned 0x1204 [0121.320] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d00 [0121.320] GetExitCodeProcess (in: hProcess=0x5d00, lpExitCode=0x24850d4 | out: lpExitCode=0x24850d4*=0x103) returned 1 [0121.320] CheckRemoteDebuggerPresent (in: hProcess=0x5d00, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.320] GetCurrentProcessId () returned 0x1204 [0121.320] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x43c [0121.320] GetExitCodeProcess (in: hProcess=0x43c, lpExitCode=0x248518c | out: lpExitCode=0x248518c*=0x103) returned 1 [0121.320] CheckRemoteDebuggerPresent (in: hProcess=0x43c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.320] GetCurrentProcessId () returned 0x1204 [0121.321] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x8964 [0121.321] GetExitCodeProcess (in: hProcess=0x8964, lpExitCode=0x2485244 | out: lpExitCode=0x2485244*=0x103) returned 1 [0121.321] CheckRemoteDebuggerPresent (in: hProcess=0x8964, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.321] GetCurrentProcessId () returned 0x1204 [0121.321] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x440 [0121.321] GetExitCodeProcess (in: hProcess=0x440, lpExitCode=0x24852fc | out: lpExitCode=0x24852fc*=0x103) returned 1 [0121.321] CheckRemoteDebuggerPresent (in: hProcess=0x440, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.321] GetCurrentProcessId () returned 0x1204 [0121.321] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d04 [0121.321] GetExitCodeProcess (in: hProcess=0x5d04, lpExitCode=0x24853b4 | out: lpExitCode=0x24853b4*=0x103) returned 1 [0121.321] CheckRemoteDebuggerPresent (in: hProcess=0x5d04, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.322] GetCurrentProcessId () returned 0x1204 [0121.322] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x444 [0121.322] GetExitCodeProcess (in: hProcess=0x444, lpExitCode=0x248546c | out: lpExitCode=0x248546c*=0x103) returned 1 [0121.322] CheckRemoteDebuggerPresent (in: hProcess=0x444, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.322] GetCurrentProcessId () returned 0x1204 [0121.322] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x9f94 [0121.322] GetExitCodeProcess (in: hProcess=0x9f94, lpExitCode=0x2485524 | out: lpExitCode=0x2485524*=0x103) returned 1 [0121.322] CheckRemoteDebuggerPresent (in: hProcess=0x9f94, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.322] GetCurrentProcessId () returned 0x1204 [0121.322] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x448 [0121.322] GetExitCodeProcess (in: hProcess=0x448, lpExitCode=0x24855dc | out: lpExitCode=0x24855dc*=0x103) returned 1 [0121.333] CheckRemoteDebuggerPresent (in: hProcess=0x448, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.333] GetCurrentProcessId () returned 0x1204 [0121.333] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d08 [0121.334] GetExitCodeProcess (in: hProcess=0x5d08, lpExitCode=0x2485694 | out: lpExitCode=0x2485694*=0x103) returned 1 [0121.334] CheckRemoteDebuggerPresent (in: hProcess=0x5d08, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.334] GetCurrentProcessId () returned 0x1204 [0121.334] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x44c [0121.334] GetExitCodeProcess (in: hProcess=0x44c, lpExitCode=0x248574c | out: lpExitCode=0x248574c*=0x103) returned 1 [0121.334] CheckRemoteDebuggerPresent (in: hProcess=0x44c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.334] GetCurrentProcessId () returned 0x1204 [0121.334] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x8968 [0121.334] GetExitCodeProcess (in: hProcess=0x8968, lpExitCode=0x2485804 | out: lpExitCode=0x2485804*=0x103) returned 1 [0121.334] CheckRemoteDebuggerPresent (in: hProcess=0x8968, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.334] GetCurrentProcessId () returned 0x1204 [0121.334] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x450 [0121.334] GetExitCodeProcess (in: hProcess=0x450, lpExitCode=0x24858bc | out: lpExitCode=0x24858bc*=0x103) returned 1 [0121.334] CheckRemoteDebuggerPresent (in: hProcess=0x450, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.334] GetCurrentProcessId () returned 0x1204 [0121.334] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d0c [0121.334] GetExitCodeProcess (in: hProcess=0x5d0c, lpExitCode=0x2485974 | out: lpExitCode=0x2485974*=0x103) returned 1 [0121.335] CheckRemoteDebuggerPresent (in: hProcess=0x5d0c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.335] GetCurrentProcessId () returned 0x1204 [0121.335] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x454 [0121.335] GetExitCodeProcess (in: hProcess=0x454, lpExitCode=0x2485a2c | out: lpExitCode=0x2485a2c*=0x103) returned 1 [0121.335] CheckRemoteDebuggerPresent (in: hProcess=0x454, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.335] GetCurrentProcessId () returned 0x1204 [0121.335] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0xb03c [0121.335] GetExitCodeProcess (in: hProcess=0xb03c, lpExitCode=0x2485ae4 | out: lpExitCode=0x2485ae4*=0x103) returned 1 [0121.335] CheckRemoteDebuggerPresent (in: hProcess=0xb03c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.335] GetCurrentProcessId () returned 0x1204 [0121.335] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x458 [0121.335] GetExitCodeProcess (in: hProcess=0x458, lpExitCode=0x2485b9c | out: lpExitCode=0x2485b9c*=0x103) returned 1 [0121.335] CheckRemoteDebuggerPresent (in: hProcess=0x458, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.335] GetCurrentProcessId () returned 0x1204 [0121.335] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d10 [0121.335] GetExitCodeProcess (in: hProcess=0x5d10, lpExitCode=0x2485c54 | out: lpExitCode=0x2485c54*=0x103) returned 1 [0121.336] CheckRemoteDebuggerPresent (in: hProcess=0x5d10, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.336] GetCurrentProcessId () returned 0x1204 [0121.336] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x45c [0121.336] GetExitCodeProcess (in: hProcess=0x45c, lpExitCode=0x2485d0c | out: lpExitCode=0x2485d0c*=0x103) returned 1 [0121.336] CheckRemoteDebuggerPresent (in: hProcess=0x45c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.336] GetCurrentProcessId () returned 0x1204 [0121.336] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x896c [0121.336] GetExitCodeProcess (in: hProcess=0x896c, lpExitCode=0x2485dc4 | out: lpExitCode=0x2485dc4*=0x103) returned 1 [0121.336] CheckRemoteDebuggerPresent (in: hProcess=0x896c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.336] GetCurrentProcessId () returned 0x1204 [0121.336] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x460 [0121.336] GetExitCodeProcess (in: hProcess=0x460, lpExitCode=0x2485e7c | out: lpExitCode=0x2485e7c*=0x103) returned 1 [0121.336] CheckRemoteDebuggerPresent (in: hProcess=0x460, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.336] GetCurrentProcessId () returned 0x1204 [0121.336] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d14 [0121.336] GetExitCodeProcess (in: hProcess=0x5d14, lpExitCode=0x2485f34 | out: lpExitCode=0x2485f34*=0x103) returned 1 [0121.336] CheckRemoteDebuggerPresent (in: hProcess=0x5d14, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.337] GetCurrentProcessId () returned 0x1204 [0121.337] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x464 [0121.337] GetExitCodeProcess (in: hProcess=0x464, lpExitCode=0x2485fec | out: lpExitCode=0x2485fec*=0x103) returned 1 [0121.337] CheckRemoteDebuggerPresent (in: hProcess=0x464, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.337] GetCurrentProcessId () returned 0x1204 [0121.337] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x9f98 [0121.337] GetExitCodeProcess (in: hProcess=0x9f98, lpExitCode=0x24860a4 | out: lpExitCode=0x24860a4*=0x103) returned 1 [0121.337] CheckRemoteDebuggerPresent (in: hProcess=0x9f98, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.337] GetCurrentProcessId () returned 0x1204 [0121.337] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x468 [0121.337] GetExitCodeProcess (in: hProcess=0x468, lpExitCode=0x248615c | out: lpExitCode=0x248615c*=0x103) returned 1 [0121.337] CheckRemoteDebuggerPresent (in: hProcess=0x468, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.337] GetCurrentProcessId () returned 0x1204 [0121.337] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d18 [0121.337] GetExitCodeProcess (in: hProcess=0x5d18, lpExitCode=0x2486214 | out: lpExitCode=0x2486214*=0x103) returned 1 [0121.338] CheckRemoteDebuggerPresent (in: hProcess=0x5d18, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.338] GetCurrentProcessId () returned 0x1204 [0121.338] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x46c [0121.338] GetExitCodeProcess (in: hProcess=0x46c, lpExitCode=0x24862cc | out: lpExitCode=0x24862cc*=0x103) returned 1 [0121.338] CheckRemoteDebuggerPresent (in: hProcess=0x46c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.338] GetCurrentProcessId () returned 0x1204 [0121.338] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x8970 [0121.338] GetExitCodeProcess (in: hProcess=0x8970, lpExitCode=0x2486384 | out: lpExitCode=0x2486384*=0x103) returned 1 [0121.338] CheckRemoteDebuggerPresent (in: hProcess=0x8970, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.338] GetCurrentProcessId () returned 0x1204 [0121.338] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x470 [0121.338] GetExitCodeProcess (in: hProcess=0x470, lpExitCode=0x248643c | out: lpExitCode=0x248643c*=0x103) returned 1 [0121.338] CheckRemoteDebuggerPresent (in: hProcess=0x470, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.338] GetCurrentProcessId () returned 0x1204 [0121.338] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d1c [0121.338] GetExitCodeProcess (in: hProcess=0x5d1c, lpExitCode=0x24864f4 | out: lpExitCode=0x24864f4*=0x103) returned 1 [0121.338] CheckRemoteDebuggerPresent (in: hProcess=0x5d1c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.339] GetCurrentProcessId () returned 0x1204 [0121.339] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x474 [0121.339] GetExitCodeProcess (in: hProcess=0x474, lpExitCode=0x24865ac | out: lpExitCode=0x24865ac*=0x103) returned 1 [0121.339] CheckRemoteDebuggerPresent (in: hProcess=0x474, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.339] GetCurrentProcessId () returned 0x1204 [0121.339] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0xaab0 [0121.339] GetExitCodeProcess (in: hProcess=0xaab0, lpExitCode=0x2486664 | out: lpExitCode=0x2486664*=0x103) returned 1 [0121.339] CheckRemoteDebuggerPresent (in: hProcess=0xaab0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.339] GetCurrentProcessId () returned 0x1204 [0121.339] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x478 [0121.339] GetExitCodeProcess (in: hProcess=0x478, lpExitCode=0x248671c | out: lpExitCode=0x248671c*=0x103) returned 1 [0121.339] CheckRemoteDebuggerPresent (in: hProcess=0x478, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.339] GetCurrentProcessId () returned 0x1204 [0121.339] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d20 [0121.340] GetExitCodeProcess (in: hProcess=0x5d20, lpExitCode=0x24867d4 | out: lpExitCode=0x24867d4*=0x103) returned 1 [0121.340] CheckRemoteDebuggerPresent (in: hProcess=0x5d20, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.340] GetCurrentProcessId () returned 0x1204 [0121.340] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x47c [0121.340] GetExitCodeProcess (in: hProcess=0x47c, lpExitCode=0x248688c | out: lpExitCode=0x248688c*=0x103) returned 1 [0121.340] CheckRemoteDebuggerPresent (in: hProcess=0x47c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.340] GetCurrentProcessId () returned 0x1204 [0121.340] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x8974 [0121.340] GetExitCodeProcess (in: hProcess=0x8974, lpExitCode=0x2486944 | out: lpExitCode=0x2486944*=0x103) returned 1 [0121.340] CheckRemoteDebuggerPresent (in: hProcess=0x8974, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.340] GetCurrentProcessId () returned 0x1204 [0121.340] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x480 [0121.340] GetExitCodeProcess (in: hProcess=0x480, lpExitCode=0x24869fc | out: lpExitCode=0x24869fc*=0x103) returned 1 [0121.340] CheckRemoteDebuggerPresent (in: hProcess=0x480, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.340] GetCurrentProcessId () returned 0x1204 [0121.340] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d24 [0121.340] GetExitCodeProcess (in: hProcess=0x5d24, lpExitCode=0x2486ab4 | out: lpExitCode=0x2486ab4*=0x103) returned 1 [0121.341] CheckRemoteDebuggerPresent (in: hProcess=0x5d24, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.341] GetCurrentProcessId () returned 0x1204 [0121.341] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x484 [0121.341] GetExitCodeProcess (in: hProcess=0x484, lpExitCode=0x2486b6c | out: lpExitCode=0x2486b6c*=0x103) returned 1 [0121.341] CheckRemoteDebuggerPresent (in: hProcess=0x484, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.341] GetCurrentProcessId () returned 0x1204 [0121.341] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x9f9c [0121.341] GetExitCodeProcess (in: hProcess=0x9f9c, lpExitCode=0x2486c24 | out: lpExitCode=0x2486c24*=0x103) returned 1 [0121.341] CheckRemoteDebuggerPresent (in: hProcess=0x9f9c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.341] GetCurrentProcessId () returned 0x1204 [0121.341] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x488 [0121.341] GetExitCodeProcess (in: hProcess=0x488, lpExitCode=0x2486cdc | out: lpExitCode=0x2486cdc*=0x103) returned 1 [0121.341] CheckRemoteDebuggerPresent (in: hProcess=0x488, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.341] GetCurrentProcessId () returned 0x1204 [0121.341] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d28 [0121.341] GetExitCodeProcess (in: hProcess=0x5d28, lpExitCode=0x2486d94 | out: lpExitCode=0x2486d94*=0x103) returned 1 [0121.341] CheckRemoteDebuggerPresent (in: hProcess=0x5d28, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.341] GetCurrentProcessId () returned 0x1204 [0121.341] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x48c [0121.341] GetExitCodeProcess (in: hProcess=0x48c, lpExitCode=0x2486e4c | out: lpExitCode=0x2486e4c*=0x103) returned 1 [0121.342] CheckRemoteDebuggerPresent (in: hProcess=0x48c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.342] GetCurrentProcessId () returned 0x1204 [0121.342] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x8978 [0121.342] GetExitCodeProcess (in: hProcess=0x8978, lpExitCode=0x2486f04 | out: lpExitCode=0x2486f04*=0x103) returned 1 [0121.342] CheckRemoteDebuggerPresent (in: hProcess=0x8978, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.342] GetCurrentProcessId () returned 0x1204 [0121.342] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x490 [0121.342] GetExitCodeProcess (in: hProcess=0x490, lpExitCode=0x2486fbc | out: lpExitCode=0x2486fbc*=0x103) returned 1 [0121.342] CheckRemoteDebuggerPresent (in: hProcess=0x490, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.342] GetCurrentProcessId () returned 0x1204 [0121.342] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d2c [0121.342] GetExitCodeProcess (in: hProcess=0x5d2c, lpExitCode=0x2487074 | out: lpExitCode=0x2487074*=0x103) returned 1 [0121.342] CheckRemoteDebuggerPresent (in: hProcess=0x5d2c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.342] GetCurrentProcessId () returned 0x1204 [0121.342] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x494 [0121.342] GetExitCodeProcess (in: hProcess=0x494, lpExitCode=0x248712c | out: lpExitCode=0x248712c*=0x103) returned 1 [0121.343] CheckRemoteDebuggerPresent (in: hProcess=0x494, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.343] GetCurrentProcessId () returned 0x1204 [0121.343] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0xb300 [0121.343] GetExitCodeProcess (in: hProcess=0xb300, lpExitCode=0x24871e4 | out: lpExitCode=0x24871e4*=0x103) returned 1 [0121.343] CheckRemoteDebuggerPresent (in: hProcess=0xb300, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.343] GetCurrentProcessId () returned 0x1204 [0121.343] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x498 [0121.343] GetExitCodeProcess (in: hProcess=0x498, lpExitCode=0x248729c | out: lpExitCode=0x248729c*=0x103) returned 1 [0121.343] CheckRemoteDebuggerPresent (in: hProcess=0x498, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.343] GetCurrentProcessId () returned 0x1204 [0121.343] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d30 [0121.343] GetExitCodeProcess (in: hProcess=0x5d30, lpExitCode=0x2487354 | out: lpExitCode=0x2487354*=0x103) returned 1 [0121.343] CheckRemoteDebuggerPresent (in: hProcess=0x5d30, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.343] GetCurrentProcessId () returned 0x1204 [0121.344] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x49c [0121.344] GetExitCodeProcess (in: hProcess=0x49c, lpExitCode=0x248740c | out: lpExitCode=0x248740c*=0x103) returned 1 [0121.344] CheckRemoteDebuggerPresent (in: hProcess=0x49c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.344] GetCurrentProcessId () returned 0x1204 [0121.344] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x897c [0121.344] GetExitCodeProcess (in: hProcess=0x897c, lpExitCode=0x24874c4 | out: lpExitCode=0x24874c4*=0x103) returned 1 [0121.344] CheckRemoteDebuggerPresent (in: hProcess=0x897c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.344] GetCurrentProcessId () returned 0x1204 [0121.344] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4a0 [0121.344] GetExitCodeProcess (in: hProcess=0x4a0, lpExitCode=0x248757c | out: lpExitCode=0x248757c*=0x103) returned 1 [0121.344] CheckRemoteDebuggerPresent (in: hProcess=0x4a0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.344] GetCurrentProcessId () returned 0x1204 [0121.344] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d34 [0121.344] GetExitCodeProcess (in: hProcess=0x5d34, lpExitCode=0x2487634 | out: lpExitCode=0x2487634*=0x103) returned 1 [0121.344] CheckRemoteDebuggerPresent (in: hProcess=0x5d34, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.345] GetCurrentProcessId () returned 0x1204 [0121.345] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4a4 [0121.345] GetExitCodeProcess (in: hProcess=0x4a4, lpExitCode=0x24876ec | out: lpExitCode=0x24876ec*=0x103) returned 1 [0121.345] CheckRemoteDebuggerPresent (in: hProcess=0x4a4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.345] GetCurrentProcessId () returned 0x1204 [0121.345] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x9fa0 [0121.345] GetExitCodeProcess (in: hProcess=0x9fa0, lpExitCode=0x24877a4 | out: lpExitCode=0x24877a4*=0x103) returned 1 [0121.345] CheckRemoteDebuggerPresent (in: hProcess=0x9fa0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.345] GetCurrentProcessId () returned 0x1204 [0121.345] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4a8 [0121.345] GetExitCodeProcess (in: hProcess=0x4a8, lpExitCode=0x248785c | out: lpExitCode=0x248785c*=0x103) returned 1 [0121.345] CheckRemoteDebuggerPresent (in: hProcess=0x4a8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.345] GetCurrentProcessId () returned 0x1204 [0121.345] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d38 [0121.345] GetExitCodeProcess (in: hProcess=0x5d38, lpExitCode=0x2487914 | out: lpExitCode=0x2487914*=0x103) returned 1 [0121.346] CheckRemoteDebuggerPresent (in: hProcess=0x5d38, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.346] GetCurrentProcessId () returned 0x1204 [0121.346] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4ac [0121.346] GetExitCodeProcess (in: hProcess=0x4ac, lpExitCode=0x24879cc | out: lpExitCode=0x24879cc*=0x103) returned 1 [0121.346] CheckRemoteDebuggerPresent (in: hProcess=0x4ac, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.346] GetCurrentProcessId () returned 0x1204 [0121.346] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x8980 [0121.346] GetExitCodeProcess (in: hProcess=0x8980, lpExitCode=0x2487a84 | out: lpExitCode=0x2487a84*=0x103) returned 1 [0121.346] CheckRemoteDebuggerPresent (in: hProcess=0x8980, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.346] GetCurrentProcessId () returned 0x1204 [0121.346] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4b0 [0121.346] GetExitCodeProcess (in: hProcess=0x4b0, lpExitCode=0x2487b3c | out: lpExitCode=0x2487b3c*=0x103) returned 1 [0121.346] CheckRemoteDebuggerPresent (in: hProcess=0x4b0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.346] GetCurrentProcessId () returned 0x1204 [0121.346] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d3c [0121.347] GetExitCodeProcess (in: hProcess=0x5d3c, lpExitCode=0x2487bf4 | out: lpExitCode=0x2487bf4*=0x103) returned 1 [0121.347] CheckRemoteDebuggerPresent (in: hProcess=0x5d3c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.347] GetCurrentProcessId () returned 0x1204 [0121.347] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4b4 [0121.347] GetExitCodeProcess (in: hProcess=0x4b4, lpExitCode=0x2487cac | out: lpExitCode=0x2487cac*=0x103) returned 1 [0121.347] CheckRemoteDebuggerPresent (in: hProcess=0x4b4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.347] GetCurrentProcessId () returned 0x1204 [0121.347] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0xaab4 [0121.347] GetExitCodeProcess (in: hProcess=0xaab4, lpExitCode=0x2487d64 | out: lpExitCode=0x2487d64*=0x103) returned 1 [0121.347] CheckRemoteDebuggerPresent (in: hProcess=0xaab4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.347] GetCurrentProcessId () returned 0x1204 [0121.347] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4b8 [0121.347] GetExitCodeProcess (in: hProcess=0x4b8, lpExitCode=0x2487e1c | out: lpExitCode=0x2487e1c*=0x103) returned 1 [0121.347] CheckRemoteDebuggerPresent (in: hProcess=0x4b8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.348] GetCurrentProcessId () returned 0x1204 [0121.348] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d40 [0121.348] GetExitCodeProcess (in: hProcess=0x5d40, lpExitCode=0x2487ed4 | out: lpExitCode=0x2487ed4*=0x103) returned 1 [0121.348] CheckRemoteDebuggerPresent (in: hProcess=0x5d40, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.348] GetCurrentProcessId () returned 0x1204 [0121.348] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4bc [0121.348] GetExitCodeProcess (in: hProcess=0x4bc, lpExitCode=0x2487f8c | out: lpExitCode=0x2487f8c*=0x103) returned 1 [0121.348] CheckRemoteDebuggerPresent (in: hProcess=0x4bc, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.348] GetCurrentProcessId () returned 0x1204 [0121.348] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x8984 [0121.348] GetExitCodeProcess (in: hProcess=0x8984, lpExitCode=0x2488044 | out: lpExitCode=0x2488044*=0x103) returned 1 [0121.349] CheckRemoteDebuggerPresent (in: hProcess=0x8984, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.349] GetCurrentProcessId () returned 0x1204 [0121.349] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4c0 [0121.349] GetExitCodeProcess (in: hProcess=0x4c0, lpExitCode=0x24880fc | out: lpExitCode=0x24880fc*=0x103) returned 1 [0121.349] CheckRemoteDebuggerPresent (in: hProcess=0x4c0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.349] GetCurrentProcessId () returned 0x1204 [0121.349] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d44 [0121.349] GetExitCodeProcess (in: hProcess=0x5d44, lpExitCode=0x24881b4 | out: lpExitCode=0x24881b4*=0x103) returned 1 [0121.349] CheckRemoteDebuggerPresent (in: hProcess=0x5d44, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.349] GetCurrentProcessId () returned 0x1204 [0121.349] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4c4 [0121.349] GetExitCodeProcess (in: hProcess=0x4c4, lpExitCode=0x248826c | out: lpExitCode=0x248826c*=0x103) returned 1 [0121.349] CheckRemoteDebuggerPresent (in: hProcess=0x4c4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.349] GetCurrentProcessId () returned 0x1204 [0121.349] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x9fa4 [0121.349] GetExitCodeProcess (in: hProcess=0x9fa4, lpExitCode=0x2488324 | out: lpExitCode=0x2488324*=0x103) returned 1 [0121.350] CheckRemoteDebuggerPresent (in: hProcess=0x9fa4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.350] GetCurrentProcessId () returned 0x1204 [0121.350] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4c8 [0121.350] GetExitCodeProcess (in: hProcess=0x4c8, lpExitCode=0x24883dc | out: lpExitCode=0x24883dc*=0x103) returned 1 [0121.350] CheckRemoteDebuggerPresent (in: hProcess=0x4c8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.350] GetCurrentProcessId () returned 0x1204 [0121.350] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d48 [0121.350] GetExitCodeProcess (in: hProcess=0x5d48, lpExitCode=0x2488494 | out: lpExitCode=0x2488494*=0x103) returned 1 [0121.350] CheckRemoteDebuggerPresent (in: hProcess=0x5d48, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.350] GetCurrentProcessId () returned 0x1204 [0121.350] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4cc [0121.351] GetExitCodeProcess (in: hProcess=0x4cc, lpExitCode=0x248854c | out: lpExitCode=0x248854c*=0x103) returned 1 [0121.351] CheckRemoteDebuggerPresent (in: hProcess=0x4cc, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.351] GetCurrentProcessId () returned 0x1204 [0121.351] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x8988 [0121.351] GetExitCodeProcess (in: hProcess=0x8988, lpExitCode=0x2488604 | out: lpExitCode=0x2488604*=0x103) returned 1 [0121.351] CheckRemoteDebuggerPresent (in: hProcess=0x8988, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.351] GetCurrentProcessId () returned 0x1204 [0121.351] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4d0 [0121.351] GetExitCodeProcess (in: hProcess=0x4d0, lpExitCode=0x24886bc | out: lpExitCode=0x24886bc*=0x103) returned 1 [0121.351] CheckRemoteDebuggerPresent (in: hProcess=0x4d0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.351] GetCurrentProcessId () returned 0x1204 [0121.352] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d4c [0121.352] GetExitCodeProcess (in: hProcess=0x5d4c, lpExitCode=0x2488774 | out: lpExitCode=0x2488774*=0x103) returned 1 [0121.352] CheckRemoteDebuggerPresent (in: hProcess=0x5d4c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.352] GetCurrentProcessId () returned 0x1204 [0121.352] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4d4 [0121.352] GetExitCodeProcess (in: hProcess=0x4d4, lpExitCode=0x248882c | out: lpExitCode=0x248882c*=0x103) returned 1 [0121.352] CheckRemoteDebuggerPresent (in: hProcess=0x4d4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.352] GetCurrentProcessId () returned 0x1204 [0121.352] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0xb040 [0121.352] GetExitCodeProcess (in: hProcess=0xb040, lpExitCode=0x24888e4 | out: lpExitCode=0x24888e4*=0x103) returned 1 [0121.353] CheckRemoteDebuggerPresent (in: hProcess=0xb040, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.353] GetCurrentProcessId () returned 0x1204 [0121.353] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4d8 [0121.353] GetExitCodeProcess (in: hProcess=0x4d8, lpExitCode=0x248899c | out: lpExitCode=0x248899c*=0x103) returned 1 [0121.353] CheckRemoteDebuggerPresent (in: hProcess=0x4d8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.353] GetCurrentProcessId () returned 0x1204 [0121.353] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d50 [0121.353] GetExitCodeProcess (in: hProcess=0x5d50, lpExitCode=0x2488a54 | out: lpExitCode=0x2488a54*=0x103) returned 1 [0121.353] CheckRemoteDebuggerPresent (in: hProcess=0x5d50, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.353] GetCurrentProcessId () returned 0x1204 [0121.353] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4dc [0121.353] GetExitCodeProcess (in: hProcess=0x4dc, lpExitCode=0x2488b0c | out: lpExitCode=0x2488b0c*=0x103) returned 1 [0121.353] CheckRemoteDebuggerPresent (in: hProcess=0x4dc, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.354] GetCurrentProcessId () returned 0x1204 [0121.354] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x898c [0121.354] GetExitCodeProcess (in: hProcess=0x898c, lpExitCode=0x2488bc4 | out: lpExitCode=0x2488bc4*=0x103) returned 1 [0121.354] CheckRemoteDebuggerPresent (in: hProcess=0x898c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.354] GetCurrentProcessId () returned 0x1204 [0121.354] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4e0 [0121.354] GetExitCodeProcess (in: hProcess=0x4e0, lpExitCode=0x2488c7c | out: lpExitCode=0x2488c7c*=0x103) returned 1 [0121.354] CheckRemoteDebuggerPresent (in: hProcess=0x4e0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.354] GetCurrentProcessId () returned 0x1204 [0121.354] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d54 [0121.354] GetExitCodeProcess (in: hProcess=0x5d54, lpExitCode=0x2488d34 | out: lpExitCode=0x2488d34*=0x103) returned 1 [0121.354] CheckRemoteDebuggerPresent (in: hProcess=0x5d54, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.354] GetCurrentProcessId () returned 0x1204 [0121.354] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4e4 [0121.354] GetExitCodeProcess (in: hProcess=0x4e4, lpExitCode=0x2488dec | out: lpExitCode=0x2488dec*=0x103) returned 1 [0121.354] CheckRemoteDebuggerPresent (in: hProcess=0x4e4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.354] GetCurrentProcessId () returned 0x1204 [0121.354] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x9fa8 [0121.355] GetExitCodeProcess (in: hProcess=0x9fa8, lpExitCode=0x2488ea4 | out: lpExitCode=0x2488ea4*=0x103) returned 1 [0121.355] CheckRemoteDebuggerPresent (in: hProcess=0x9fa8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.355] GetCurrentProcessId () returned 0x1204 [0121.355] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4e8 [0121.355] GetExitCodeProcess (in: hProcess=0x4e8, lpExitCode=0x2488f5c | out: lpExitCode=0x2488f5c*=0x103) returned 1 [0121.355] CheckRemoteDebuggerPresent (in: hProcess=0x4e8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.355] GetCurrentProcessId () returned 0x1204 [0121.355] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d58 [0121.355] GetExitCodeProcess (in: hProcess=0x5d58, lpExitCode=0x2489014 | out: lpExitCode=0x2489014*=0x103) returned 1 [0121.355] CheckRemoteDebuggerPresent (in: hProcess=0x5d58, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.355] GetCurrentProcessId () returned 0x1204 [0121.355] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4ec [0121.355] GetExitCodeProcess (in: hProcess=0x4ec, lpExitCode=0x24890cc | out: lpExitCode=0x24890cc*=0x103) returned 1 [0121.355] CheckRemoteDebuggerPresent (in: hProcess=0x4ec, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.355] GetCurrentProcessId () returned 0x1204 [0121.355] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x8990 [0121.355] GetExitCodeProcess (in: hProcess=0x8990, lpExitCode=0x2489184 | out: lpExitCode=0x2489184*=0x103) returned 1 [0121.356] CheckRemoteDebuggerPresent (in: hProcess=0x8990, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.356] GetCurrentProcessId () returned 0x1204 [0121.356] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4f0 [0121.356] GetExitCodeProcess (in: hProcess=0x4f0, lpExitCode=0x248923c | out: lpExitCode=0x248923c*=0x103) returned 1 [0121.356] CheckRemoteDebuggerPresent (in: hProcess=0x4f0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.356] GetCurrentProcessId () returned 0x1204 [0121.356] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d5c [0121.356] GetExitCodeProcess (in: hProcess=0x5d5c, lpExitCode=0x24892f4 | out: lpExitCode=0x24892f4*=0x103) returned 1 [0121.356] CheckRemoteDebuggerPresent (in: hProcess=0x5d5c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.356] GetCurrentProcessId () returned 0x1204 [0121.356] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4f4 [0121.356] GetExitCodeProcess (in: hProcess=0x4f4, lpExitCode=0x24893ac | out: lpExitCode=0x24893ac*=0x103) returned 1 [0121.356] CheckRemoteDebuggerPresent (in: hProcess=0x4f4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.356] GetCurrentProcessId () returned 0x1204 [0121.356] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0xaab8 [0121.356] GetExitCodeProcess (in: hProcess=0xaab8, lpExitCode=0x2489464 | out: lpExitCode=0x2489464*=0x103) returned 1 [0121.356] CheckRemoteDebuggerPresent (in: hProcess=0xaab8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.357] GetCurrentProcessId () returned 0x1204 [0121.357] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4f8 [0121.357] GetExitCodeProcess (in: hProcess=0x4f8, lpExitCode=0x248951c | out: lpExitCode=0x248951c*=0x103) returned 1 [0121.357] CheckRemoteDebuggerPresent (in: hProcess=0x4f8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.357] GetCurrentProcessId () returned 0x1204 [0121.357] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d60 [0121.357] GetExitCodeProcess (in: hProcess=0x5d60, lpExitCode=0x24895d4 | out: lpExitCode=0x24895d4*=0x103) returned 1 [0121.357] CheckRemoteDebuggerPresent (in: hProcess=0x5d60, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.357] GetCurrentProcessId () returned 0x1204 [0121.357] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x4fc [0121.357] GetExitCodeProcess (in: hProcess=0x4fc, lpExitCode=0x248968c | out: lpExitCode=0x248968c*=0x103) returned 1 [0121.357] CheckRemoteDebuggerPresent (in: hProcess=0x4fc, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.357] GetCurrentProcessId () returned 0x1204 [0121.357] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x8994 [0121.357] GetExitCodeProcess (in: hProcess=0x8994, lpExitCode=0x2489744 | out: lpExitCode=0x2489744*=0x103) returned 1 [0121.357] CheckRemoteDebuggerPresent (in: hProcess=0x8994, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.358] GetCurrentProcessId () returned 0x1204 [0121.358] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x500 [0121.358] GetExitCodeProcess (in: hProcess=0x500, lpExitCode=0x24897fc | out: lpExitCode=0x24897fc*=0x103) returned 1 [0121.358] CheckRemoteDebuggerPresent (in: hProcess=0x500, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.358] GetCurrentProcessId () returned 0x1204 [0121.358] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d64 [0121.358] GetExitCodeProcess (in: hProcess=0x5d64, lpExitCode=0x24898b4 | out: lpExitCode=0x24898b4*=0x103) returned 1 [0121.358] CheckRemoteDebuggerPresent (in: hProcess=0x5d64, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.358] GetCurrentProcessId () returned 0x1204 [0121.358] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x504 [0121.358] GetExitCodeProcess (in: hProcess=0x504, lpExitCode=0x248996c | out: lpExitCode=0x248996c*=0x103) returned 1 [0121.358] CheckRemoteDebuggerPresent (in: hProcess=0x504, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.358] GetCurrentProcessId () returned 0x1204 [0121.358] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x9fac [0121.358] GetExitCodeProcess (in: hProcess=0x9fac, lpExitCode=0x2489a24 | out: lpExitCode=0x2489a24*=0x103) returned 1 [0121.358] CheckRemoteDebuggerPresent (in: hProcess=0x9fac, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.358] GetCurrentProcessId () returned 0x1204 [0121.358] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x508 [0121.358] GetExitCodeProcess (in: hProcess=0x508, lpExitCode=0x2489adc | out: lpExitCode=0x2489adc*=0x103) returned 1 [0121.359] CheckRemoteDebuggerPresent (in: hProcess=0x508, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.359] GetCurrentProcessId () returned 0x1204 [0121.359] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d68 [0121.359] GetExitCodeProcess (in: hProcess=0x5d68, lpExitCode=0x2489b94 | out: lpExitCode=0x2489b94*=0x103) returned 1 [0121.359] CheckRemoteDebuggerPresent (in: hProcess=0x5d68, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.359] GetCurrentProcessId () returned 0x1204 [0121.359] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x50c [0121.359] GetExitCodeProcess (in: hProcess=0x50c, lpExitCode=0x2489c4c | out: lpExitCode=0x2489c4c*=0x103) returned 1 [0121.359] CheckRemoteDebuggerPresent (in: hProcess=0x50c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.359] GetCurrentProcessId () returned 0x1204 [0121.359] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x8998 [0121.359] GetExitCodeProcess (in: hProcess=0x8998, lpExitCode=0x2489d04 | out: lpExitCode=0x2489d04*=0x103) returned 1 [0121.359] CheckRemoteDebuggerPresent (in: hProcess=0x8998, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.359] GetCurrentProcessId () returned 0x1204 [0121.359] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x510 [0121.359] GetExitCodeProcess (in: hProcess=0x510, lpExitCode=0x2489dbc | out: lpExitCode=0x2489dbc*=0x103) returned 1 [0121.359] CheckRemoteDebuggerPresent (in: hProcess=0x510, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.360] GetCurrentProcessId () returned 0x1204 [0121.360] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d6c [0121.360] GetExitCodeProcess (in: hProcess=0x5d6c, lpExitCode=0x2489e74 | out: lpExitCode=0x2489e74*=0x103) returned 1 [0121.360] CheckRemoteDebuggerPresent (in: hProcess=0x5d6c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.360] GetCurrentProcessId () returned 0x1204 [0121.360] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x514 [0121.360] GetExitCodeProcess (in: hProcess=0x514, lpExitCode=0x2489f2c | out: lpExitCode=0x2489f2c*=0x103) returned 1 [0121.360] CheckRemoteDebuggerPresent (in: hProcess=0x514, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.360] GetCurrentProcessId () returned 0x1204 [0121.360] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0xb5b0 [0121.360] GetExitCodeProcess (in: hProcess=0xb5b0, lpExitCode=0x2489fe4 | out: lpExitCode=0x2489fe4*=0x103) returned 1 [0121.361] CheckRemoteDebuggerPresent (in: hProcess=0xb5b0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.361] GetCurrentProcessId () returned 0x1204 [0121.361] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x518 [0121.361] GetExitCodeProcess (in: hProcess=0x518, lpExitCode=0x248a09c | out: lpExitCode=0x248a09c*=0x103) returned 1 [0121.361] CheckRemoteDebuggerPresent (in: hProcess=0x518, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.361] GetCurrentProcessId () returned 0x1204 [0121.361] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d70 [0121.361] GetExitCodeProcess (in: hProcess=0x5d70, lpExitCode=0x248a154 | out: lpExitCode=0x248a154*=0x103) returned 1 [0121.361] CheckRemoteDebuggerPresent (in: hProcess=0x5d70, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.361] GetCurrentProcessId () returned 0x1204 [0121.361] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x51c [0121.361] GetExitCodeProcess (in: hProcess=0x51c, lpExitCode=0x248a20c | out: lpExitCode=0x248a20c*=0x103) returned 1 [0121.361] CheckRemoteDebuggerPresent (in: hProcess=0x51c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.361] GetCurrentProcessId () returned 0x1204 [0121.362] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x899c [0121.362] GetExitCodeProcess (in: hProcess=0x899c, lpExitCode=0x248a2c4 | out: lpExitCode=0x248a2c4*=0x103) returned 1 [0121.362] CheckRemoteDebuggerPresent (in: hProcess=0x899c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.362] GetCurrentProcessId () returned 0x1204 [0121.362] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x520 [0121.362] GetExitCodeProcess (in: hProcess=0x520, lpExitCode=0x248a37c | out: lpExitCode=0x248a37c*=0x103) returned 1 [0121.362] CheckRemoteDebuggerPresent (in: hProcess=0x520, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.362] GetCurrentProcessId () returned 0x1204 [0121.362] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d74 [0121.362] GetExitCodeProcess (in: hProcess=0x5d74, lpExitCode=0x248a434 | out: lpExitCode=0x248a434*=0x103) returned 1 [0121.362] CheckRemoteDebuggerPresent (in: hProcess=0x5d74, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.362] GetCurrentProcessId () returned 0x1204 [0121.362] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x524 [0121.363] GetExitCodeProcess (in: hProcess=0x524, lpExitCode=0x248a4ec | out: lpExitCode=0x248a4ec*=0x103) returned 1 [0121.363] CheckRemoteDebuggerPresent (in: hProcess=0x524, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.363] GetCurrentProcessId () returned 0x1204 [0121.363] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x9fb0 [0121.363] GetExitCodeProcess (in: hProcess=0x9fb0, lpExitCode=0x248a5a4 | out: lpExitCode=0x248a5a4*=0x103) returned 1 [0121.363] CheckRemoteDebuggerPresent (in: hProcess=0x9fb0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.363] GetCurrentProcessId () returned 0x1204 [0121.363] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x528 [0121.363] GetExitCodeProcess (in: hProcess=0x528, lpExitCode=0x248a65c | out: lpExitCode=0x248a65c*=0x103) returned 1 [0121.363] CheckRemoteDebuggerPresent (in: hProcess=0x528, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.363] GetCurrentProcessId () returned 0x1204 [0121.363] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d78 [0121.363] GetExitCodeProcess (in: hProcess=0x5d78, lpExitCode=0x248a714 | out: lpExitCode=0x248a714*=0x103) returned 1 [0121.363] CheckRemoteDebuggerPresent (in: hProcess=0x5d78, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.364] GetCurrentProcessId () returned 0x1204 [0121.364] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x52c [0121.364] GetExitCodeProcess (in: hProcess=0x52c, lpExitCode=0x248a7cc | out: lpExitCode=0x248a7cc*=0x103) returned 1 [0121.364] CheckRemoteDebuggerPresent (in: hProcess=0x52c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.364] GetCurrentProcessId () returned 0x1204 [0121.364] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x89a0 [0121.364] GetExitCodeProcess (in: hProcess=0x89a0, lpExitCode=0x248a884 | out: lpExitCode=0x248a884*=0x103) returned 1 [0121.364] CheckRemoteDebuggerPresent (in: hProcess=0x89a0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.364] GetCurrentProcessId () returned 0x1204 [0121.364] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x530 [0121.364] GetExitCodeProcess (in: hProcess=0x530, lpExitCode=0x248a93c | out: lpExitCode=0x248a93c*=0x103) returned 1 [0121.364] CheckRemoteDebuggerPresent (in: hProcess=0x530, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.364] GetCurrentProcessId () returned 0x1204 [0121.364] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d7c [0121.364] GetExitCodeProcess (in: hProcess=0x5d7c, lpExitCode=0x248a9f4 | out: lpExitCode=0x248a9f4*=0x103) returned 1 [0121.365] CheckRemoteDebuggerPresent (in: hProcess=0x5d7c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.365] GetCurrentProcessId () returned 0x1204 [0121.365] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x534 [0121.365] GetExitCodeProcess (in: hProcess=0x534, lpExitCode=0x248aaac | out: lpExitCode=0x248aaac*=0x103) returned 1 [0121.365] CheckRemoteDebuggerPresent (in: hProcess=0x534, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.365] GetCurrentProcessId () returned 0x1204 [0121.365] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0xaabc [0121.365] GetExitCodeProcess (in: hProcess=0xaabc, lpExitCode=0x248ab64 | out: lpExitCode=0x248ab64*=0x103) returned 1 [0121.365] CheckRemoteDebuggerPresent (in: hProcess=0xaabc, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.365] GetCurrentProcessId () returned 0x1204 [0121.365] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x538 [0121.365] GetExitCodeProcess (in: hProcess=0x538, lpExitCode=0x248ac1c | out: lpExitCode=0x248ac1c*=0x103) returned 1 [0121.365] CheckRemoteDebuggerPresent (in: hProcess=0x538, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.365] GetCurrentProcessId () returned 0x1204 [0121.365] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d80 [0121.365] GetExitCodeProcess (in: hProcess=0x5d80, lpExitCode=0x248acd4 | out: lpExitCode=0x248acd4*=0x103) returned 1 [0121.366] CheckRemoteDebuggerPresent (in: hProcess=0x5d80, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.366] GetCurrentProcessId () returned 0x1204 [0121.366] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x53c [0121.366] GetExitCodeProcess (in: hProcess=0x53c, lpExitCode=0x248ad8c | out: lpExitCode=0x248ad8c*=0x103) returned 1 [0121.366] CheckRemoteDebuggerPresent (in: hProcess=0x53c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.366] GetCurrentProcessId () returned 0x1204 [0121.366] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x89a4 [0121.366] GetExitCodeProcess (in: hProcess=0x89a4, lpExitCode=0x248ae44 | out: lpExitCode=0x248ae44*=0x103) returned 1 [0121.366] CheckRemoteDebuggerPresent (in: hProcess=0x89a4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.366] GetCurrentProcessId () returned 0x1204 [0121.366] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x540 [0121.366] GetExitCodeProcess (in: hProcess=0x540, lpExitCode=0x248aefc | out: lpExitCode=0x248aefc*=0x103) returned 1 [0121.366] CheckRemoteDebuggerPresent (in: hProcess=0x540, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.366] GetCurrentProcessId () returned 0x1204 [0121.367] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d84 [0121.367] GetExitCodeProcess (in: hProcess=0x5d84, lpExitCode=0x248afb4 | out: lpExitCode=0x248afb4*=0x103) returned 1 [0121.367] CheckRemoteDebuggerPresent (in: hProcess=0x5d84, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.367] GetCurrentProcessId () returned 0x1204 [0121.367] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x544 [0121.367] GetExitCodeProcess (in: hProcess=0x544, lpExitCode=0x248b06c | out: lpExitCode=0x248b06c*=0x103) returned 1 [0121.367] CheckRemoteDebuggerPresent (in: hProcess=0x544, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.367] GetCurrentProcessId () returned 0x1204 [0121.367] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x9fb4 [0121.367] GetExitCodeProcess (in: hProcess=0x9fb4, lpExitCode=0x248b124 | out: lpExitCode=0x248b124*=0x103) returned 1 [0121.367] CheckRemoteDebuggerPresent (in: hProcess=0x9fb4, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.367] GetCurrentProcessId () returned 0x1204 [0121.367] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x548 [0121.367] GetExitCodeProcess (in: hProcess=0x548, lpExitCode=0x248b1dc | out: lpExitCode=0x248b1dc*=0x103) returned 1 [0121.367] CheckRemoteDebuggerPresent (in: hProcess=0x548, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.368] GetCurrentProcessId () returned 0x1204 [0121.368] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d88 [0121.368] GetExitCodeProcess (in: hProcess=0x5d88, lpExitCode=0x248b294 | out: lpExitCode=0x248b294*=0x103) returned 1 [0121.368] CheckRemoteDebuggerPresent (in: hProcess=0x5d88, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.368] GetCurrentProcessId () returned 0x1204 [0121.368] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x54c [0121.368] GetExitCodeProcess (in: hProcess=0x54c, lpExitCode=0x248b34c | out: lpExitCode=0x248b34c*=0x103) returned 1 [0121.368] CheckRemoteDebuggerPresent (in: hProcess=0x54c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.368] GetCurrentProcessId () returned 0x1204 [0121.368] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x89a8 [0121.368] GetExitCodeProcess (in: hProcess=0x89a8, lpExitCode=0x248b404 | out: lpExitCode=0x248b404*=0x103) returned 1 [0121.368] CheckRemoteDebuggerPresent (in: hProcess=0x89a8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.368] GetCurrentProcessId () returned 0x1204 [0121.368] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x550 [0121.369] GetExitCodeProcess (in: hProcess=0x550, lpExitCode=0x248b4bc | out: lpExitCode=0x248b4bc*=0x103) returned 1 [0121.369] CheckRemoteDebuggerPresent (in: hProcess=0x550, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.369] GetCurrentProcessId () returned 0x1204 [0121.369] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d8c [0121.369] GetExitCodeProcess (in: hProcess=0x5d8c, lpExitCode=0x248b574 | out: lpExitCode=0x248b574*=0x103) returned 1 [0121.369] CheckRemoteDebuggerPresent (in: hProcess=0x5d8c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.369] GetCurrentProcessId () returned 0x1204 [0121.369] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x554 [0121.369] GetExitCodeProcess (in: hProcess=0x554, lpExitCode=0x248b62c | out: lpExitCode=0x248b62c*=0x103) returned 1 [0121.369] CheckRemoteDebuggerPresent (in: hProcess=0x554, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.369] GetCurrentProcessId () returned 0x1204 [0121.369] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0xb044 [0121.369] GetExitCodeProcess (in: hProcess=0xb044, lpExitCode=0x248b6e4 | out: lpExitCode=0x248b6e4*=0x103) returned 1 [0121.369] CheckRemoteDebuggerPresent (in: hProcess=0xb044, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.369] GetCurrentProcessId () returned 0x1204 [0121.370] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x558 [0121.370] GetExitCodeProcess (in: hProcess=0x558, lpExitCode=0x248b79c | out: lpExitCode=0x248b79c*=0x103) returned 1 [0121.370] CheckRemoteDebuggerPresent (in: hProcess=0x558, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.370] GetCurrentProcessId () returned 0x1204 [0121.370] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d90 [0121.370] GetExitCodeProcess (in: hProcess=0x5d90, lpExitCode=0x248b854 | out: lpExitCode=0x248b854*=0x103) returned 1 [0121.370] CheckRemoteDebuggerPresent (in: hProcess=0x5d90, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.370] GetCurrentProcessId () returned 0x1204 [0121.370] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x55c [0121.370] GetExitCodeProcess (in: hProcess=0x55c, lpExitCode=0x248b90c | out: lpExitCode=0x248b90c*=0x103) returned 1 [0121.370] CheckRemoteDebuggerPresent (in: hProcess=0x55c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.370] GetCurrentProcessId () returned 0x1204 [0121.370] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x89ac [0121.370] GetExitCodeProcess (in: hProcess=0x89ac, lpExitCode=0x248b9c4 | out: lpExitCode=0x248b9c4*=0x103) returned 1 [0121.370] CheckRemoteDebuggerPresent (in: hProcess=0x89ac, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.370] GetCurrentProcessId () returned 0x1204 [0121.370] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x560 [0121.371] GetExitCodeProcess (in: hProcess=0x560, lpExitCode=0x248ba7c | out: lpExitCode=0x248ba7c*=0x103) returned 1 [0121.371] CheckRemoteDebuggerPresent (in: hProcess=0x560, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.371] GetCurrentProcessId () returned 0x1204 [0121.371] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d94 [0121.371] GetExitCodeProcess (in: hProcess=0x5d94, lpExitCode=0x248bb34 | out: lpExitCode=0x248bb34*=0x103) returned 1 [0121.371] CheckRemoteDebuggerPresent (in: hProcess=0x5d94, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.371] GetCurrentProcessId () returned 0x1204 [0121.371] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x564 [0121.371] GetExitCodeProcess (in: hProcess=0x564, lpExitCode=0x248bbec | out: lpExitCode=0x248bbec*=0x103) returned 1 [0121.378] CheckRemoteDebuggerPresent (in: hProcess=0x564, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.378] GetCurrentProcessId () returned 0x1204 [0121.378] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x9fb8 [0121.378] GetExitCodeProcess (in: hProcess=0x9fb8, lpExitCode=0x248bca4 | out: lpExitCode=0x248bca4*=0x103) returned 1 [0121.378] CheckRemoteDebuggerPresent (in: hProcess=0x9fb8, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.378] GetCurrentProcessId () returned 0x1204 [0121.378] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x568 [0121.378] GetExitCodeProcess (in: hProcess=0x568, lpExitCode=0x248bd5c | out: lpExitCode=0x248bd5c*=0x103) returned 1 [0121.378] CheckRemoteDebuggerPresent (in: hProcess=0x568, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.379] GetCurrentProcessId () returned 0x1204 [0121.379] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d98 [0121.379] GetExitCodeProcess (in: hProcess=0x5d98, lpExitCode=0x248be14 | out: lpExitCode=0x248be14*=0x103) returned 1 [0121.379] CheckRemoteDebuggerPresent (in: hProcess=0x5d98, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.379] GetCurrentProcessId () returned 0x1204 [0121.379] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x56c [0121.379] GetExitCodeProcess (in: hProcess=0x56c, lpExitCode=0x248becc | out: lpExitCode=0x248becc*=0x103) returned 1 [0121.379] CheckRemoteDebuggerPresent (in: hProcess=0x56c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.379] GetCurrentProcessId () returned 0x1204 [0121.379] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x89b0 [0121.379] GetExitCodeProcess (in: hProcess=0x89b0, lpExitCode=0x248bf84 | out: lpExitCode=0x248bf84*=0x103) returned 1 [0121.379] CheckRemoteDebuggerPresent (in: hProcess=0x89b0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.379] GetCurrentProcessId () returned 0x1204 [0121.379] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x570 [0121.379] GetExitCodeProcess (in: hProcess=0x570, lpExitCode=0x248c03c | out: lpExitCode=0x248c03c*=0x103) returned 1 [0121.380] CheckRemoteDebuggerPresent (in: hProcess=0x570, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.380] GetCurrentProcessId () returned 0x1204 [0121.380] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5d9c [0121.380] GetExitCodeProcess (in: hProcess=0x5d9c, lpExitCode=0x248c0f4 | out: lpExitCode=0x248c0f4*=0x103) returned 1 [0121.380] CheckRemoteDebuggerPresent (in: hProcess=0x5d9c, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.380] GetCurrentProcessId () returned 0x1204 [0121.380] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x574 [0121.380] GetExitCodeProcess (in: hProcess=0x574, lpExitCode=0x248c1ac | out: lpExitCode=0x248c1ac*=0x103) returned 1 [0121.380] CheckRemoteDebuggerPresent (in: hProcess=0x574, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.380] GetCurrentProcessId () returned 0x1204 [0121.380] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0xaac0 [0121.380] GetExitCodeProcess (in: hProcess=0xaac0, lpExitCode=0x248c264 | out: lpExitCode=0x248c264*=0x103) returned 1 [0121.380] CheckRemoteDebuggerPresent (in: hProcess=0xaac0, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.380] GetCurrentProcessId () returned 0x1204 [0121.380] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x578 [0121.380] GetExitCodeProcess (in: hProcess=0x578, lpExitCode=0x248c31c | out: lpExitCode=0x248c31c*=0x103) returned 1 [0121.380] CheckRemoteDebuggerPresent (in: hProcess=0x578, pbDebuggerPresent=0x19ea88 | out: pbDebuggerPresent=0x19ea88) returned 1 [0121.381] GetCurrentProcessId () returned 0x1204 [0121.381] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1204) returned 0x5da0 [0124.596] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x19ef04, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0124.936] IsAppThemed () returned 0x1 [0124.940] CoTaskMemAlloc (cb=0xf0) returned 0x75fda8 [0124.940] CreateActCtxA (pActCtx=0x19f400) returned 0x76740c [0125.076] CoTaskMemFree (pv=0x75fda8) [0125.098] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc208 [0125.098] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc150 [0125.145] GetSystemMetrics (nIndex=75) returned 1 [0125.152] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0126.148] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x69170000 [0126.201] AdjustWindowRectEx (in: lpRect=0x19f3f8, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x19f3f8) returned 1 [0126.203] GetCurrentProcess () returned 0xffffffff [0126.204] GetCurrentThread () returned 0xfffffffe [0126.204] GetCurrentProcess () returned 0xffffffff [0126.204] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x19f310, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x19f310*=0x5f4) returned 1 [0126.207] GetCurrentThreadId () returned 0xb98 [0126.256] GetCurrentActCtx (in: lphActCtx=0x19f270 | out: lphActCtx=0x19f270*=0x0) returned 1 [0126.257] ActivateActCtx (in: hActCtx=0x76740c, lpCookie=0x19f280 | out: hActCtx=0x76740c, lpCookie=0x19f280) returned 1 [0126.257] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0127.442] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x6f140000 [0127.547] GetModuleHandleW (lpModuleName="user32.dll") returned 0x75640000 [0127.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x19f138, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcW@i§?º© «Ækhö\x19", lpUsedDefaultChar=0x0) returned 14 [0127.547] GetProcAddress (hModule=0x75640000, lpProcName="DefWindowProcW") returned 0x744e07e0 [0127.548] GetStockObject (i=5) returned 0x1900015 [0127.573] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0127.657] CoTaskMemAlloc (cb=0x5c) returned 0x740fa0 [0127.657] RegisterClassW (lpWndClass=0x19f128) returned 0xc1db [0127.658] CoTaskMemFree (pv=0x740fa0) [0127.658] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0127.659] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r41_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x503b8 [0127.661] SetWindowLongW (hWnd=0x503b8, nIndex=-4, dwNewLong=1951270880) returned 115541438 [0127.662] GetWindowLongW (hWnd=0x503b8, nIndex=-4) returned 1951270880 [0127.675] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e984 | out: phkResult=0x19e984*=0x5ca8) returned 0x0 [0127.676] RegQueryValueExW (in: hKey=0x5ca8, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x19e9a4, lpData=0x0, lpcbData=0x19e9a0*=0x0 | out: lpType=0x19e9a4*=0x0, lpData=0x0, lpcbData=0x19e9a0*=0x0) returned 0x2 [0127.676] RegQueryValueExW (in: hKey=0x5ca8, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x19e9a4, lpData=0x0, lpcbData=0x19e9a0*=0x0 | out: lpType=0x19e9a4*=0x0, lpData=0x0, lpcbData=0x19e9a0*=0x0) returned 0x2 [0127.676] RegCloseKey (hKey=0x5ca8) returned 0x0 [0127.678] SetWindowLongW (hWnd=0x503b8, nIndex=-4, dwNewLong=115541478) returned 1951270880 [0127.678] GetWindowLongW (hWnd=0x503b8, nIndex=-4) returned 115541478 [0127.678] GetWindowLongW (hWnd=0x503b8, nIndex=-16) returned 113311744 [0127.680] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc20d [0127.681] CallWindowProcW (lpPrevWndFunc=0x744e07e0, hWnd=0x503b8, Msg=0x24, wParam=0x0, lParam=0x19ec9c) returned 0x0 [0127.681] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc20c [0127.681] CallWindowProcW (lpPrevWndFunc=0x744e07e0, hWnd=0x503b8, Msg=0x81, wParam=0x0, lParam=0x19ec90) returned 0x1 [0127.683] CallWindowProcW (lpPrevWndFunc=0x744e07e0, hWnd=0x503b8, Msg=0x83, wParam=0x0, lParam=0x19ec7c) returned 0x0 [0127.684] CallWindowProcW (lpPrevWndFunc=0x744e07e0, hWnd=0x503b8, Msg=0x1, wParam=0x0, lParam=0x19ec90) returned 0x0 [0127.685] GetClientRect (in: hWnd=0x503b8, lpRect=0x19e9bc | out: lpRect=0x19e9bc) returned 1 [0127.685] GetWindowRect (in: hWnd=0x503b8, lpRect=0x19e9bc | out: lpRect=0x19e9bc) returned 1 [0127.687] GetParent (hWnd=0x503b8) returned 0x0 [0127.687] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1a840001) returned 1 [0128.103] GetSystemDefaultLCID () returned 0x409 [0128.104] GetStockObject (i=17) returned 0x10a0047 [0128.108] GetObjectW (in: h=0x10a0047, c=92, pv=0x19f01c | out: pv=0x19f01c) returned 92 [0128.109] GetDC (hWnd=0x0) returned 0x10107f0 [0128.869] GdiplusStartup (in: token=0x517390, input=0x19e5e0, output=0x19e630 | out: token=0x517390, output=0x19e630) returned 0x0 [0128.880] CoTaskMemAlloc (cb=0x5c) returned 0x740fa0 [0128.891] GdipCreateFontFromLogfontW (hdc=0x10107f0, logfont=0x740fa0, font=0x19f0e4) returned 0x0 [0131.964] CoTaskMemFree (pv=0x740fa0) [0131.966] CoTaskMemAlloc (cb=0x5c) returned 0x740d98 [0131.966] CoTaskMemFree (pv=0x740d98) [0131.966] CoTaskMemAlloc (cb=0x5c) returned 0x740cc8 [0131.967] CoTaskMemFree (pv=0x740cc8) [0131.967] GdipGetFontUnit (font=0x6c81f08, unit=0x19f0b0) returned 0x0 [0131.967] GdipGetFontSize (font=0x6c81f08, size=0x19f0b4) returned 0x0 [0131.967] GdipGetFontStyle (font=0x6c81f08, style=0x19f0ac) returned 0x0 [0131.968] GdipGetFamily (font=0x6c81f08, family=0x19f0a8) returned 0x0 [0131.969] GdipGetFontSize (font=0x6c81f08, size=0x24ac3b4) returned 0x0 [0131.969] ReleaseDC (hWnd=0x0, hDC=0x10107f0) returned 1 [0131.969] GetDC (hWnd=0x0) returned 0xb01078b [0131.970] GdipCreateFromHDC (hdc=0xb01078b, graphics=0x19f0d0) returned 0x0 [0132.271] GdipGetDpiY (graphics=0x7f4f268, dpi=0x24ac4bc) returned 0x0 [0132.271] GdipGetFontHeight (font=0x6c81f08, graphics=0x7f4f268, height=0x19f0c8) returned 0x0 [0132.271] GdipGetEmHeight (family=0x7f45cb8, style=0, EmHeight=0x19f0d0) returned 0x0 [0132.272] GdipGetLineSpacing (family=0x7f45cb8, style=0, LineSpacing=0x19f0d0) returned 0x0 [0132.272] GdipDeleteGraphics (graphics=0x7f4f268) returned 0x0 [0132.315] ReleaseDC (hWnd=0x0, hDC=0xb01078b) returned 1 [0132.316] GdipCreateFont (fontFamily=0x7f45cb8, emSize=0x41040000, style=0, unit=0x3, font=0x24ac47c) returned 0x0 [0132.316] GdipGetFontSize (font=0x6c8efc0, size=0x24ac480) returned 0x0 [0132.316] GdipDeleteFont (font=0x6c81f08) returned 0x0 [0132.317] GetDC (hWnd=0x0) returned 0xb01078b [0132.317] GdipCreateFromHDC (hdc=0xb01078b, graphics=0x19f134) returned 0x0 [0132.317] GdipGetFontHeight (font=0x6c8efc0, graphics=0x7f4f268, height=0x19f12c) returned 0x0 [0132.317] GdipDeleteGraphics (graphics=0x7f4f268) returned 0x0 [0132.317] ReleaseDC (hWnd=0x0, hDC=0xb01078b) returned 1 [0132.323] GetSystemMetrics (nIndex=5) returned 1 [0132.323] GetSystemMetrics (nIndex=6) returned 1 [0132.324] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.325] AdjustWindowRectEx (in: lpRect=0x19f25c, dwStyle=0x560101c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19f25c) returned 1 [0132.325] GetDC (hWnd=0x0) returned 0xb01078b [0132.325] GdipCreateFromHDC (hdc=0xb01078b, graphics=0x19f134) returned 0x0 [0132.326] GdipGetFontHeight (font=0x6c8efc0, graphics=0x7f4f268, height=0x19f12c) returned 0x0 [0132.326] GdipDeleteGraphics (graphics=0x7f4f268) returned 0x0 [0132.326] ReleaseDC (hWnd=0x0, hDC=0xb01078b) returned 1 [0132.326] GetSystemMetrics (nIndex=5) returned 1 [0132.326] GetSystemMetrics (nIndex=6) returned 1 [0132.326] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.326] AdjustWindowRectEx (in: lpRect=0x19f25c, dwStyle=0x560101c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19f25c) returned 1 [0132.346] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.348] AdjustWindowRectEx (in: lpRect=0x19f260, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f260) returned 1 [0132.348] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.348] AdjustWindowRectEx (in: lpRect=0x19f260, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f260) returned 1 [0132.363] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.364] AdjustWindowRectEx (in: lpRect=0x19f25c, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f25c) returned 1 [0132.364] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.364] AdjustWindowRectEx (in: lpRect=0x19f260, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f260) returned 1 [0132.364] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.364] AdjustWindowRectEx (in: lpRect=0x19f260, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f260) returned 1 [0132.416] GetSystemMetrics (nIndex=5) returned 1 [0132.416] GetSystemMetrics (nIndex=6) returned 1 [0132.418] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.418] AdjustWindowRectEx (in: lpRect=0x19f1b8, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19f1b8) returned 1 [0132.502] GetSystemMetrics (nIndex=5) returned 1 [0132.502] GetSystemMetrics (nIndex=6) returned 1 [0132.503] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.503] AdjustWindowRectEx (in: lpRect=0x19f1b8, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19f1b8) returned 1 [0132.508] GetSystemMetrics (nIndex=5) returned 1 [0132.508] GetSystemMetrics (nIndex=6) returned 1 [0132.508] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.509] AdjustWindowRectEx (in: lpRect=0x19f1b8, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19f1b8) returned 1 [0132.509] GetSystemMetrics (nIndex=5) returned 1 [0132.509] GetSystemMetrics (nIndex=6) returned 1 [0132.509] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.509] AdjustWindowRectEx (in: lpRect=0x19f1b8, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19f1b8) returned 1 [0132.518] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.518] AdjustWindowRectEx (in: lpRect=0x19f1b8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f1b8) returned 1 [0132.532] GetProcessWindowStation () returned 0xcc [0132.533] GetUserObjectInformationA (in: hObj=0xcc, nIndex=1, pvInfo=0x24ad798, nLength=0xc, lpnLengthNeeded=0x19f094 | out: pvInfo=0x24ad798, lpnLengthNeeded=0x19f094) returned 1 [0132.537] SetConsoleCtrlHandler (HandlerRoutine=0x6e3060e, Add=1) returned 1 [0132.538] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0132.539] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0132.543] GetClassInfoW (in: hInstance=0x400000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWndClass=0x24ad7fc | out: lpWndClass=0x24ad7fc) returned 0 [0132.545] CoTaskMemAlloc (cb=0x58) returned 0x6e6d60 [0132.545] RegisterClassW (lpWndClass=0x19efe4) returned 0xc206 [0132.546] CoTaskMemFree (pv=0x6e6d60) [0132.547] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x502ac [0132.548] NtdllDefWindowProc_W (hWnd=0x502ac, Msg=0x81, wParam=0x0, lParam=0x19eb20) returned 0x1 [0132.553] NtdllDefWindowProc_W (hWnd=0x502ac, Msg=0x83, wParam=0x0, lParam=0x19eb0c) returned 0x0 [0132.553] NtdllDefWindowProc_W (hWnd=0x502ac, Msg=0x1, wParam=0x0, lParam=0x19eb20) returned 0x0 [0132.553] NtdllDefWindowProc_W (hWnd=0x502ac, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0132.553] NtdllDefWindowProc_W (hWnd=0x502ac, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0132.561] GetSysColor (nIndex=10) returned 0xb4b4b4 [0132.561] GetSysColor (nIndex=2) returned 0xd1b499 [0132.561] GetSysColor (nIndex=9) returned 0x0 [0132.561] GetSysColor (nIndex=12) returned 0xababab [0132.561] GetSysColor (nIndex=15) returned 0xf0f0f0 [0132.561] GetSysColor (nIndex=20) returned 0xffffff [0132.561] GetSysColor (nIndex=16) returned 0xa0a0a0 [0132.561] GetSysColor (nIndex=15) returned 0xf0f0f0 [0132.561] GetSysColor (nIndex=16) returned 0xa0a0a0 [0132.561] GetSysColor (nIndex=21) returned 0x696969 [0132.561] GetSysColor (nIndex=22) returned 0xe3e3e3 [0132.561] GetSysColor (nIndex=20) returned 0xffffff [0132.561] GetSysColor (nIndex=18) returned 0x0 [0132.561] GetSysColor (nIndex=1) returned 0x0 [0132.561] GetSysColor (nIndex=27) returned 0xead1b9 [0132.562] GetSysColor (nIndex=28) returned 0xf2e4d7 [0132.562] GetSysColor (nIndex=17) returned 0x6d6d6d [0132.562] GetSysColor (nIndex=13) returned 0xff9933 [0132.562] GetSysColor (nIndex=14) returned 0xffffff [0132.562] GetSysColor (nIndex=26) returned 0xcc6600 [0132.562] GetSysColor (nIndex=11) returned 0xfcf7f4 [0132.562] GetSysColor (nIndex=3) returned 0xdbcdbf [0132.562] GetSysColor (nIndex=19) returned 0x0 [0132.562] GetSysColor (nIndex=24) returned 0xe1ffff [0132.562] GetSysColor (nIndex=23) returned 0x0 [0132.562] GetSysColor (nIndex=4) returned 0xf0f0f0 [0132.562] GetSysColor (nIndex=30) returned 0xf0f0f0 [0132.562] GetSysColor (nIndex=29) returned 0xff9933 [0132.562] GetSysColor (nIndex=7) returned 0x0 [0132.562] GetSysColor (nIndex=0) returned 0xc8c8c8 [0132.562] GetSysColor (nIndex=5) returned 0xffffff [0132.563] GetSysColor (nIndex=6) returned 0x646464 [0132.563] GetSysColor (nIndex=8) returned 0x0 [0132.601] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.601] AdjustWindowRectEx (in: lpRect=0x19f1b8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f1b8) returned 1 [0132.624] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.624] AdjustWindowRectEx (in: lpRect=0x19f1b8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f1b8) returned 1 [0132.625] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.625] AdjustWindowRectEx (in: lpRect=0x19f1b8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f1b8) returned 1 [0132.625] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.625] AdjustWindowRectEx (in: lpRect=0x19f1e4, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f1e4) returned 1 [0132.669] GdipCreateFontFamilyFromName (name="Microsoft Sans Serif", fontCollection=0x0, fontFamily=0x19f228) returned 0x0 [0132.669] GdipCreateFont (fontFamily=0x7f45cb8, emSize=0x41400000, style=0, unit=0x3, font=0x24adee8) returned 0x0 [0132.669] GdipGetFontSize (font=0x6c81f08, size=0x24adeec) returned 0x0 [0132.693] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.693] AdjustWindowRectEx (in: lpRect=0x19f1b8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f1b8) returned 1 [0132.716] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.716] AdjustWindowRectEx (in: lpRect=0x19f1b8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f1b8) returned 1 [0132.716] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.716] AdjustWindowRectEx (in: lpRect=0x19f1b8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f1b8) returned 1 [0132.717] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.717] AdjustWindowRectEx (in: lpRect=0x19f1b8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f1b8) returned 1 [0132.732] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.733] AdjustWindowRectEx (in: lpRect=0x19f218, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19f218) returned 1 [0132.733] GetSystemMetrics (nIndex=59) returned 1456 [0132.733] GetSystemMetrics (nIndex=60) returned 916 [0132.733] GetSystemMetrics (nIndex=34) returned 136 [0132.733] GetSystemMetrics (nIndex=35) returned 39 [0132.733] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.733] AdjustWindowRectEx (in: lpRect=0x19f118, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19f118) returned 1 [0132.740] GetCurrentThreadId () returned 0xb98 [0132.740] GetCurrentThreadId () returned 0xb98 [0132.742] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.742] AdjustWindowRectEx (in: lpRect=0x19f018, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f018) returned 1 [0132.752] GdipGetFamilyName (in: family=0x7f45cb8, name=0x19ef08, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0132.753] CreateCompatibleDC (hdc=0x0) returned 0x2a0109cd [0132.754] GetCurrentObject (hdc=0x2a0109cd, type=0x1) returned 0x1b00017 [0132.754] GetCurrentObject (hdc=0x2a0109cd, type=0x2) returned 0x1900010 [0132.754] GetCurrentObject (hdc=0x2a0109cd, type=0x7) returned 0x185000f [0132.754] GetCurrentObject (hdc=0x2a0109cd, type=0x6) returned 0x18a0048 [0132.758] SaveDC (hdc=0x2a0109cd) returned 1 [0132.759] GetDeviceCaps (hdc=0x2a0109cd, index=90) returned 96 [0132.759] CoTaskMemAlloc (cb=0x5c) returned 0x740ac0 [0132.759] CreateFontIndirectW (lplf=0x740ac0) returned 0x710a0792 [0132.759] CoTaskMemFree (pv=0x740ac0) [0132.760] GetObjectW (in: h=0x710a0792, c=92, pv=0x19eee0 | out: pv=0x19eee0) returned 92 [0132.760] GetCurrentObject (hdc=0x2a0109cd, type=0x6) returned 0x18a0048 [0132.760] GetObjectW (in: h=0x18a0048, c=92, pv=0x19ee38 | out: pv=0x19ee38) returned 92 [0132.761] SelectObject (hdc=0x2a0109cd, h=0x710a0792) returned 0x18a0048 [0132.761] GetMapMode (hdc=0x2a0109cd) returned 1 [0132.761] GetTextMetricsW (in: hdc=0x2a0109cd, lptm=0x19eeec | out: lptm=0x19eeec) returned 1 [0132.763] DrawTextExW (in: hdc=0x2a0109cd, lpchText="Author: Ali Umar ", cchText=17, lprc=0x19f000, format=0x2400, lpdtp=0x24ae808 | out: lpchText="Author: Ali Umar ", lprc=0x19f000) returned 13 [0132.825] GetCurrentThreadId () returned 0xb98 [0132.825] GetCurrentThreadId () returned 0xb98 [0132.826] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.826] AdjustWindowRectEx (in: lpRect=0x19f018, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f018) returned 1 [0132.826] GdipGetFamilyName (in: family=0x7f45cb8, name=0x19ef08, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0132.826] GetDeviceCaps (hdc=0x2a0109cd, index=90) returned 96 [0132.826] CoTaskMemAlloc (cb=0x5c) returned 0x740fa0 [0132.826] CreateFontIndirectW (lplf=0x740fa0) returned 0xa80a06be [0132.826] CoTaskMemFree (pv=0x740fa0) [0132.827] GetObjectW (in: h=0xa80a06be, c=92, pv=0x19eee0 | out: pv=0x19eee0) returned 92 [0132.830] SelectObject (hdc=0x2a0109cd, h=0xa80a06be) returned 0x710a0792 [0132.830] GetMapMode (hdc=0x2a0109cd) returned 1 [0132.830] GetTextMetricsW (in: hdc=0x2a0109cd, lptm=0x19eeec | out: lptm=0x19eeec) returned 1 [0132.831] DrawTextExW (in: hdc=0x2a0109cd, lpchText="Welcome, to the simple client/server application.", cchText=49, lprc=0x19f000, format=0x2400, lpdtp=0x24aeaa4 | out: lpchText="Welcome, to the simple client/server application.", lprc=0x19f000) returned 20 [0132.842] GetCurrentThreadId () returned 0xb98 [0132.842] GetCurrentThreadId () returned 0xb98 [0132.842] GetCurrentThreadId () returned 0xb98 [0132.842] GetCurrentThreadId () returned 0xb98 [0132.842] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.842] AdjustWindowRectEx (in: lpRect=0x19f018, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f018) returned 1 [0132.842] SelectObject (hdc=0x2a0109cd, h=0x710a0792) returned 0xa80a06be [0132.842] DrawTextExW (in: hdc=0x2a0109cd, lpchText="IP Address/Host", cchText=15, lprc=0x19f000, format=0x2400, lpdtp=0x24aebe8 | out: lpchText="IP Address/Host", lprc=0x19f000) returned 13 [0132.843] GetCurrentThreadId () returned 0xb98 [0132.843] GetCurrentThreadId () returned 0xb98 [0132.843] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.843] AdjustWindowRectEx (in: lpRect=0x19f018, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f018) returned 1 [0132.843] DrawTextExW (in: hdc=0x2a0109cd, lpchText="Account No", cchText=10, lprc=0x19f000, format=0x2400, lpdtp=0x24aecf8 | out: lpchText="Account No", lprc=0x19f000) returned 13 [0132.843] GetCurrentThreadId () returned 0xb98 [0132.843] GetCurrentThreadId () returned 0xb98 [0132.844] GetCurrentThreadId () returned 0xb98 [0132.844] GetCurrentThreadId () returned 0xb98 [0132.857] CreateCompatibleDC (hdc=0x0) returned 0x5f010551 [0132.873] GetDC (hWnd=0x0) returned 0xb01078b [0132.873] GdipCreateFromHDC (hdc=0xb01078b, graphics=0x19f058) returned 0x0 [0132.874] CoTaskMemAlloc (cb=0x5c) returned 0x740d98 [0132.874] GdipGetLogFontW (font=0x6c8efc0, graphics=0x7f4f268, logfontW=0x740d98) returned 0x0 [0132.878] CoTaskMemFree (pv=0x740d98) [0132.878] CoTaskMemAlloc (cb=0x5c) returned 0x740ac0 [0132.878] CoTaskMemFree (pv=0x740ac0) [0132.879] CoTaskMemAlloc (cb=0x5c) returned 0x740fa0 [0132.879] CoTaskMemFree (pv=0x740fa0) [0132.879] GdipDeleteGraphics (graphics=0x7f4f268) returned 0x0 [0132.879] ReleaseDC (hWnd=0x0, hDC=0xb01078b) returned 1 [0132.880] CoTaskMemAlloc (cb=0x5c) returned 0x7410d8 [0132.880] CreateFontIndirectW (lplf=0x7410d8) returned 0x3e0a06b6 [0132.880] CoTaskMemFree (pv=0x7410d8) [0132.880] SelectObject (hdc=0x5f010551, h=0x3e0a06b6) returned 0x18a0048 [0132.880] GetTextMetricsW (in: hdc=0x5f010551, lptm=0x19f164 | out: lptm=0x19f164) returned 1 [0132.881] GetTextExtentPoint32W (in: hdc=0x5f010551, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x24af504 | out: psizl=0x24af504) returned 1 [0132.881] SelectObject (hdc=0x5f010551, h=0x18a0048) returned 0x3e0a06b6 [0132.882] DeleteDC (hdc=0x5f010551) returned 1 [0132.883] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.884] AdjustWindowRectEx (in: lpRect=0x19eed0, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19eed0) returned 1 [0132.885] GetCursorPos (in: lpPoint=0x24af524 | out: lpPoint=0x24af524*(x=798, y=375)) returned 1 [0132.887] GetSystemMetrics (nIndex=80) returned 1 [0132.890] MonitorFromPoint (pt=0x31e, dwFlags=0x177) returned 0x10001 [0132.891] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19edac | out: lpmi=0x19edac) returned 1 [0132.892] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x61010551 [0132.892] GetDeviceCaps (hdc=0x61010551, index=12) returned 32 [0132.892] GetDeviceCaps (hdc=0x61010551, index=14) returned 1 [0132.892] DeleteDC (hdc=0x61010551) returned 1 [0132.893] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19ee00 | out: lpmi=0x19ee00) returned 1 [0132.893] AdjustWindowRectEx (in: lpRect=0x19f0f0, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19f0f0) returned 1 [0132.894] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.894] AdjustWindowRectEx (in: lpRect=0x19ee48, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19ee48) returned 1 [0132.894] GetCursorPos (in: lpPoint=0x24af858 | out: lpPoint=0x24af858*(x=798, y=375)) returned 1 [0132.894] MonitorFromPoint (pt=0x31f, dwFlags=0x179) returned 0x10001 [0132.894] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19ed24 | out: lpmi=0x19ed24) returned 1 [0132.894] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x62010551 [0132.894] GetDeviceCaps (hdc=0x62010551, index=12) returned 32 [0132.895] GetDeviceCaps (hdc=0x62010551, index=14) returned 1 [0132.895] DeleteDC (hdc=0x62010551) returned 1 [0132.895] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19ed78 | out: lpmi=0x19ed78) returned 1 [0132.895] AdjustWindowRectEx (in: lpRect=0x19ef28, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19ef28) returned 1 [0132.895] GetSystemMetrics (nIndex=34) returned 136 [0132.895] GetSystemMetrics (nIndex=35) returned 39 [0132.895] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.895] AdjustWindowRectEx (in: lpRect=0x19f0e8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f0e8) returned 1 [0132.896] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.896] AdjustWindowRectEx (in: lpRect=0x19ef4c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ef4c) returned 1 [0132.896] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.896] AdjustWindowRectEx (in: lpRect=0x19eda8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eda8) returned 1 [0132.897] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.897] AdjustWindowRectEx (in: lpRect=0x19f0e8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f0e8) returned 1 [0132.897] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.897] AdjustWindowRectEx (in: lpRect=0x19ef4c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ef4c) returned 1 [0132.897] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.897] AdjustWindowRectEx (in: lpRect=0x19eda8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eda8) returned 1 [0132.897] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.897] AdjustWindowRectEx (in: lpRect=0x19f0e8, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f0e8) returned 1 [0132.898] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.898] AdjustWindowRectEx (in: lpRect=0x19ef4c, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ef4c) returned 1 [0132.898] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.898] AdjustWindowRectEx (in: lpRect=0x19f0e8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f0e8) returned 1 [0132.898] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.898] AdjustWindowRectEx (in: lpRect=0x19ef4c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ef4c) returned 1 [0132.899] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.899] AdjustWindowRectEx (in: lpRect=0x19eda8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eda8) returned 1 [0132.899] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.899] AdjustWindowRectEx (in: lpRect=0x19f0e8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f0e8) returned 1 [0132.899] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.899] AdjustWindowRectEx (in: lpRect=0x19ef4c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ef4c) returned 1 [0132.900] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.900] AdjustWindowRectEx (in: lpRect=0x19eda8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eda8) returned 1 [0132.900] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.900] AdjustWindowRectEx (in: lpRect=0x19f0e8, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19f0e8) returned 1 [0132.900] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.900] AdjustWindowRectEx (in: lpRect=0x19ef4c, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19ef4c) returned 1 [0132.900] GetSystemMetrics (nIndex=5) returned 1 [0132.900] GetSystemMetrics (nIndex=6) returned 1 [0132.901] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.901] AdjustWindowRectEx (in: lpRect=0x19f0e8, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19f0e8) returned 1 [0132.901] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69170000 [0132.901] AdjustWindowRectEx (in: lpRect=0x19ef4c, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19ef4c) returned 1 [0132.901] GetSystemMetrics (nIndex=5) returned 1 [0132.901] GetSystemMetrics (nIndex=6) returned 1 [0132.992] EtwEventRegister (in: ProviderId=0x24b0000, EnableCallback=0x6e3065e, CallbackContext=0x0, RegHandle=0x24affdc | out: RegHandle=0x24affdc) returned 0x0 [0132.997] EtwEventSetInformation (RegHandle=0x70c328, InformationClass=0x59, EventInformation=0x2, InformationLength=0x24aff70) returned 0x0 [0133.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef60) returned 1 [0133.009] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe.config" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19efdc | out: lpFileInformation=0x19efdc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0133.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef5c) returned 1 [0133.697] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11400, lpName=0x0) returned 0x390 [0133.698] memcpy (in: _Dst=0x6c40000, _Src=0x24b283c, _Size=0x11400 | out: _Dst=0x6c40000) returned 0x6c40000 [0133.699] CloseHandle (hObject=0x390) returned 1 [0183.051] GdipLoadImageFromStream (stream=0x4d0030, image=0x19e4c0) returned 0x0 [0183.566] GdipImageForceValidation (image=0x7f4f268) returned 0x0 [0183.589] GdipGetImageType (image=0x7f4f268, type=0x19e4bc) returned 0x0 [0183.590] GdipGetImageRawFormat (image=0x7f4f268, format=0x19e43c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0183.669] GdipGetImageWidth (image=0x7f4f268, width=0x19ea20) returned 0x0 [0183.670] GdipGetImageHeight (image=0x7f4f268, height=0x19ea20) returned 0x0 [0183.954] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0183.954] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0183.955] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=0, color=0x19ea10) returned 0x0 [0184.054] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.054] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.054] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=1, color=0x19ea10) returned 0x0 [0184.054] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.054] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.054] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=2, color=0x19ea10) returned 0x0 [0184.054] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.054] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.054] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=3, color=0x19ea10) returned 0x0 [0184.054] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.054] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.054] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=4, color=0x19ea10) returned 0x0 [0184.054] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.054] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.055] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=5, color=0x19ea10) returned 0x0 [0184.055] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.055] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.055] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=6, color=0x19ea10) returned 0x0 [0184.055] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.055] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.055] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=7, color=0x19ea10) returned 0x0 [0184.055] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.055] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.055] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=8, color=0x19ea10) returned 0x0 [0184.055] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.055] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.055] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=9, color=0x19ea10) returned 0x0 [0184.055] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.055] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.056] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=10, color=0x19ea10) returned 0x0 [0184.056] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.056] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.056] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=11, color=0x19ea10) returned 0x0 [0184.056] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.056] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.056] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=12, color=0x19ea10) returned 0x0 [0184.056] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.056] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.056] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=13, color=0x19ea10) returned 0x0 [0184.056] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.056] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.056] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=14, color=0x19ea10) returned 0x0 [0184.056] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.056] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.056] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=15, color=0x19ea10) returned 0x0 [0184.056] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.057] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.057] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=16, color=0x19ea10) returned 0x0 [0184.057] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.057] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.057] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=17, color=0x19ea10) returned 0x0 [0184.057] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.057] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.057] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=18, color=0x19ea10) returned 0x0 [0184.057] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.057] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.057] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=19, color=0x19ea10) returned 0x0 [0184.057] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.057] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.057] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=20, color=0x19ea10) returned 0x0 [0184.057] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.057] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.057] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=21, color=0x19ea10) returned 0x0 [0184.057] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.058] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.058] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=22, color=0x19ea10) returned 0x0 [0184.058] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.058] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.058] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=23, color=0x19ea10) returned 0x0 [0184.058] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.058] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.058] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=24, color=0x19ea10) returned 0x0 [0184.058] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.058] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.058] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=25, color=0x19ea10) returned 0x0 [0184.058] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.058] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.058] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=26, color=0x19ea10) returned 0x0 [0184.058] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.058] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.058] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=27, color=0x19ea10) returned 0x0 [0184.059] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.059] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.059] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=28, color=0x19ea10) returned 0x0 [0184.059] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.059] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.059] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=29, color=0x19ea10) returned 0x0 [0184.059] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.059] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.059] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=30, color=0x19ea10) returned 0x0 [0184.059] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.059] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.059] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=31, color=0x19ea10) returned 0x0 [0184.059] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.059] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.059] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=32, color=0x19ea10) returned 0x0 [0184.059] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.059] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.060] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=33, color=0x19ea10) returned 0x0 [0184.060] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.060] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.060] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=34, color=0x19ea10) returned 0x0 [0184.060] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.060] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.060] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=35, color=0x19ea10) returned 0x0 [0184.060] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.060] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.060] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=36, color=0x19ea10) returned 0x0 [0184.060] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.060] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.060] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=37, color=0x19ea10) returned 0x0 [0184.060] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.060] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.060] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=38, color=0x19ea10) returned 0x0 [0184.060] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.061] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.061] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=39, color=0x19ea10) returned 0x0 [0184.061] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.061] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.061] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=40, color=0x19ea10) returned 0x0 [0184.061] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.061] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.061] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=41, color=0x19ea10) returned 0x0 [0184.061] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.061] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.061] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=42, color=0x19ea10) returned 0x0 [0184.061] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.061] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.061] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=43, color=0x19ea10) returned 0x0 [0184.062] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.062] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.062] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=44, color=0x19ea10) returned 0x0 [0184.062] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.062] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.062] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=45, color=0x19ea10) returned 0x0 [0184.062] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.062] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.062] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=46, color=0x19ea10) returned 0x0 [0184.062] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.062] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.062] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=47, color=0x19ea10) returned 0x0 [0184.062] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.062] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.062] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=48, color=0x19ea10) returned 0x0 [0184.062] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.062] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.062] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=49, color=0x19ea10) returned 0x0 [0184.063] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.063] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.063] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=50, color=0x19ea10) returned 0x0 [0184.063] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.063] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.063] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=51, color=0x19ea10) returned 0x0 [0184.063] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.063] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.063] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=52, color=0x19ea10) returned 0x0 [0184.063] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.063] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.063] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=53, color=0x19ea10) returned 0x0 [0184.063] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.063] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.064] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=54, color=0x19ea10) returned 0x0 [0184.064] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.064] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.064] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=55, color=0x19ea10) returned 0x0 [0184.064] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.064] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.064] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=56, color=0x19ea10) returned 0x0 [0184.064] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.064] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.064] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=57, color=0x19ea10) returned 0x0 [0184.064] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.064] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.064] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=58, color=0x19ea10) returned 0x0 [0184.064] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.065] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.065] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=59, color=0x19ea10) returned 0x0 [0184.065] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.065] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.065] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=60, color=0x19ea10) returned 0x0 [0184.065] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.065] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.065] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=61, color=0x19ea10) returned 0x0 [0184.065] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.065] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.065] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=62, color=0x19ea10) returned 0x0 [0184.066] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.066] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.066] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=63, color=0x19ea10) returned 0x0 [0184.066] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.066] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.066] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=64, color=0x19ea10) returned 0x0 [0184.066] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.066] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.066] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=65, color=0x19ea10) returned 0x0 [0184.066] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.066] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.066] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=66, color=0x19ea10) returned 0x0 [0184.066] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.066] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.066] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=67, color=0x19ea10) returned 0x0 [0184.066] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.067] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.067] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=68, color=0x19ea10) returned 0x0 [0184.067] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.067] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.067] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=69, color=0x19ea10) returned 0x0 [0184.067] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.067] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.067] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=70, color=0x19ea10) returned 0x0 [0184.067] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.067] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.067] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=71, color=0x19ea10) returned 0x0 [0184.067] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.067] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.067] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=72, color=0x19ea10) returned 0x0 [0184.067] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.067] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.067] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=73, color=0x19ea10) returned 0x0 [0184.068] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.068] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.068] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=74, color=0x19ea10) returned 0x0 [0184.068] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.068] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.068] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=75, color=0x19ea10) returned 0x0 [0184.068] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.068] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.068] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=76, color=0x19ea10) returned 0x0 [0184.068] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.068] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.068] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=77, color=0x19ea10) returned 0x0 [0184.068] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.068] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.068] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=78, color=0x19ea10) returned 0x0 [0184.068] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.068] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.069] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=79, color=0x19ea10) returned 0x0 [0184.069] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.069] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.069] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=80, color=0x19ea10) returned 0x0 [0184.069] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.069] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.069] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=81, color=0x19ea10) returned 0x0 [0184.069] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.069] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.069] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=82, color=0x19ea10) returned 0x0 [0184.069] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.069] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.069] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=83, color=0x19ea10) returned 0x0 [0184.069] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.069] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.069] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=84, color=0x19ea10) returned 0x0 [0184.069] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.070] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.070] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=85, color=0x19ea10) returned 0x0 [0184.070] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.070] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.070] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=86, color=0x19ea10) returned 0x0 [0184.070] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.070] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.070] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=87, color=0x19ea10) returned 0x0 [0184.070] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.070] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.070] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=88, color=0x19ea10) returned 0x0 [0184.070] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.070] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.070] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=89, color=0x19ea10) returned 0x0 [0184.070] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.070] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.070] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=90, color=0x19ea10) returned 0x0 [0184.070] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.070] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.071] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=91, color=0x19ea10) returned 0x0 [0184.071] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.071] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.071] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=92, color=0x19ea10) returned 0x0 [0184.071] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.071] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.071] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=93, color=0x19ea10) returned 0x0 [0184.071] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.071] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.071] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=94, color=0x19ea10) returned 0x0 [0184.072] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.072] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.072] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=95, color=0x19ea10) returned 0x0 [0184.072] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.072] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.072] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=96, color=0x19ea10) returned 0x0 [0184.073] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.073] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.073] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=97, color=0x19ea10) returned 0x0 [0184.073] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.073] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.073] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=98, color=0x19ea10) returned 0x0 [0184.073] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.073] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.073] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=99, color=0x19ea10) returned 0x0 [0184.073] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.073] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.073] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=100, color=0x19ea10) returned 0x0 [0184.073] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.073] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.073] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=101, color=0x19ea10) returned 0x0 [0184.073] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.073] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.073] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=102, color=0x19ea10) returned 0x0 [0184.074] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.074] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.074] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=103, color=0x19ea10) returned 0x0 [0184.074] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.074] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.074] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=104, color=0x19ea10) returned 0x0 [0184.074] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.074] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.074] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=105, color=0x19ea10) returned 0x0 [0184.074] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.074] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.074] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=106, color=0x19ea10) returned 0x0 [0184.074] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.074] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.074] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=107, color=0x19ea10) returned 0x0 [0184.074] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.074] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.075] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=108, color=0x19ea10) returned 0x0 [0184.075] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.075] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.075] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=109, color=0x19ea10) returned 0x0 [0184.075] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.075] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.075] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=110, color=0x19ea10) returned 0x0 [0184.075] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.075] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.075] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=111, color=0x19ea10) returned 0x0 [0184.075] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.075] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.075] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=112, color=0x19ea10) returned 0x0 [0184.075] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.075] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.075] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=113, color=0x19ea10) returned 0x0 [0184.075] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.075] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.076] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=114, color=0x19ea10) returned 0x0 [0184.076] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.076] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.076] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=115, color=0x19ea10) returned 0x0 [0184.076] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.076] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.076] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=116, color=0x19ea10) returned 0x0 [0184.076] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.076] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.076] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=117, color=0x19ea10) returned 0x0 [0184.076] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.076] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.076] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=118, color=0x19ea10) returned 0x0 [0184.077] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.077] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.077] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=119, color=0x19ea10) returned 0x0 [0184.077] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.077] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.077] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=120, color=0x19ea10) returned 0x0 [0184.077] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.077] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.077] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=121, color=0x19ea10) returned 0x0 [0184.077] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.077] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.077] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=122, color=0x19ea10) returned 0x0 [0184.077] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.077] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.077] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=123, color=0x19ea10) returned 0x0 [0184.077] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.078] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.078] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=124, color=0x19ea10) returned 0x0 [0184.078] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.078] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.078] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=125, color=0x19ea10) returned 0x0 [0184.078] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.078] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.078] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=126, color=0x19ea10) returned 0x0 [0184.078] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.078] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.078] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=127, color=0x19ea10) returned 0x0 [0184.078] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.078] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.078] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=128, color=0x19ea10) returned 0x0 [0184.078] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.079] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.079] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=129, color=0x19ea10) returned 0x0 [0184.079] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.079] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.079] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=130, color=0x19ea10) returned 0x0 [0184.079] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.079] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.079] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=131, color=0x19ea10) returned 0x0 [0184.079] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.079] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.079] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=132, color=0x19ea10) returned 0x0 [0184.079] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.079] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.079] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=133, color=0x19ea10) returned 0x0 [0184.080] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.080] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.080] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=134, color=0x19ea10) returned 0x0 [0184.080] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.080] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.080] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=135, color=0x19ea10) returned 0x0 [0184.080] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.080] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.080] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=136, color=0x19ea10) returned 0x0 [0184.080] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.080] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.080] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=137, color=0x19ea10) returned 0x0 [0184.080] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.080] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.081] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=138, color=0x19ea10) returned 0x0 [0184.081] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.081] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.081] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=139, color=0x19ea10) returned 0x0 [0184.081] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.081] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.081] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=140, color=0x19ea10) returned 0x0 [0184.081] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.081] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.081] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=141, color=0x19ea10) returned 0x0 [0184.081] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.081] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.081] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=142, color=0x19ea10) returned 0x0 [0184.082] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.082] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.082] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=143, color=0x19ea10) returned 0x0 [0184.082] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.082] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.082] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=144, color=0x19ea10) returned 0x0 [0184.082] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.082] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.082] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=145, color=0x19ea10) returned 0x0 [0184.082] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.082] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.082] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=146, color=0x19ea10) returned 0x0 [0184.082] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.082] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.082] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=147, color=0x19ea10) returned 0x0 [0184.083] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.083] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.083] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=148, color=0x19ea10) returned 0x0 [0184.083] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.083] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.083] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=149, color=0x19ea10) returned 0x0 [0184.083] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.083] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.083] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=150, color=0x19ea10) returned 0x0 [0184.083] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.083] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.083] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=151, color=0x19ea10) returned 0x0 [0184.083] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.083] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.084] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=152, color=0x19ea10) returned 0x0 [0184.084] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.084] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.084] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=153, color=0x19ea10) returned 0x0 [0184.084] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.084] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.084] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=154, color=0x19ea10) returned 0x0 [0184.084] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.084] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.084] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=155, color=0x19ea10) returned 0x0 [0184.084] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.085] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.085] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=156, color=0x19ea10) returned 0x0 [0184.085] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.085] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.085] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=157, color=0x19ea10) returned 0x0 [0184.085] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.085] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.085] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=158, color=0x19ea10) returned 0x0 [0184.085] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.085] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.085] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=159, color=0x19ea10) returned 0x0 [0184.085] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.085] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.086] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=160, color=0x19ea10) returned 0x0 [0184.086] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.086] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.086] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=161, color=0x19ea10) returned 0x0 [0184.086] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.086] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.086] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=162, color=0x19ea10) returned 0x0 [0184.086] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.086] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.086] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=163, color=0x19ea10) returned 0x0 [0184.086] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.087] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.087] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=164, color=0x19ea10) returned 0x0 [0184.087] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.087] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.087] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=165, color=0x19ea10) returned 0x0 [0184.087] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.087] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.087] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=166, color=0x19ea10) returned 0x0 [0184.087] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.087] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.087] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=167, color=0x19ea10) returned 0x0 [0184.087] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.087] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.087] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=168, color=0x19ea10) returned 0x0 [0184.088] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.088] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.088] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=169, color=0x19ea10) returned 0x0 [0184.088] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.088] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.088] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=170, color=0x19ea10) returned 0x0 [0184.088] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.088] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.088] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=171, color=0x19ea10) returned 0x0 [0184.088] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.088] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.088] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=172, color=0x19ea10) returned 0x0 [0184.088] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.088] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.088] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=173, color=0x19ea10) returned 0x0 [0184.089] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.089] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.089] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=174, color=0x19ea10) returned 0x0 [0184.089] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.089] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.089] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=175, color=0x19ea10) returned 0x0 [0184.089] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.089] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.089] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=176, color=0x19ea10) returned 0x0 [0184.089] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.089] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.089] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=177, color=0x19ea10) returned 0x0 [0184.089] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.089] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.089] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=178, color=0x19ea10) returned 0x0 [0184.090] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.090] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.090] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=179, color=0x19ea10) returned 0x0 [0184.090] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.090] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.090] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=180, color=0x19ea10) returned 0x0 [0184.090] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.090] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.090] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=181, color=0x19ea10) returned 0x0 [0184.090] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.090] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.090] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=182, color=0x19ea10) returned 0x0 [0184.090] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.090] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.091] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=183, color=0x19ea10) returned 0x0 [0184.091] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.091] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.091] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=184, color=0x19ea10) returned 0x0 [0184.091] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.091] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.091] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=185, color=0x19ea10) returned 0x0 [0184.091] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.091] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.091] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=186, color=0x19ea10) returned 0x0 [0184.091] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.091] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.091] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=187, color=0x19ea10) returned 0x0 [0184.091] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.091] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.091] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=188, color=0x19ea10) returned 0x0 [0184.092] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.092] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.092] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=189, color=0x19ea10) returned 0x0 [0184.092] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.092] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.092] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=190, color=0x19ea10) returned 0x0 [0184.092] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.092] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.092] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=191, color=0x19ea10) returned 0x0 [0184.092] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.092] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.092] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=192, color=0x19ea10) returned 0x0 [0184.092] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.092] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.092] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=193, color=0x19ea10) returned 0x0 [0184.093] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.093] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.093] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=194, color=0x19ea10) returned 0x0 [0184.093] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.093] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.093] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=195, color=0x19ea10) returned 0x0 [0184.093] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.093] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.093] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=196, color=0x19ea10) returned 0x0 [0184.093] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.093] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.093] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=197, color=0x19ea10) returned 0x0 [0184.093] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.093] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.094] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=198, color=0x19ea10) returned 0x0 [0184.094] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.094] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.094] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=199, color=0x19ea10) returned 0x0 [0184.094] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.094] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.094] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=200, color=0x19ea10) returned 0x0 [0184.094] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.094] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.094] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=201, color=0x19ea10) returned 0x0 [0184.094] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.094] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.094] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=202, color=0x19ea10) returned 0x0 [0184.094] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.094] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.094] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=203, color=0x19ea10) returned 0x0 [0184.095] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.095] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.095] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=204, color=0x19ea10) returned 0x0 [0184.095] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.095] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.095] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=205, color=0x19ea10) returned 0x0 [0184.095] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.095] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.095] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=206, color=0x19ea10) returned 0x0 [0184.095] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.095] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.095] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=207, color=0x19ea10) returned 0x0 [0184.095] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.095] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.095] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=208, color=0x19ea10) returned 0x0 [0184.095] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.095] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.096] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=209, color=0x19ea10) returned 0x0 [0184.096] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.096] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.096] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=210, color=0x19ea10) returned 0x0 [0184.096] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.096] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.096] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=211, color=0x19ea10) returned 0x0 [0184.096] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.096] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.096] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=212, color=0x19ea10) returned 0x0 [0184.096] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.096] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.096] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=213, color=0x19ea10) returned 0x0 [0184.096] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.096] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.096] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=214, color=0x19ea10) returned 0x0 [0184.096] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.097] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.097] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=215, color=0x19ea10) returned 0x0 [0184.097] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.097] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.097] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=216, color=0x19ea10) returned 0x0 [0184.097] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.097] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.097] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=217, color=0x19ea10) returned 0x0 [0184.097] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.097] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.097] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=218, color=0x19ea10) returned 0x0 [0184.097] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.097] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.097] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=219, color=0x19ea10) returned 0x0 [0184.097] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.097] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.097] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=220, color=0x19ea10) returned 0x0 [0184.098] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.098] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.098] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=221, color=0x19ea10) returned 0x0 [0184.098] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.098] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.099] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=222, color=0x19ea10) returned 0x0 [0184.099] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.099] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.099] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=223, color=0x19ea10) returned 0x0 [0184.100] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.100] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.100] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=224, color=0x19ea10) returned 0x0 [0184.100] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.100] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.100] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=225, color=0x19ea10) returned 0x0 [0184.100] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.100] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.100] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=226, color=0x19ea10) returned 0x0 [0184.100] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.100] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.100] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=227, color=0x19ea10) returned 0x0 [0184.101] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.101] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.101] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=228, color=0x19ea10) returned 0x0 [0184.101] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.101] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.101] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=229, color=0x19ea10) returned 0x0 [0184.101] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.101] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.101] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=230, color=0x19ea10) returned 0x0 [0184.101] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.102] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.102] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=231, color=0x19ea10) returned 0x0 [0184.102] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.102] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.102] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=232, color=0x19ea10) returned 0x0 [0184.102] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.102] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.102] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=233, color=0x19ea10) returned 0x0 [0184.102] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.102] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.102] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=234, color=0x19ea10) returned 0x0 [0184.102] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.102] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.102] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=235, color=0x19ea10) returned 0x0 [0184.102] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.103] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.103] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=236, color=0x19ea10) returned 0x0 [0184.103] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.103] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.103] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=237, color=0x19ea10) returned 0x0 [0184.103] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.103] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.103] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=238, color=0x19ea10) returned 0x0 [0184.103] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.103] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.103] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=239, color=0x19ea10) returned 0x0 [0184.103] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.103] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.103] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=240, color=0x19ea10) returned 0x0 [0184.103] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.120] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.120] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=241, color=0x19ea10) returned 0x0 [0184.120] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.120] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.121] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=242, color=0x19ea10) returned 0x0 [0184.121] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.121] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.121] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=243, color=0x19ea10) returned 0x0 [0184.121] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.121] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.121] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=244, color=0x19ea10) returned 0x0 [0184.121] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.121] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.121] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=245, color=0x19ea10) returned 0x0 [0184.121] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.121] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.121] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=246, color=0x19ea10) returned 0x0 [0184.121] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.122] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.122] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=247, color=0x19ea10) returned 0x0 [0184.122] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.122] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.122] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=248, color=0x19ea10) returned 0x0 [0184.122] GdipGetImageWidth (image=0x7f4f268, width=0x19ea00) returned 0x0 [0184.122] GdipGetImageHeight (image=0x7f4f268, height=0x19ea00) returned 0x0 [0184.122] GdipBitmapGetPixel (bitmap=0x7f4f268, x=0, y=249, color=0x19ea10) returned 0x0 [0184.441] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x77000, lpName=0x0) returned 0x394 [0184.441] memcpy (in: _Dst=0x2020000, _Src=0x3cc8840, _Size=0x77000 | out: _Dst=0x2020000) returned 0x2020000 [0184.448] CloseHandle (hObject=0x394) returned 1 [0185.872] CoTaskMemAlloc (cb=0xd) returned 0x744620 [0185.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x22fd1b8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0185.872] LoadLibraryA (lpLibFileName="kernel32") returned 0x74580000 [0185.873] CoTaskMemFree (pv=0x744620) [0185.888] CoTaskMemAlloc (cb=0x11) returned 0x7617f0 [0185.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResumeThread", cchWideChar=12, lpMultiByteStr=0x22fd4f4, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResumeThread", lpUsedDefaultChar=0x0) returned 12 [0185.888] GetProcAddress (hModule=0x74580000, lpProcName="ResumeThread") returned 0x7459a800 [0185.888] CoTaskMemFree (pv=0x7617f0) [0185.924] CoTaskMemAlloc (cb=0xd) returned 0x744620 [0185.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x22fdc78, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0185.925] LoadLibraryA (lpLibFileName="kernel32") returned 0x74580000 [0185.925] CoTaskMemFree (pv=0x744620) [0185.925] CoTaskMemAlloc (cb=0x1a) returned 0x731548 [0185.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Wow64SetThreadContext", cchWideChar=21, lpMultiByteStr=0x22fdcb0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wow64SetThreadContext", lpUsedDefaultChar=0x0) returned 21 [0185.925] GetProcAddress (hModule=0x74580000, lpProcName="Wow64SetThreadContext") returned 0x745c3e60 [0185.926] CoTaskMemFree (pv=0x731548) [0185.937] CoTaskMemAlloc (cb=0xd) returned 0x744620 [0185.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x22fdd7c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0185.937] LoadLibraryA (lpLibFileName="kernel32") returned 0x74580000 [0185.938] CoTaskMemFree (pv=0x744620) [0185.938] CoTaskMemAlloc (cb=0x15) returned 0x761a10 [0185.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetThreadContext", cchWideChar=16, lpMultiByteStr=0x22fddb4, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetThreadContext", lpUsedDefaultChar=0x0) returned 16 [0185.938] GetProcAddress (hModule=0x74580000, lpProcName="SetThreadContext") returned 0x745c2490 [0185.938] CoTaskMemFree (pv=0x761a10) [0185.941] CoTaskMemAlloc (cb=0xd) returned 0x7446c8 [0185.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x22fde7c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0185.941] LoadLibraryA (lpLibFileName="kernel32") returned 0x74580000 [0185.942] CoTaskMemFree (pv=0x7446c8) [0185.942] CoTaskMemAlloc (cb=0x1a) returned 0x731408 [0185.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Wow64GetThreadContext", cchWideChar=21, lpMultiByteStr=0x22fdeb4, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wow64GetThreadContext", lpUsedDefaultChar=0x0) returned 21 [0185.942] GetProcAddress (hModule=0x74580000, lpProcName="Wow64GetThreadContext") returned 0x745c3e30 [0185.942] CoTaskMemFree (pv=0x731408) [0185.945] CoTaskMemAlloc (cb=0xd) returned 0x744620 [0185.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x22fdf80, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0185.945] LoadLibraryA (lpLibFileName="kernel32") returned 0x74580000 [0185.945] CoTaskMemFree (pv=0x744620) [0185.945] CoTaskMemAlloc (cb=0x15) returned 0x7617b0 [0185.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetThreadContext", cchWideChar=16, lpMultiByteStr=0x22fdfb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThreadContext", lpUsedDefaultChar=0x0) returned 16 [0185.946] GetProcAddress (hModule=0x74580000, lpProcName="GetThreadContext") returned 0x7459ec60 [0185.946] CoTaskMemFree (pv=0x7617b0) [0185.948] CoTaskMemAlloc (cb=0xd) returned 0x744620 [0185.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x22fe074, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0185.948] LoadLibraryA (lpLibFileName="kernel32") returned 0x74580000 [0185.950] CoTaskMemFree (pv=0x744620) [0185.950] CoTaskMemAlloc (cb=0x13) returned 0x7618d0 [0185.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualAllocEx", cchWideChar=14, lpMultiByteStr=0x22fe0ac, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VirtualAllocEx", lpUsedDefaultChar=0x0) returned 14 [0185.950] GetProcAddress (hModule=0x74580000, lpProcName="VirtualAllocEx") returned 0x745c2730 [0185.951] CoTaskMemFree (pv=0x7618d0) [0185.979] CoTaskMemAlloc (cb=0xd) returned 0x744620 [0185.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x22fe168, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0185.979] LoadLibraryA (lpLibFileName="kernel32") returned 0x74580000 [0185.980] CoTaskMemFree (pv=0x744620) [0185.980] CoTaskMemAlloc (cb=0x17) returned 0x7616d0 [0185.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WriteProcessMemory", cchWideChar=18, lpMultiByteStr=0x22fe1a0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WriteProcessMemory", lpUsedDefaultChar=0x0) returned 18 [0185.980] GetProcAddress (hModule=0x74580000, lpProcName="WriteProcessMemory") returned 0x745c2850 [0185.980] CoTaskMemFree (pv=0x7616d0) [0185.986] CoTaskMemAlloc (cb=0xd) returned 0x744620 [0185.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x22fe264, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0185.986] LoadLibraryA (lpLibFileName="kernel32") returned 0x74580000 [0185.986] CoTaskMemFree (pv=0x744620) [0185.986] CoTaskMemAlloc (cb=0x16) returned 0x761870 [0185.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ReadProcessMemory", cchWideChar=17, lpMultiByteStr=0x22fe29c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadProcessMemory", lpUsedDefaultChar=0x0) returned 17 [0185.987] GetProcAddress (hModule=0x74580000, lpProcName="ReadProcessMemory") returned 0x745c1c80 [0185.987] CoTaskMemFree (pv=0x761870) [0185.992] CoTaskMemAlloc (cb=0xa) returned 0x744620 [0185.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntdll", cchWideChar=5, lpMultiByteStr=0x22fe35c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ntdll", lpUsedDefaultChar=0x0) returned 5 [0185.992] LoadLibraryA (lpLibFileName="ntdll") returned 0x77830000 [0185.992] CoTaskMemFree (pv=0x744620) [0185.992] CoTaskMemAlloc (cb=0x19) returned 0x731728 [0185.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ZwUnmapViewOfSection", cchWideChar=20, lpMultiByteStr=0x22fe388, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ZwUnmapViewOfSection", lpUsedDefaultChar=0x0) returned 20 [0185.993] GetProcAddress (hModule=0x77830000, lpProcName="ZwUnmapViewOfSection") returned 0x778a6f40 [0185.993] CoTaskMemFree (pv=0x731728) [0185.996] CoTaskMemAlloc (cb=0xd) returned 0x744788 [0185.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x22fe450, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0185.996] LoadLibraryA (lpLibFileName="kernel32") returned 0x74580000 [0185.996] CoTaskMemFree (pv=0x744788) [0185.996] CoTaskMemAlloc (cb=0x13) returned 0x7617d0 [0185.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateProcessA", cchWideChar=14, lpMultiByteStr=0x22fe488, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateProcessA", lpUsedDefaultChar=0x0) returned 14 [0185.996] GetProcAddress (hModule=0x74580000, lpProcName="CreateProcessA") returned 0x745c0750 [0185.997] CoTaskMemFree (pv=0x7617d0) [0186.123] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe", nBufferLength=0x105, lpBuffer=0x19e070, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe", lpFilePart=0x0) returned 0x62 [0186.778] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x36400, lpName=0x0) returned 0x394 [0186.779] memcpy (in: _Dst=0x9f10000, _Src=0x3e1d7f0, _Size=0x36400 | out: _Dst=0x9f10000) returned 0x9f10000 [0186.782] CloseHandle (hObject=0x394) returned 1 [0186.884] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe", nBufferLength=0x105, lpBuffer=0x19dfb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe", lpFilePart=0x0) returned 0x62 [0187.000] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x19da40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0187.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe", cchWideChar=98, lpMultiByteStr=0x19e234, cbMultiByte=100, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe\x0c\x02§?º© «Æk\x0cê\x19", lpUsedDefaultChar=0x0) returned 98 [0187.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=0, lpMultiByteStr=0x19e230, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",\x10\x0c\x02C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe", lpUsedDefaultChar=0x0) returned 0 [0187.101] CreateProcessA (in: lpApplicationName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe", lpCommandLine="", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000004, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19e2f4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19e598 | out: lpCommandLine="", lpProcessInformation=0x19e598*(hProcess=0x5de4, hThread=0x394, dwProcessId=0x8f4, dwThreadId=0x91c)) returned 1 [0187.158] CoTaskMemFree (pv=0x0) [0187.168] GetThreadContext (in: hThread=0x394, lpContext=0x2358a50 | out: lpContext=0x2358a50*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x2cb000, Edx=0x0, Ecx=0x0, Eax=0x49e00a, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0187.168] ReadProcessMemory (in: hProcess=0x5de4, lpBaseAddress=0x2cb008, lpBuffer=0x19e588, nSize=0x4, lpNumberOfBytesRead=0x19e5cc | out: lpBuffer=0x19e588*, lpNumberOfBytesRead=0x19e5cc*=0x4) returned 1 [0187.169] NtUnmapViewOfSection (ProcessHandle=0x5de4, BaseAddress=0x400000) returned 0x0 [0187.175] VirtualAllocEx (hProcess=0x5de4, lpAddress=0x400000, dwSize=0x3a000, flAllocationType=0x3000, flProtect=0x40) returned 0x400000 [0187.177] WriteProcessMemory (in: hProcess=0x5de4, lpBaseAddress=0x400000, lpBuffer=0x3e88230*, nSize=0x200, lpNumberOfBytesWritten=0x19e5cc | out: lpBuffer=0x3e88230*, lpNumberOfBytesWritten=0x19e5cc*=0x200) returned 1 [0187.198] WriteProcessMemory (in: hProcess=0x5de4, lpBaseAddress=0x402000, lpBuffer=0x3ebc850*, nSize=0x33c00, lpNumberOfBytesWritten=0x19e5cc | out: lpBuffer=0x3ebc850*, lpNumberOfBytesWritten=0x19e5cc*=0x33c00) returned 1 [0187.210] WriteProcessMemory (in: hProcess=0x5de4, lpBaseAddress=0x436000, lpBuffer=0x2359b20*, nSize=0x600, lpNumberOfBytesWritten=0x19e5cc | out: lpBuffer=0x2359b20*, lpNumberOfBytesWritten=0x19e5cc*=0x600) returned 1 [0187.215] WriteProcessMemory (in: hProcess=0x5de4, lpBaseAddress=0x438000, lpBuffer=0x235a12c*, nSize=0x200, lpNumberOfBytesWritten=0x19e5cc | out: lpBuffer=0x235a12c*, lpNumberOfBytesWritten=0x19e5cc*=0x200) returned 1 [0187.232] WriteProcessMemory (in: hProcess=0x5de4, lpBaseAddress=0x2cb008, lpBuffer=0x235a638*, nSize=0x4, lpNumberOfBytesWritten=0x19e5cc | out: lpBuffer=0x235a638*, lpNumberOfBytesWritten=0x19e5cc*=0x4) returned 1 [0187.236] SetThreadContext (hThread=0x394, lpContext=0x2358a50*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x2cb000, Edx=0x0, Ecx=0x0, Eax=0x435b6e, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0187.239] ResumeThread (hThread=0x394) returned 0x1 [0187.329] CoGetContextToken (in: pToken=0x19e978 | out: pToken=0x19e978) returned 0x0 [0187.329] CObjectContext::QueryInterface () returned 0x0 [0187.329] CObjectContext::GetCurrentThreadType () returned 0x0 [0187.329] Release () returned 0x0 [0187.331] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x13880, cHandles=0x1, pHandles=0x705cf8*=0x25c, lpdwindex=0x19e81c | out: lpdwindex=0x19e81c) returned 0x0 Thread: id = 2 os_tid = 0xafc Thread: id = 3 os_tid = 0xbf0 Thread: id = 4 os_tid = 0xbd8 [0118.864] CoGetContextToken (in: pToken=0x437fc3c | out: pToken=0x437fc3c) returned 0x800401f0 [0118.864] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0118.864] RoInitialize () returned 0x1 [0118.864] RoUninitialize () returned 0x0 [0120.308] CloseHandle (hObject=0x380) returned 1 [0120.308] CloseHandle (hObject=0x9f7c) returned 1 [0120.308] CloseHandle (hObject=0x5ca4) returned 1 [0120.309] CloseHandle (hObject=0x8934) returned 1 [0120.309] CloseHandle (hObject=0x5ca0) returned 1 [0120.309] CloseHandle (hObject=0xaaa0) returned 1 [0120.309] CloseHandle (hObject=0x5c9c) returned 1 [0120.309] CloseHandle (hObject=0x8930) returned 1 [0120.310] CloseHandle (hObject=0x5c98) returned 1 [0120.310] CloseHandle (hObject=0x9f78) returned 1 [0120.310] CloseHandle (hObject=0x5c94) returned 1 [0120.310] CloseHandle (hObject=0x892c) returned 1 [0120.310] CloseHandle (hObject=0x5c90) returned 1 [0120.311] CloseHandle (hObject=0xb034) returned 1 [0120.311] CloseHandle (hObject=0x5c8c) returned 1 [0120.311] CloseHandle (hObject=0x8928) returned 1 [0120.311] CloseHandle (hObject=0x5c88) returned 1 [0120.311] CloseHandle (hObject=0x9f74) returned 1 [0120.311] CloseHandle (hObject=0x5c84) returned 1 [0120.312] CloseHandle (hObject=0x8924) returned 1 [0120.312] CloseHandle (hObject=0x5c80) returned 1 [0120.312] CloseHandle (hObject=0xaa9c) returned 1 [0120.312] CloseHandle (hObject=0x5c7c) returned 1 [0120.312] CloseHandle (hObject=0x8920) returned 1 [0120.312] CloseHandle (hObject=0x5c78) returned 1 [0120.312] CloseHandle (hObject=0x9f70) returned 1 [0120.313] CloseHandle (hObject=0x5c74) returned 1 [0120.313] CloseHandle (hObject=0x891c) returned 1 [0120.313] CloseHandle (hObject=0x5c70) returned 1 [0120.313] CloseHandle (hObject=0xb514) returned 1 [0120.313] CloseHandle (hObject=0x5c6c) returned 1 [0120.313] CloseHandle (hObject=0x8918) returned 1 [0120.313] CloseHandle (hObject=0x5c68) returned 1 [0120.314] CloseHandle (hObject=0x9f6c) returned 1 [0120.314] CloseHandle (hObject=0x5c64) returned 1 [0120.314] CloseHandle (hObject=0x8914) returned 1 [0120.314] CloseHandle (hObject=0x5c60) returned 1 [0120.314] CloseHandle (hObject=0xaa98) returned 1 [0120.314] CloseHandle (hObject=0x5c5c) returned 1 [0120.316] CloseHandle (hObject=0x8910) returned 1 [0120.316] CloseHandle (hObject=0x5c58) returned 1 [0120.316] CloseHandle (hObject=0x9f68) returned 1 [0120.316] CloseHandle (hObject=0x5c54) returned 1 [0120.316] CloseHandle (hObject=0x890c) returned 1 [0120.316] CloseHandle (hObject=0x5c50) returned 1 [0120.317] CloseHandle (hObject=0xb030) returned 1 [0120.317] CloseHandle (hObject=0x5c4c) returned 1 [0120.317] CloseHandle (hObject=0x8908) returned 1 [0120.317] CloseHandle (hObject=0x5c48) returned 1 [0120.317] CloseHandle (hObject=0x9f64) returned 1 [0120.317] CloseHandle (hObject=0x5c44) returned 1 [0120.318] CloseHandle (hObject=0x8904) returned 1 [0120.318] CloseHandle (hObject=0x5c40) returned 1 [0120.318] CloseHandle (hObject=0xaa94) returned 1 [0120.318] CloseHandle (hObject=0x5c3c) returned 1 [0120.318] CloseHandle (hObject=0x8900) returned 1 [0120.318] CloseHandle (hObject=0x5c38) returned 1 [0120.318] CloseHandle (hObject=0x9f60) returned 1 [0120.318] CloseHandle (hObject=0x5c34) returned 1 [0120.319] CloseHandle (hObject=0x88fc) returned 1 [0120.319] CloseHandle (hObject=0x5c30) returned 1 [0120.319] CloseHandle (hObject=0xb2f8) returned 1 [0120.319] CloseHandle (hObject=0x5c2c) returned 1 [0120.319] CloseHandle (hObject=0x88f8) returned 1 [0120.319] CloseHandle (hObject=0x5c28) returned 1 [0120.319] CloseHandle (hObject=0x9f5c) returned 1 [0120.320] CloseHandle (hObject=0x5c24) returned 1 [0120.320] CloseHandle (hObject=0x88f4) returned 1 [0120.320] CloseHandle (hObject=0x5c20) returned 1 [0120.320] CloseHandle (hObject=0xaa90) returned 1 [0120.320] CloseHandle (hObject=0x5c1c) returned 1 [0120.320] CloseHandle (hObject=0x88f0) returned 1 [0120.321] CloseHandle (hObject=0x5c18) returned 1 [0120.321] CloseHandle (hObject=0x9f58) returned 1 [0120.321] CloseHandle (hObject=0x5c14) returned 1 [0120.321] CloseHandle (hObject=0x88ec) returned 1 [0120.321] CloseHandle (hObject=0x5c10) returned 1 [0120.321] CloseHandle (hObject=0xb02c) returned 1 [0120.321] CloseHandle (hObject=0x5c0c) returned 1 [0120.322] CloseHandle (hObject=0x88e8) returned 1 [0120.322] CloseHandle (hObject=0x5c08) returned 1 [0120.322] CloseHandle (hObject=0x9f54) returned 1 [0120.322] CloseHandle (hObject=0x5c04) returned 1 [0120.322] CloseHandle (hObject=0x88e4) returned 1 [0120.322] CloseHandle (hObject=0x5bfc) returned 1 [0120.322] CloseHandle (hObject=0xaa8c) returned 1 [0120.323] CloseHandle (hObject=0x5bf8) returned 1 [0120.323] CloseHandle (hObject=0x88e0) returned 1 [0120.323] CloseHandle (hObject=0x5bf4) returned 1 [0120.323] CloseHandle (hObject=0x9f50) returned 1 [0120.323] CloseHandle (hObject=0x5bf0) returned 1 [0120.323] CloseHandle (hObject=0x88dc) returned 1 [0120.323] CloseHandle (hObject=0x5bec) returned 1 [0120.323] CloseHandle (hObject=0xb460) returned 1 [0120.324] CloseHandle (hObject=0x5be8) returned 1 [0120.324] CloseHandle (hObject=0x88d8) returned 1 [0120.324] CloseHandle (hObject=0x5be4) returned 1 [0120.324] CloseHandle (hObject=0x9f4c) returned 1 [0120.324] CloseHandle (hObject=0x5be0) returned 1 [0120.324] CloseHandle (hObject=0x88d4) returned 1 [0120.324] CloseHandle (hObject=0x5bdc) returned 1 [0120.325] CloseHandle (hObject=0xaa88) returned 1 [0120.325] CloseHandle (hObject=0x5bd8) returned 1 [0120.325] CloseHandle (hObject=0x88d0) returned 1 [0120.325] CloseHandle (hObject=0x5bd4) returned 1 [0120.328] CloseHandle (hObject=0x9f48) returned 1 [0120.328] CloseHandle (hObject=0x5bd0) returned 1 [0120.329] CloseHandle (hObject=0x88cc) returned 1 [0120.329] CloseHandle (hObject=0x5bcc) returned 1 [0120.329] CloseHandle (hObject=0xb028) returned 1 [0120.329] CloseHandle (hObject=0x5bc8) returned 1 [0120.329] CloseHandle (hObject=0x88c8) returned 1 [0120.329] CloseHandle (hObject=0x5bc4) returned 1 [0120.329] CloseHandle (hObject=0x9f44) returned 1 [0120.330] CloseHandle (hObject=0x5bc0) returned 1 [0120.330] CloseHandle (hObject=0x88c4) returned 1 [0120.330] CloseHandle (hObject=0x5bbc) returned 1 [0120.330] CloseHandle (hObject=0xaa84) returned 1 [0120.330] CloseHandle (hObject=0x5bb8) returned 1 [0120.330] CloseHandle (hObject=0x88c0) returned 1 [0120.330] CloseHandle (hObject=0x5bb4) returned 1 [0120.330] CloseHandle (hObject=0x9f40) returned 1 [0120.331] CloseHandle (hObject=0x5bb0) returned 1 [0120.331] CloseHandle (hObject=0x88bc) returned 1 [0120.331] CloseHandle (hObject=0x5bac) returned 1 [0120.331] CloseHandle (hObject=0xb2f4) returned 1 [0120.331] CloseHandle (hObject=0x5ba8) returned 1 [0120.331] CloseHandle (hObject=0x88b8) returned 1 [0120.331] CloseHandle (hObject=0x5ba4) returned 1 [0120.332] CloseHandle (hObject=0x9f3c) returned 1 [0120.332] CloseHandle (hObject=0x5ba0) returned 1 [0120.332] CloseHandle (hObject=0x88b4) returned 1 [0120.332] CloseHandle (hObject=0x5b9c) returned 1 [0120.332] CloseHandle (hObject=0xaa80) returned 1 [0120.332] CloseHandle (hObject=0x5b98) returned 1 [0120.332] CloseHandle (hObject=0x88b0) returned 1 [0120.333] CloseHandle (hObject=0x5b94) returned 1 [0120.333] CloseHandle (hObject=0x9f38) returned 1 [0120.333] CloseHandle (hObject=0x5b90) returned 1 [0120.333] CloseHandle (hObject=0x88ac) returned 1 [0120.333] CloseHandle (hObject=0x5b8c) returned 1 [0120.333] CloseHandle (hObject=0xb024) returned 1 [0120.333] CloseHandle (hObject=0x5b88) returned 1 [0120.334] CloseHandle (hObject=0x88a8) returned 1 [0120.334] CloseHandle (hObject=0x5b84) returned 1 [0120.334] CloseHandle (hObject=0x9f34) returned 1 [0120.334] CloseHandle (hObject=0x5b80) returned 1 [0120.334] CloseHandle (hObject=0x88a4) returned 1 [0120.334] CloseHandle (hObject=0x5b7c) returned 1 [0120.334] CloseHandle (hObject=0xaa7c) returned 1 [0120.334] CloseHandle (hObject=0x5b78) returned 1 [0120.335] CloseHandle (hObject=0x88a0) returned 1 [0120.335] CloseHandle (hObject=0x5b74) returned 1 [0120.335] CloseHandle (hObject=0x9f30) returned 1 [0120.335] CloseHandle (hObject=0x5b70) returned 1 [0120.335] CloseHandle (hObject=0x889c) returned 1 [0120.335] CloseHandle (hObject=0x5b6c) returned 1 [0120.336] CloseHandle (hObject=0xb56c) returned 1 [0120.336] CloseHandle (hObject=0x5b68) returned 1 [0120.336] CloseHandle (hObject=0x8898) returned 1 [0120.336] CloseHandle (hObject=0x5b64) returned 1 [0120.336] CloseHandle (hObject=0x9f2c) returned 1 [0120.336] CloseHandle (hObject=0x5b60) returned 1 [0120.336] CloseHandle (hObject=0x8894) returned 1 [0120.337] CloseHandle (hObject=0x5b5c) returned 1 [0120.337] CloseHandle (hObject=0xaa78) returned 1 [0120.337] CloseHandle (hObject=0x5b58) returned 1 [0120.337] CloseHandle (hObject=0x8890) returned 1 [0120.338] CloseHandle (hObject=0x5b54) returned 1 [0120.338] CloseHandle (hObject=0x9f28) returned 1 [0120.339] CloseHandle (hObject=0x5b50) returned 1 [0120.339] CloseHandle (hObject=0x888c) returned 1 [0120.339] CloseHandle (hObject=0x5b4c) returned 1 [0120.339] CloseHandle (hObject=0xb020) returned 1 [0120.339] CloseHandle (hObject=0x5b48) returned 1 [0120.339] CloseHandle (hObject=0x8888) returned 1 [0120.339] CloseHandle (hObject=0x5b44) returned 1 [0120.340] CloseHandle (hObject=0x9f24) returned 1 [0120.340] CloseHandle (hObject=0x5b40) returned 1 [0120.340] CloseHandle (hObject=0x8884) returned 1 [0120.340] CloseHandle (hObject=0x5b3c) returned 1 [0120.340] CloseHandle (hObject=0xaa74) returned 1 [0120.340] CloseHandle (hObject=0x5b38) returned 1 [0120.340] CloseHandle (hObject=0x8880) returned 1 [0120.341] CloseHandle (hObject=0x5b34) returned 1 [0120.341] CloseHandle (hObject=0x9f20) returned 1 [0120.341] CloseHandle (hObject=0x5b30) returned 1 [0120.341] CloseHandle (hObject=0x887c) returned 1 [0120.341] CloseHandle (hObject=0x5b2c) returned 1 [0120.341] CloseHandle (hObject=0xb2f0) returned 1 [0120.341] CloseHandle (hObject=0x5b28) returned 1 [0120.342] CloseHandle (hObject=0x8878) returned 1 [0120.342] CloseHandle (hObject=0x5b24) returned 1 [0120.342] CloseHandle (hObject=0x9f1c) returned 1 [0120.342] CloseHandle (hObject=0x5b20) returned 1 [0120.342] CloseHandle (hObject=0x8874) returned 1 [0120.342] CloseHandle (hObject=0x5b1c) returned 1 [0120.342] CloseHandle (hObject=0xaa70) returned 1 [0120.342] CloseHandle (hObject=0x5b18) returned 1 [0120.343] CloseHandle (hObject=0x8870) returned 1 [0120.343] CloseHandle (hObject=0x5b14) returned 1 [0120.343] CloseHandle (hObject=0x9f18) returned 1 [0120.343] CloseHandle (hObject=0x5b10) returned 1 [0120.343] CloseHandle (hObject=0x886c) returned 1 [0120.343] CloseHandle (hObject=0x5b0c) returned 1 [0120.343] CloseHandle (hObject=0xb01c) returned 1 [0120.344] CloseHandle (hObject=0x5b08) returned 1 [0120.344] CloseHandle (hObject=0x8868) returned 1 [0120.344] CloseHandle (hObject=0x5b04) returned 1 [0120.344] CloseHandle (hObject=0x9f14) returned 1 [0120.344] CloseHandle (hObject=0x5b00) returned 1 [0120.344] CloseHandle (hObject=0x8864) returned 1 [0120.344] CloseHandle (hObject=0x5afc) returned 1 [0120.345] CloseHandle (hObject=0xaa6c) returned 1 [0120.345] CloseHandle (hObject=0x5af8) returned 1 [0120.345] CloseHandle (hObject=0x8860) returned 1 [0120.345] CloseHandle (hObject=0x5af4) returned 1 [0120.345] CloseHandle (hObject=0x9f10) returned 1 [0120.345] CloseHandle (hObject=0x5af0) returned 1 [0120.346] CloseHandle (hObject=0x885c) returned 1 [0120.346] CloseHandle (hObject=0x5aec) returned 1 [0120.346] CloseHandle (hObject=0xb45c) returned 1 [0120.346] CloseHandle (hObject=0x5ae8) returned 1 [0120.346] CloseHandle (hObject=0x8858) returned 1 [0120.346] CloseHandle (hObject=0x5ae4) returned 1 [0120.346] CloseHandle (hObject=0x9f0c) returned 1 [0120.346] CloseHandle (hObject=0x5ae0) returned 1 [0120.347] CloseHandle (hObject=0x8854) returned 1 [0120.347] CloseHandle (hObject=0x5adc) returned 1 [0120.347] CloseHandle (hObject=0xaa68) returned 1 [0120.347] CloseHandle (hObject=0x5ad8) returned 1 [0120.347] CloseHandle (hObject=0x8850) returned 1 [0120.347] CloseHandle (hObject=0x5ad4) returned 1 [0120.348] CloseHandle (hObject=0x9f08) returned 1 [0120.348] CloseHandle (hObject=0x5ad0) returned 1 [0120.348] CloseHandle (hObject=0x884c) returned 1 [0120.348] CloseHandle (hObject=0x5acc) returned 1 [0120.348] CloseHandle (hObject=0xb018) returned 1 [0120.349] CloseHandle (hObject=0x5ac8) returned 1 [0120.349] CloseHandle (hObject=0x8848) returned 1 [0120.350] CloseHandle (hObject=0x5ac4) returned 1 [0120.350] CloseHandle (hObject=0x9f04) returned 1 [0120.350] CloseHandle (hObject=0x5ac0) returned 1 [0120.350] CloseHandle (hObject=0x8844) returned 1 [0120.350] CloseHandle (hObject=0x5abc) returned 1 [0120.350] CloseHandle (hObject=0xaa64) returned 1 [0120.351] CloseHandle (hObject=0x5ab8) returned 1 [0120.351] CloseHandle (hObject=0x8840) returned 1 [0120.351] CloseHandle (hObject=0x5ab4) returned 1 [0122.046] CloseHandle (hObject=0x5ec8) returned 1 [0122.046] CloseHandle (hObject=0x5ddc) returned 1 [0122.046] CloseHandle (hObject=0x72c) returned 1 [0122.046] CloseHandle (hObject=0x5f0) returned 1 [0122.047] CloseHandle (hObject=0x81c) returned 1 [0122.047] CloseHandle (hObject=0x89d0) returned 1 [0122.047] CloseHandle (hObject=0x5e78) returned 1 [0122.047] CloseHandle (hObject=0x5ec) returned 1 [0122.047] CloseHandle (hObject=0x7c8) returned 1 [0122.047] CloseHandle (hObject=0x5dd8) returned 1 [0122.047] CloseHandle (hObject=0x728) returned 1 [0122.048] CloseHandle (hObject=0x5e8) returned 1 [0122.048] CloseHandle (hObject=0x378) returned 1 [0122.048] CloseHandle (hObject=0x9fc8) returned 1 [0122.048] CloseHandle (hObject=0x9ff0) returned 1 [0122.048] CloseHandle (hObject=0x5e4) returned 1 [0122.048] CloseHandle (hObject=0xa008) returned 1 [0122.048] CloseHandle (hObject=0x5dd4) returned 1 [0122.048] CloseHandle (hObject=0x724) returned 1 [0122.049] CloseHandle (hObject=0x5e0) returned 1 [0122.049] CloseHandle (hObject=0xb46c) returned 1 [0122.049] CloseHandle (hObject=0x89cc) returned 1 [0122.049] CloseHandle (hObject=0x5e74) returned 1 [0122.049] CloseHandle (hObject=0x5dc) returned 1 [0122.049] CloseHandle (hObject=0x7c4) returned 1 [0122.049] CloseHandle (hObject=0x5dd0) returned 1 [0122.049] CloseHandle (hObject=0x720) returned 1 [0122.050] CloseHandle (hObject=0x5d8) returned 1 [0122.050] CloseHandle (hObject=0x8a64) returned 1 [0122.050] CloseHandle (hObject=0xb048) returned 1 [0122.050] CloseHandle (hObject=0x8a1c) returned 1 [0122.050] CloseHandle (hObject=0x5d4) returned 1 [0122.050] CloseHandle (hObject=0x5ec4) returned 1 [0122.050] CloseHandle (hObject=0x5dcc) returned 1 [0122.050] CloseHandle (hObject=0x71c) returned 1 [0122.051] CloseHandle (hObject=0x5d0) returned 1 [0122.051] CloseHandle (hObject=0x818) returned 1 [0122.051] CloseHandle (hObject=0x89c8) returned 1 [0122.051] CloseHandle (hObject=0x5e70) returned 1 [0122.051] CloseHandle (hObject=0x5cc) returned 1 [0122.051] CloseHandle (hObject=0x7c0) returned 1 [0122.051] CloseHandle (hObject=0x5dc8) returned 1 [0122.052] CloseHandle (hObject=0x718) returned 1 [0122.052] CloseHandle (hObject=0x5c8) returned 1 [0122.052] CloseHandle (hObject=0x5f0c) returned 1 [0122.052] CloseHandle (hObject=0x9fc4) returned 1 [0122.052] CloseHandle (hObject=0xb518) returned 1 [0122.052] CloseHandle (hObject=0x5c4) returned 1 [0122.053] CloseHandle (hObject=0x8a44) returned 1 [0122.053] CloseHandle (hObject=0x5dc4) returned 1 [0122.053] CloseHandle (hObject=0x714) returned 1 [0122.053] CloseHandle (hObject=0x5c0) returned 1 [0122.053] CloseHandle (hObject=0x5eec) returned 1 [0122.053] CloseHandle (hObject=0x89c4) returned 1 [0122.053] CloseHandle (hObject=0x5e6c) returned 1 [0122.053] CloseHandle (hObject=0x5bc) returned 1 [0122.054] CloseHandle (hObject=0x7bc) returned 1 [0122.054] CloseHandle (hObject=0x5dc0) returned 1 [0122.054] CloseHandle (hObject=0x710) returned 1 [0122.054] CloseHandle (hObject=0x5b8) returned 1 [0122.054] CloseHandle (hObject=0x840) returned 1 [0122.054] CloseHandle (hObject=0xaac4) returned 1 [0122.055] CloseHandle (hObject=0x8a18) returned 1 [0122.055] CloseHandle (hObject=0x5b4) returned 1 [0122.055] CloseHandle (hObject=0x5ec0) returned 1 [0122.055] CloseHandle (hObject=0x5dbc) returned 1 [0122.055] CloseHandle (hObject=0x70c) returned 1 [0122.055] CloseHandle (hObject=0x5b0) returned 1 [0122.055] CloseHandle (hObject=0x814) returned 1 [0122.055] CloseHandle (hObject=0x89c0) returned 1 [0122.056] CloseHandle (hObject=0x5e68) returned 1 [0122.056] CloseHandle (hObject=0x5ac) returned 1 [0122.056] CloseHandle (hObject=0x7b8) returned 1 [0122.056] CloseHandle (hObject=0x5db8) returned 1 [0122.056] CloseHandle (hObject=0x708) returned 1 [0122.056] CloseHandle (hObject=0x5a8) returned 1 [0122.056] CloseHandle (hObject=0x860) returned 1 [0122.056] CloseHandle (hObject=0x9fc0) returned 1 [0122.057] CloseHandle (hObject=0x9fec) returned 1 [0122.057] CloseHandle (hObject=0x5a4) returned 1 [0122.057] CloseHandle (hObject=0xaae4) returned 1 [0122.057] CloseHandle (hObject=0x5db4) returned 1 [0122.057] CloseHandle (hObject=0x704) returned 1 [0122.057] CloseHandle (hObject=0x5a0) returned 1 [0122.058] CloseHandle (hObject=0x8a58) returned 1 [0122.058] CloseHandle (hObject=0x89bc) returned 1 [0122.058] CloseHandle (hObject=0x5e64) returned 1 [0122.058] CloseHandle (hObject=0x59c) returned 1 [0122.058] CloseHandle (hObject=0x7b4) returned 1 [0122.059] CloseHandle (hObject=0x5db0) returned 1 [0122.059] CloseHandle (hObject=0x700) returned 1 [0122.059] CloseHandle (hObject=0x598) returned 1 [0122.059] CloseHandle (hObject=0x5f00) returned 1 [0122.059] CloseHandle (hObject=0xb304) returned 1 [0122.059] CloseHandle (hObject=0x8a14) returned 1 [0122.060] CloseHandle (hObject=0x594) returned 1 [0122.060] CloseHandle (hObject=0x5ebc) returned 1 [0122.060] CloseHandle (hObject=0x5dac) returned 1 [0122.060] CloseHandle (hObject=0x6fc) returned 1 [0122.060] CloseHandle (hObject=0x590) returned 1 [0122.060] CloseHandle (hObject=0x810) returned 1 [0122.061] CloseHandle (hObject=0x89b8) returned 1 [0122.061] CloseHandle (hObject=0x5e60) returned 1 [0122.061] CloseHandle (hObject=0x58c) returned 1 [0122.061] CloseHandle (hObject=0x7b0) returned 1 [0122.061] CloseHandle (hObject=0x5da8) returned 1 [0122.061] CloseHandle (hObject=0x6f8) returned 1 [0122.061] CloseHandle (hObject=0x588) returned 1 [0122.062] CloseHandle (hObject=0x854) returned 1 [0122.062] CloseHandle (hObject=0x9fbc) returned 1 [0122.062] CloseHandle (hObject=0xaad8) returned 1 [0122.062] CloseHandle (hObject=0x584) returned 1 [0122.062] CloseHandle (hObject=0x8a40) returned 1 [0122.062] CloseHandle (hObject=0x5da4) returned 1 [0122.063] CloseHandle (hObject=0x6f4) returned 1 [0122.063] CloseHandle (hObject=0x580) returned 1 [0122.063] CloseHandle (hObject=0x5ee8) returned 1 [0122.063] CloseHandle (hObject=0x89b4) returned 1 [0122.063] CloseHandle (hObject=0x5e5c) returned 1 [0122.063] CloseHandle (hObject=0x57c) returned 1 [0122.063] CloseHandle (hObject=0x7ac) returned 1 [0122.063] CloseHandle (hObject=0x5da0) returned 1 [0122.064] CloseHandle (hObject=0x6f0) returned 1 [0122.064] CloseHandle (hObject=0x578) returned 1 [0122.064] CloseHandle (hObject=0x83c) returned 1 [0122.064] CloseHandle (hObject=0xaac0) returned 1 [0122.064] CloseHandle (hObject=0x8a10) returned 1 [0122.064] CloseHandle (hObject=0x574) returned 1 [0122.065] CloseHandle (hObject=0x5eb8) returned 1 [0122.065] CloseHandle (hObject=0x5d9c) returned 1 [0122.065] CloseHandle (hObject=0x6ec) returned 1 [0122.065] CloseHandle (hObject=0x570) returned 1 [0122.065] CloseHandle (hObject=0x80c) returned 1 [0122.065] CloseHandle (hObject=0x89b0) returned 1 [0122.065] CloseHandle (hObject=0x5e58) returned 1 [0122.065] CloseHandle (hObject=0x56c) returned 1 [0122.066] CloseHandle (hObject=0x7a8) returned 1 [0122.066] CloseHandle (hObject=0x5d98) returned 1 [0122.066] CloseHandle (hObject=0x6e8) returned 1 [0122.066] CloseHandle (hObject=0x568) returned 1 [0122.066] CloseHandle (hObject=0x37c) returned 1 [0122.066] CloseHandle (hObject=0x9fb8) returned 1 [0122.066] CloseHandle (hObject=0x9fe8) returned 1 [0122.067] CloseHandle (hObject=0x564) returned 1 [0122.067] CloseHandle (hObject=0xa004) returned 1 [0122.067] CloseHandle (hObject=0x5d94) returned 1 [0122.067] CloseHandle (hObject=0x6e4) returned 1 [0122.067] CloseHandle (hObject=0x560) returned 1 [0122.067] CloseHandle (hObject=0xa010) returned 1 [0122.067] CloseHandle (hObject=0x89ac) returned 1 [0122.067] CloseHandle (hObject=0x5e54) returned 1 [0122.068] CloseHandle (hObject=0x55c) returned 1 [0122.068] CloseHandle (hObject=0x7a4) returned 1 [0122.068] CloseHandle (hObject=0x5d90) returned 1 [0122.068] CloseHandle (hObject=0x6e0) returned 1 [0122.068] CloseHandle (hObject=0x558) returned 1 [0122.068] CloseHandle (hObject=0xaaec) returned 1 [0122.068] CloseHandle (hObject=0xb044) returned 1 [0122.068] CloseHandle (hObject=0x8a0c) returned 1 [0122.069] CloseHandle (hObject=0x554) returned 1 [0122.069] CloseHandle (hObject=0x5eb4) returned 1 [0122.069] CloseHandle (hObject=0x5d8c) returned 1 [0122.069] CloseHandle (hObject=0x6dc) returned 1 [0122.069] CloseHandle (hObject=0x550) returned 1 [0122.069] CloseHandle (hObject=0x808) returned 1 [0122.069] CloseHandle (hObject=0x89a8) returned 1 [0122.069] CloseHandle (hObject=0x5e50) returned 1 [0122.070] CloseHandle (hObject=0x54c) returned 1 [0122.070] CloseHandle (hObject=0x7a0) returned 1 [0122.070] CloseHandle (hObject=0x5d88) returned 1 [0122.070] CloseHandle (hObject=0x6d8) returned 1 [0122.070] CloseHandle (hObject=0x548) returned 1 [0122.070] CloseHandle (hObject=0x8a68) returned 1 [0122.070] CloseHandle (hObject=0x9fb4) returned 1 [0122.070] CloseHandle (hObject=0xb050) returned 1 [0122.071] CloseHandle (hObject=0x544) returned 1 [0122.071] CloseHandle (hObject=0x8a3c) returned 1 [0122.071] CloseHandle (hObject=0x5d84) returned 1 [0122.071] CloseHandle (hObject=0x6d4) returned 1 [0122.071] CloseHandle (hObject=0x540) returned 1 [0122.071] CloseHandle (hObject=0x5ee4) returned 1 [0122.071] CloseHandle (hObject=0x89a4) returned 1 [0122.072] CloseHandle (hObject=0x5e4c) returned 1 [0122.072] CloseHandle (hObject=0x53c) returned 1 [0122.072] CloseHandle (hObject=0x79c) returned 1 [0122.072] CloseHandle (hObject=0x5d80) returned 1 [0122.073] CloseHandle (hObject=0x6d0) returned 1 [0122.073] CloseHandle (hObject=0x538) returned 1 [0122.073] CloseHandle (hObject=0x838) returned 1 [0122.073] CloseHandle (hObject=0xaabc) returned 1 [0122.073] CloseHandle (hObject=0x8a08) returned 1 [0122.073] CloseHandle (hObject=0x534) returned 1 [0122.073] CloseHandle (hObject=0x5eb0) returned 1 [0122.073] CloseHandle (hObject=0x5d7c) returned 1 [0122.074] CloseHandle (hObject=0x6cc) returned 1 [0122.074] CloseHandle (hObject=0x530) returned 1 [0122.074] CloseHandle (hObject=0x804) returned 1 [0122.074] CloseHandle (hObject=0x89a0) returned 1 [0122.074] CloseHandle (hObject=0x5e48) returned 1 [0122.074] CloseHandle (hObject=0x52c) returned 1 [0122.074] CloseHandle (hObject=0x798) returned 1 [0122.075] CloseHandle (hObject=0x5d78) returned 1 [0122.075] CloseHandle (hObject=0x6c8) returned 1 [0122.075] CloseHandle (hObject=0x528) returned 1 [0122.075] CloseHandle (hObject=0x5f10) returned 1 [0122.075] CloseHandle (hObject=0x9fb0) returned 1 [0122.075] CloseHandle (hObject=0x9fe4) returned 1 [0122.075] CloseHandle (hObject=0x524) returned 1 [0122.075] CloseHandle (hObject=0xb30c) returned 1 [0122.076] CloseHandle (hObject=0x5d74) returned 1 [0122.076] CloseHandle (hObject=0x6c4) returned 1 [0122.076] CloseHandle (hObject=0x520) returned 1 [0122.076] CloseHandle (hObject=0x8a54) returned 1 [0122.076] CloseHandle (hObject=0x899c) returned 1 [0122.076] CloseHandle (hObject=0x5e44) returned 1 [0122.076] CloseHandle (hObject=0x51c) returned 1 [0122.077] CloseHandle (hObject=0x794) returned 1 [0122.077] CloseHandle (hObject=0x5d70) returned 1 [0122.077] CloseHandle (hObject=0x6c0) returned 1 [0122.077] CloseHandle (hObject=0x518) returned 1 [0122.077] CloseHandle (hObject=0x5efc) returned 1 [0122.077] CloseHandle (hObject=0xb5b0) returned 1 [0122.077] CloseHandle (hObject=0x8a04) returned 1 [0122.078] CloseHandle (hObject=0x514) returned 1 [0122.078] CloseHandle (hObject=0x5eac) returned 1 [0122.078] CloseHandle (hObject=0x5d6c) returned 1 [0122.078] CloseHandle (hObject=0x6bc) returned 1 [0122.078] CloseHandle (hObject=0x510) returned 1 [0122.078] CloseHandle (hObject=0x7fc) returned 1 [0122.078] CloseHandle (hObject=0x8998) returned 1 [0122.078] CloseHandle (hObject=0x5e40) returned 1 [0122.088] CloseHandle (hObject=0x50c) returned 1 [0122.088] CloseHandle (hObject=0x790) returned 1 [0122.089] CloseHandle (hObject=0x5d68) returned 1 [0122.089] CloseHandle (hObject=0x6b8) returned 1 [0122.089] CloseHandle (hObject=0x508) returned 1 [0122.089] CloseHandle (hObject=0x850) returned 1 [0122.089] CloseHandle (hObject=0x9fac) returned 1 [0122.089] CloseHandle (hObject=0xaad4) returned 1 [0122.089] CloseHandle (hObject=0x504) returned 1 [0122.089] CloseHandle (hObject=0x8a38) returned 1 [0122.090] CloseHandle (hObject=0x5d64) returned 1 [0122.090] CloseHandle (hObject=0x6b4) returned 1 [0122.090] CloseHandle (hObject=0x500) returned 1 [0122.090] CloseHandle (hObject=0x5ee0) returned 1 [0122.090] CloseHandle (hObject=0x8994) returned 1 [0122.090] CloseHandle (hObject=0x5e3c) returned 1 [0122.090] CloseHandle (hObject=0x4fc) returned 1 [0122.090] CloseHandle (hObject=0x78c) returned 1 [0187.386] SetWindowLongW (hWnd=0x503b8, nIndex=-4, dwNewLong=1951270880) returned 115541478 [0187.390] SetClassLongW (hWnd=0x503b8, nIndex=-24, dwNewLong=1951270880) returned 0x6e305be [0187.391] PostMessageW (hWnd=0x503b8, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0187.393] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0187.393] UnregisterClassW (lpClassName="WindowsForms10.Window.8.app.0.141b42a_r41_ad1", hInstance=0x400000) returned 0 [0187.401] IsWindow (hWnd=0x502ac) returned 1 [0187.404] GetModuleHandleW (lpModuleName="user32.dll") returned 0x75640000 [0187.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x437f9dc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcW j§?º© «ÆkXü7\x04`¾r", lpUsedDefaultChar=0x0) returned 14 [0187.405] GetProcAddress (hModule=0x75640000, lpProcName="DefWindowProcW") returned 0x744e07e0 [0187.406] SetWindowLongW (hWnd=0x502ac, nIndex=-4, dwNewLong=1951270880) returned 115541558 [0187.406] SetClassLongW (hWnd=0x502ac, nIndex=-24, dwNewLong=1951270880) returned 0x6e30636 [0187.406] IsWindow (hWnd=0x502ac) returned 1 [0187.407] DestroyWindow (hWnd=0x502ac) returned 0 [0187.407] PostMessageW (hWnd=0x502ac, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0187.407] SetConsoleCtrlHandler (HandlerRoutine=0x6e3060e, Add=0) returned 1 [0187.408] EtwEventUnregister (RegHandle=0x70c328) returned 0x0 [0187.447] CloseHandle (hObject=0x5f4) returned 1 [0187.449] GdipDeleteFont (font=0x6c8efc0) returned 0x0 [0187.451] GdipDisposeImage (image=0x7f4f268) returned 0x0 [0187.460] DeleteObject (ho=0x3e0a06b6) returned 1 [0187.461] DeleteObject (ho=0xa80a06be) returned 1 [0187.462] GetCurrentObject (hdc=0x2a0109cd, type=0x6) returned 0x710a0792 [0187.462] SelectObject (hdc=0x2a0109cd, h=0x18a0048) returned 0x710a0792 [0187.463] DeleteObject (ho=0x710a0792) returned 1 [0187.464] DeleteDC (hdc=0x2a0109cd) returned 1 [0187.465] RestoreDC (hdc=0x0, nSavedDC=-1) returned 0 [0187.466] GdipDeleteFont (font=0x6c81f08) returned 0x0 [0187.470] RegCloseKey (hKey=0x80000004) returned 0x0 Thread: id = 5 os_tid = 0xe28 [0142.188] CoGetContextToken (in: pToken=0x47bfd0c | out: pToken=0x47bfd0c) returned 0x0 [0142.189] CObjectContext::QueryInterface () returned 0x0 [0142.190] CObjectContext::GetCurrentThreadType () returned 0x0 [0142.190] Release () returned 0x0 Thread: id = 6 os_tid = 0x1200 Thread: id = 7 os_tid = 0xf80 Thread: id = 8 os_tid = 0x8e0 Thread: id = 9 os_tid = 0x9c8 Thread: id = 11 os_tid = 0x8c0 Thread: id = 12 os_tid = 0x1294 Process: id = "2" image_name = "c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe" filename = "c:\\users\\rdhj0cnfevzx\\desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe" page_root = "0x2a5f8000" os_pid = "0x8f4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x1204" cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe\"" cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fe14" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 696 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 697 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 698 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 699 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 700 start_va = 0xa0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 701 start_va = 0x1a0000 end_va = 0x1a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 702 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 703 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 704 start_va = 0x400000 end_va = 0x49ffff monitored = 1 entry_point = 0x49e00a region_type = mapped_file name = "c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe") Region: id = 705 start_va = 0x77830000 end_va = 0x779aafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 706 start_va = 0x7ffb0000 end_va = 0x7ffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 707 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 708 start_va = 0x7fff0000 end_va = 0x7ffdab58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 709 start_va = 0x7ffdab590000 end_va = 0x7ffdab750fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 710 start_va = 0x7ffdab751000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffdab751000" filename = "" Region: id = 711 start_va = 0x400000 end_va = 0x439fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 712 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 713 start_va = 0x639e0000 end_va = 0x63a2ffff monitored = 0 entry_point = 0x639f8180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 714 start_va = 0x63a40000 end_va = 0x63ab9fff monitored = 0 entry_point = 0x63a53290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 715 start_va = 0x74580000 end_va = 0x7465ffff monitored = 0 entry_point = 0x74593980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 716 start_va = 0x63a30000 end_va = 0x63a37fff monitored = 0 entry_point = 0x63a317c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 717 start_va = 0x4b0000 end_va = 0x60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 718 start_va = 0x6cba0000 end_va = 0x6cbf8fff monitored = 1 entry_point = 0x6cbb0780 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 721 start_va = 0x74580000 end_va = 0x7465ffff monitored = 0 entry_point = 0x74593980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 722 start_va = 0x77420000 end_va = 0x7759dfff monitored = 0 entry_point = 0x774d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 723 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 724 start_va = 0x7feb0000 end_va = 0x7ffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 725 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 726 start_va = 0x610000 end_va = 0x6cdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 727 start_va = 0x744b0000 end_va = 0x74541fff monitored = 0 entry_point = 0x744f0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 728 start_va = 0x7fb00000 end_va = 0x7fea0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 729 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 730 start_va = 0x6c320000 end_va = 0x6c583fff monitored = 0 entry_point = 0x6c350d00 region_type = mapped_file name = "acgenral.dll" filename = "\\Windows\\AppPatch\\AcGenral.dll" (normalized: "c:\\windows\\apppatch\\acgenral.dll") Region: id = 731 start_va = 0x74db0000 end_va = 0x74e6dfff monitored = 0 entry_point = 0x74de5630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 732 start_va = 0x757e0000 end_va = 0x75823fff monitored = 0 entry_point = 0x757f9d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 733 start_va = 0x759b0000 end_va = 0x75a5cfff monitored = 0 entry_point = 0x759c4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 734 start_va = 0x74560000 end_va = 0x7457dfff monitored = 0 entry_point = 0x7456b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 735 start_va = 0x74550000 end_va = 0x74559fff monitored = 0 entry_point = 0x74552a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 736 start_va = 0x777d0000 end_va = 0x77827fff monitored = 0 entry_point = 0x778125c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 737 start_va = 0x77680000 end_va = 0x776c4fff monitored = 0 entry_point = 0x7769de90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 738 start_va = 0x75bf0000 end_va = 0x75dacfff monitored = 0 entry_point = 0x75cd2a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 739 start_va = 0x771b0000 end_va = 0x772fefff monitored = 0 entry_point = 0x77266820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 740 start_va = 0x75640000 end_va = 0x75786fff monitored = 0 entry_point = 0x75651cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 741 start_va = 0x753d0000 end_va = 0x754bafff monitored = 0 entry_point = 0x7540d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 742 start_va = 0x74660000 end_va = 0x746f1fff monitored = 0 entry_point = 0x74698cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 743 start_va = 0x75db0000 end_va = 0x771aefff monitored = 0 entry_point = 0x75f6b990 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 744 start_va = 0x77640000 end_va = 0x77676fff monitored = 0 entry_point = 0x77643b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 745 start_va = 0x74ed0000 end_va = 0x753c8fff monitored = 0 entry_point = 0x750d7610 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 746 start_va = 0x74810000 end_va = 0x7488afff monitored = 0 entry_point = 0x7482e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 747 start_va = 0x77730000 end_va = 0x7773bfff monitored = 0 entry_point = 0x77733930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 748 start_va = 0x77390000 end_va = 0x7741cfff monitored = 0 entry_point = 0x773d9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 749 start_va = 0x74e70000 end_va = 0x74eb3fff monitored = 0 entry_point = 0x74e77410 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 750 start_va = 0x77320000 end_va = 0x7732efff monitored = 0 entry_point = 0x77322e40 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 753 start_va = 0x70610000 end_va = 0x70684fff monitored = 0 entry_point = 0x70649a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 754 start_va = 0x6cb10000 end_va = 0x6cb33fff monitored = 0 entry_point = 0x6cb14820 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\SysWOW64\\winmm.dll" (normalized: "c:\\windows\\syswow64\\winmm.dll") Region: id = 755 start_va = 0x6caf0000 end_va = 0x6cb04fff monitored = 0 entry_point = 0x6caf5210 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\SysWOW64\\samcli.dll" (normalized: "c:\\windows\\syswow64\\samcli.dll") Region: id = 756 start_va = 0x6cad0000 end_va = 0x6cae7fff monitored = 0 entry_point = 0x6cad3f70 region_type = mapped_file name = "msacm32.dll" filename = "\\Windows\\SysWOW64\\msacm32.dll" (normalized: "c:\\windows\\syswow64\\msacm32.dll") Region: id = 757 start_va = 0x6cb90000 end_va = 0x6cb97fff monitored = 0 entry_point = 0x6cb917b0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 758 start_va = 0x705f0000 end_va = 0x70608fff monitored = 0 entry_point = 0x705f47e0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll") Region: id = 759 start_va = 0x6fef0000 end_va = 0x6ff0cfff monitored = 0 entry_point = 0x6fef3b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 760 start_va = 0x717f0000 end_va = 0x7196dfff monitored = 0 entry_point = 0x7186c630 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 761 start_va = 0x6ca60000 end_va = 0x6cac6fff monitored = 0 entry_point = 0x6ca75a00 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\SysWOW64\\winspool.drv" (normalized: "c:\\windows\\syswow64\\winspool.drv") Region: id = 762 start_va = 0x6ca40000 end_va = 0x6ca55fff monitored = 0 entry_point = 0x6ca421d0 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 763 start_va = 0x6ca10000 end_va = 0x6ca32fff monitored = 0 entry_point = 0x6ca18940 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\SysWOW64\\winmmbase.dll" (normalized: "c:\\windows\\syswow64\\winmmbase.dll") Region: id = 764 start_va = 0x720c0000 end_va = 0x7238afff monitored = 0 entry_point = 0x722fc4c0 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 765 start_va = 0x74200000 end_va = 0x7421afff monitored = 0 entry_point = 0x74209050 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 766 start_va = 0x6d0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 767 start_va = 0x6c790000 end_va = 0x6ca07fff monitored = 0 entry_point = 0x6c7a5e90 region_type = mapped_file name = "aclayers.dll" filename = "\\Windows\\AppPatch\\AcLayers.dll" (normalized: "c:\\windows\\apppatch\\aclayers.dll") Region: id = 768 start_va = 0x74890000 end_va = 0x74c9afff monitored = 0 entry_point = 0x748badf0 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 769 start_va = 0x66680000 end_va = 0x66682fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sfc.dll" filename = "\\Windows\\SysWOW64\\sfc.dll" (normalized: "c:\\windows\\syswow64\\sfc.dll") Region: id = 770 start_va = 0x6c780000 end_va = 0x6c78efff monitored = 0 entry_point = 0x6c7863e0 region_type = mapped_file name = "sfc_os.dll" filename = "\\Windows\\SysWOW64\\sfc_os.dll" (normalized: "c:\\windows\\syswow64\\sfc_os.dll") Region: id = 771 start_va = 0x1c0000 end_va = 0x1e9fff monitored = 0 entry_point = 0x1c5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 772 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 773 start_va = 0x800000 end_va = 0x987fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 774 start_va = 0x77740000 end_va = 0x7776afff monitored = 0 entry_point = 0x77745680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 775 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 776 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 777 start_va = 0x440000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 778 start_va = 0x990000 end_va = 0xb10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000990000" filename = "" Region: id = 779 start_va = 0xb20000 end_va = 0x1f1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b20000" filename = "" Region: id = 780 start_va = 0x1d0000 end_va = 0x1d3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 781 start_va = 0x6c700000 end_va = 0x6c778fff monitored = 1 entry_point = 0x6c70f82a region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 782 start_va = 0x6d0000 end_va = 0x768fff monitored = 1 entry_point = 0x76e00a region_type = mapped_file name = "c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe") Region: id = 783 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 784 start_va = 0x6bc60000 end_va = 0x6c310fff monitored = 1 entry_point = 0x6bc75d20 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 785 start_va = 0x440000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 786 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 787 start_va = 0x6d0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 788 start_va = 0x6c600000 end_va = 0x6c6f4fff monitored = 0 entry_point = 0x6c654160 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll") Region: id = 789 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 790 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 791 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 792 start_va = 0x510000 end_va = 0x60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 793 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 794 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 795 start_va = 0x4e0000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 796 start_va = 0x4f0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 797 start_va = 0x500000 end_va = 0x500fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 798 start_va = 0x7d0000 end_va = 0x7d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 799 start_va = 0x1f20000 end_va = 0x1f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f20000" filename = "" Region: id = 800 start_va = 0x1f70000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 801 start_va = 0x1f20000 end_va = 0x1f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f20000" filename = "" Region: id = 802 start_va = 0x1f60000 end_va = 0x1f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f60000" filename = "" Region: id = 803 start_va = 0x1fe0000 end_va = 0x20dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fe0000" filename = "" Region: id = 804 start_va = 0x7e0000 end_va = 0x7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007e0000" filename = "" Region: id = 805 start_va = 0x20e0000 end_va = 0x40dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 806 start_va = 0x40e0000 end_va = 0x417ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000040e0000" filename = "" Region: id = 807 start_va = 0x1f70000 end_va = 0x1faffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 808 start_va = 0x1fd0000 end_va = 0x1fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 809 start_va = 0x4180000 end_va = 0x427ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004180000" filename = "" Region: id = 810 start_va = 0x4280000 end_va = 0x45b6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 811 start_va = 0x6aa30000 end_va = 0x6bc57fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\8062d427acd64e37f4fded7b00f4a869\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\8062d427acd64e37f4fded7b00f4a869\\mscorlib.ni.dll") Region: id = 812 start_va = 0x7e0000 end_va = 0x7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007e0000" filename = "" Region: id = 813 start_va = 0x1fb0000 end_va = 0x1fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fb0000" filename = "" Region: id = 814 start_va = 0x6a9b0000 end_va = 0x6aa2dfff monitored = 1 entry_point = 0x6a9b1140 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 815 start_va = 0x1fc0000 end_va = 0x1fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fc0000" filename = "" Region: id = 816 start_va = 0x6a000000 end_va = 0x6a9abfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\cc4e5d110dd318e8b7d61a9ed184ab74\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\cc4e5d110dd318e8b7d61a9ed184ab74\\system.ni.dll") Region: id = 817 start_va = 0x69e70000 end_va = 0x69ffcfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\9b645a48c9bcfc95aaadf6a069bb4ebe\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\9b645a48c9bcfc95aaadf6a069bb4ebe\\system.drawing.ni.dll") Region: id = 818 start_va = 0x69210000 end_va = 0x69e68fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\8cd2187094ba6cade0ca0fab4f932654\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\8cd2187094ba6cade0ca0fab4f932654\\system.windows.forms.ni.dll") Region: id = 819 start_va = 0x68af0000 end_va = 0x69201fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\abad45b9cc652ba7e38c4c837234c0ab\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\abad45b9cc652ba7e38c4c837234c0ab\\system.core.ni.dll") Region: id = 820 start_va = 0x68a00000 end_va = 0x68aeefff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\1b51e779650e38bb712f3e535efcf132\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\1b51e779650e38bb712f3e535efcf132\\system.configuration.ni.dll") Region: id = 821 start_va = 0x682e0000 end_va = 0x689f5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\1f87b5140145c221b5201351fffc52d8\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\1f87b5140145c221b5201351fffc52d8\\system.xml.ni.dll") Region: id = 822 start_va = 0x45c0000 end_va = 0x46cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000045c0000" filename = "" Region: id = 823 start_va = 0x5e430000 end_va = 0x5e4cbfff monitored = 1 entry_point = 0x5e4be9b2 region_type = mapped_file name = "microsoft.visualbasic.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\microsoft.visualbasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\microsoft.visualbasic.dll") Region: id = 824 start_va = 0x45c0000 end_va = 0x465bfff monitored = 1 entry_point = 0x464e9b2 region_type = mapped_file name = "microsoft.visualbasic.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\microsoft.visualbasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\microsoft.visualbasic.dll") Region: id = 825 start_va = 0x46c0000 end_va = 0x46cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000046c0000" filename = "" Region: id = 826 start_va = 0x46d0000 end_va = 0x47cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000046d0000" filename = "" Region: id = 827 start_va = 0x4660000 end_va = 0x466ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004660000" filename = "" Region: id = 828 start_va = 0x4670000 end_va = 0x467ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004670000" filename = "" Region: id = 829 start_va = 0x4660000 end_va = 0x466ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004660000" filename = "" Region: id = 830 start_va = 0x4680000 end_va = 0x468ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004680000" filename = "" Region: id = 831 start_va = 0x4660000 end_va = 0x466ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004660000" filename = "" Region: id = 832 start_va = 0x4660000 end_va = 0x466ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004660000" filename = "" Region: id = 833 start_va = 0x4660000 end_va = 0x466ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004660000" filename = "" Region: id = 834 start_va = 0x4660000 end_va = 0x466ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004660000" filename = "" Region: id = 835 start_va = 0x4660000 end_va = 0x466ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004660000" filename = "" Region: id = 836 start_va = 0x4660000 end_va = 0x466ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004660000" filename = "" Region: id = 837 start_va = 0x4660000 end_va = 0x466ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004660000" filename = "" Region: id = 838 start_va = 0x4660000 end_va = 0x466ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004660000" filename = "" Region: id = 839 start_va = 0x4660000 end_va = 0x4660fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004660000" filename = "" Region: id = 840 start_va = 0x70410000 end_va = 0x70422fff monitored = 0 entry_point = 0x70419950 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 841 start_va = 0x703e0000 end_va = 0x7040efff monitored = 0 entry_point = 0x703f95e0 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 842 start_va = 0x4680000 end_va = 0x46bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004680000" filename = "" Region: id = 843 start_va = 0x47d0000 end_va = 0x48cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000047d0000" filename = "" Region: id = 844 start_va = 0x48d0000 end_va = 0x490ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048d0000" filename = "" Region: id = 845 start_va = 0x4910000 end_va = 0x4a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004910000" filename = "" Region: id = 846 start_va = 0x4a10000 end_va = 0x4a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a10000" filename = "" Region: id = 847 start_va = 0x4a50000 end_va = 0x4b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a50000" filename = "" Region: id = 848 start_va = 0x4b50000 end_va = 0x4b50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004b50000" filename = "" Region: id = 849 start_va = 0x74d20000 end_va = 0x74da3fff monitored = 0 entry_point = 0x74d46220 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 850 start_va = 0x4b60000 end_va = 0x4b60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004b60000" filename = "" Region: id = 851 start_va = 0x6c5b0000 end_va = 0x6c5f1fff monitored = 1 entry_point = 0x6c5bf380 region_type = mapped_file name = "wbemdisp.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemdisp.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemdisp.dll") Region: id = 852 start_va = 0x68270000 end_va = 0x682d6fff monitored = 0 entry_point = 0x6828b610 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 853 start_va = 0x75b90000 end_va = 0x75beefff monitored = 0 entry_point = 0x75b94af0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 854 start_va = 0x6c5a0000 end_va = 0x6c5acfff monitored = 0 entry_point = 0x6c5a3520 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 855 start_va = 0x68250000 end_va = 0x6826bfff monitored = 0 entry_point = 0x6825aa90 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\SysWOW64\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wmiutils.dll") Region: id = 1235 start_va = 0x68230000 end_va = 0x68240fff monitored = 0 entry_point = 0x68238fa0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 1236 start_va = 0x68170000 end_va = 0x6822efff monitored = 0 entry_point = 0x681a1e80 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 1237 start_va = 0x680e0000 end_va = 0x68160fff monitored = 0 entry_point = 0x680fb260 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll") Region: id = 1238 start_va = 0x4b70000 end_va = 0x4b7efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wbemdisp.tlb" filename = "\\Windows\\SysWOW64\\wbem\\wbemdisp.tlb" (normalized: "c:\\windows\\syswow64\\wbem\\wbemdisp.tlb") Region: id = 1239 start_va = 0x4b80000 end_va = 0x4b81fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004b80000" filename = "" Region: id = 1240 start_va = 0x4b90000 end_va = 0x4b90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004b90000" filename = "" Region: id = 1241 start_va = 0x4ba0000 end_va = 0x4c7ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 1242 start_va = 0x4c80000 end_va = 0x4c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c80000" filename = "" Region: id = 1243 start_va = 0x4c80000 end_va = 0x4c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c80000" filename = "" Region: id = 1244 start_va = 0x4c80000 end_va = 0x4c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c80000" filename = "" Region: id = 1245 start_va = 0x4c80000 end_va = 0x4c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c80000" filename = "" Region: id = 1246 start_va = 0x4c80000 end_va = 0x4c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c80000" filename = "" Region: id = 1247 start_va = 0x4c80000 end_va = 0x4c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c80000" filename = "" Region: id = 1248 start_va = 0x4c80000 end_va = 0x4c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c80000" filename = "" Region: id = 1249 start_va = 0x4c80000 end_va = 0x4c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c80000" filename = "" Region: id = 1250 start_va = 0x4c80000 end_va = 0x4c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c80000" filename = "" Region: id = 1251 start_va = 0x4c80000 end_va = 0x4c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c80000" filename = "" Region: id = 1252 start_va = 0x4c80000 end_va = 0x4c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c80000" filename = "" Region: id = 1253 start_va = 0x4c80000 end_va = 0x4c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c80000" filename = "" Region: id = 1254 start_va = 0x4c80000 end_va = 0x4c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c80000" filename = "" Region: id = 1255 start_va = 0x4c80000 end_va = 0x4c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c80000" filename = "" Region: id = 1256 start_va = 0x4c80000 end_va = 0x4c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c80000" filename = "" Region: id = 1257 start_va = 0x4c90000 end_va = 0x4c9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c90000" filename = "" Region: id = 1258 start_va = 0x4c90000 end_va = 0x4c9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c90000" filename = "" Region: id = 1259 start_va = 0x4c90000 end_va = 0x4c9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c90000" filename = "" Region: id = 1260 start_va = 0x4c80000 end_va = 0x4c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c80000" filename = "" Region: id = 1261 start_va = 0x4c80000 end_va = 0x4c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c80000" filename = "" Region: id = 1262 start_va = 0x4c80000 end_va = 0x4c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c80000" filename = "" Region: id = 1263 start_va = 0x4c80000 end_va = 0x4c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c80000" filename = "" Region: id = 1264 start_va = 0x4c80000 end_va = 0x4c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c80000" filename = "" Region: id = 1265 start_va = 0x4c80000 end_va = 0x4c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c80000" filename = "" Region: id = 1356 start_va = 0x680c0000 end_va = 0x680d7fff monitored = 1 entry_point = 0x680c5480 region_type = mapped_file name = "custommarshalers.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\custommarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\custommarshalers.dll") Region: id = 1357 start_va = 0x4c80000 end_va = 0x4c97fff monitored = 1 entry_point = 0x4c85480 region_type = mapped_file name = "custommarshalers.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\custommarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\custommarshalers.dll") Region: id = 1358 start_va = 0x4ca0000 end_va = 0x4caffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ca0000" filename = "" Region: id = 1359 start_va = 0x680c0000 end_va = 0x680d7fff monitored = 1 entry_point = 0x680c5480 region_type = mapped_file name = "custommarshalers.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\custommarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\custommarshalers.dll") Region: id = 1360 start_va = 0x4cb0000 end_va = 0x4cc7fff monitored = 1 entry_point = 0x4cb5480 region_type = mapped_file name = "custommarshalers.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\custommarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\custommarshalers.dll") Region: id = 1361 start_va = 0x4cb0000 end_va = 0x4cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cb0000" filename = "" Region: id = 1362 start_va = 0x4cc0000 end_va = 0x4ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cc0000" filename = "" Region: id = 1363 start_va = 0x4cc0000 end_va = 0x4ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cc0000" filename = "" Region: id = 1364 start_va = 0x4cc0000 end_va = 0x4ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cc0000" filename = "" Region: id = 1365 start_va = 0x4cc0000 end_va = 0x4cc4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\SysWOW64\\stdole2.tlb" (normalized: "c:\\windows\\syswow64\\stdole2.tlb") Region: id = 1366 start_va = 0x4cd0000 end_va = 0x4cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 1367 start_va = 0x4cd0000 end_va = 0x4cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 1368 start_va = 0x4cd0000 end_va = 0x4cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 1369 start_va = 0x4cd0000 end_va = 0x4cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 1370 start_va = 0x4cd0000 end_va = 0x4cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 1371 start_va = 0x4cd0000 end_va = 0x4cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 1372 start_va = 0x4cd0000 end_va = 0x4cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 1373 start_va = 0x4cd0000 end_va = 0x4cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 1374 start_va = 0x4cd0000 end_va = 0x4cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 1375 start_va = 0x4cd0000 end_va = 0x4cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 1376 start_va = 0x4cd0000 end_va = 0x4cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 1377 start_va = 0x4cd0000 end_va = 0x4cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 1378 start_va = 0x4ce0000 end_va = 0x4ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ce0000" filename = "" Region: id = 1379 start_va = 0x4ce0000 end_va = 0x4ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ce0000" filename = "" Region: id = 1380 start_va = 0x4ce0000 end_va = 0x4ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ce0000" filename = "" Region: id = 1381 start_va = 0x67fa0000 end_va = 0x680bbfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\d2f554a0c84513cd793fdcd77a86dab1\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.management\\d2f554a0c84513cd793fdcd77a86dab1\\system.management.ni.dll") Region: id = 1382 start_va = 0x4cd0000 end_va = 0x4d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 1383 start_va = 0x4d10000 end_va = 0x4e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d10000" filename = "" Region: id = 1384 start_va = 0x7fe60000 end_va = 0x7feaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fe60000" filename = "" Region: id = 1385 start_va = 0x7fe50000 end_va = 0x7fe5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fe50000" filename = "" Region: id = 1386 start_va = 0x4e10000 end_va = 0x4e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 1387 start_va = 0x4e50000 end_va = 0x4f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e50000" filename = "" Region: id = 1388 start_va = 0x6c590000 end_va = 0x6c599fff monitored = 1 entry_point = 0x6c5939f9 region_type = mapped_file name = "wminet_utils.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WMINet_Utils.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\wminet_utils.dll") Region: id = 1389 start_va = 0x4f50000 end_va = 0x4f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f50000" filename = "" Region: id = 1390 start_va = 0x4f50000 end_va = 0x4f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f50000" filename = "" Region: id = 1391 start_va = 0x4f50000 end_va = 0x4f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f50000" filename = "" Region: id = 1392 start_va = 0x4e10000 end_va = 0x4e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 1393 start_va = 0x4e50000 end_va = 0x4f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e50000" filename = "" Region: id = 1394 start_va = 0x4f50000 end_va = 0x4f54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004f50000" filename = "" Region: id = 1818 start_va = 0x4f50000 end_va = 0x4f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f50000" filename = "" Region: id = 1819 start_va = 0x4f90000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f90000" filename = "" Region: id = 1820 start_va = 0x4f50000 end_va = 0x4f62fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004f50000" filename = "" Region: id = 1830 start_va = 0x4f50000 end_va = 0x4f52fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004f50000" filename = "" Region: id = 1831 start_va = 0x4f50000 end_va = 0x504ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f50000" filename = "" Region: id = 1832 start_va = 0x5050000 end_va = 0x505ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005050000" filename = "" Region: id = 1833 start_va = 0x5050000 end_va = 0x505ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005050000" filename = "" Region: id = 1834 start_va = 0x5050000 end_va = 0x505ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005050000" filename = "" Region: id = 1835 start_va = 0x5050000 end_va = 0x505ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005050000" filename = "" Region: id = 1836 start_va = 0x5050000 end_va = 0x505ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005050000" filename = "" Region: id = 1837 start_va = 0x5050000 end_va = 0x505ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005050000" filename = "" Region: id = 1838 start_va = 0x5050000 end_va = 0x505ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005050000" filename = "" Region: id = 1839 start_va = 0x5050000 end_va = 0x505ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005050000" filename = "" Region: id = 1840 start_va = 0x5050000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005050000" filename = "" Region: id = 1841 start_va = 0x5090000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1842 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1843 start_va = 0x705a0000 end_va = 0x705c7fff monitored = 0 entry_point = 0x705a7820 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 1844 start_va = 0x50d0000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1845 start_va = 0x5110000 end_va = 0x520ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005110000" filename = "" Region: id = 1846 start_va = 0x5210000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1847 start_va = 0x5250000 end_va = 0x528ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005250000" filename = "" Region: id = 1848 start_va = 0x67f20000 end_va = 0x67f90fff monitored = 0 entry_point = 0x67f769e0 region_type = mapped_file name = "efswrt.dll" filename = "\\Windows\\SysWOW64\\efswrt.dll" (normalized: "c:\\windows\\syswow64\\efswrt.dll") Region: id = 1849 start_va = 0x74130000 end_va = 0x741f7fff monitored = 0 entry_point = 0x7419ae90 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\SysWOW64\\WinTypes.dll" (normalized: "c:\\windows\\syswow64\\wintypes.dll") Region: id = 1850 start_va = 0x67ed0000 end_va = 0x67f18fff monitored = 0 entry_point = 0x67ed6450 region_type = mapped_file name = "edputil.dll" filename = "\\Windows\\SysWOW64\\edputil.dll" (normalized: "c:\\windows\\syswow64\\edputil.dll") Region: id = 1851 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 1852 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1853 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 1854 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1855 start_va = 0x52b0000 end_va = 0x52bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052b0000" filename = "" Region: id = 1856 start_va = 0x52c0000 end_va = 0x52cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052c0000" filename = "" Region: id = 1857 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1858 start_va = 0x52e0000 end_va = 0x52effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052e0000" filename = "" Region: id = 1859 start_va = 0x52f0000 end_va = 0x52fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052f0000" filename = "" Region: id = 1860 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 1861 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 1862 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 1863 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 1864 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1865 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1866 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1867 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 1868 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 1869 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 1870 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 1871 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 1872 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 1873 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 1874 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 1875 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 1876 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 1877 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 1878 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1879 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1880 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1881 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1882 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1883 start_va = 0x52b0000 end_va = 0x52bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052b0000" filename = "" Region: id = 1884 start_va = 0x52c0000 end_va = 0x52cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052c0000" filename = "" Region: id = 1885 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1886 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 1887 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 1888 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 1889 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1890 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1891 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1892 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1893 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1894 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1895 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1896 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1897 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1898 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1899 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1900 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1901 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1902 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1903 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1904 start_va = 0x52b0000 end_va = 0x52bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052b0000" filename = "" Region: id = 1905 start_va = 0x52b0000 end_va = 0x52bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052b0000" filename = "" Region: id = 1906 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1907 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1908 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1909 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1910 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1911 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1912 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1913 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1914 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1915 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1916 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1917 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1918 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1919 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1920 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1921 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1922 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1923 start_va = 0x5220000 end_va = 0x522ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 1924 start_va = 0x5220000 end_va = 0x522ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 1925 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1926 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1927 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1928 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1929 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1930 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1931 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1932 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1933 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1934 start_va = 0x5220000 end_va = 0x522ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 1935 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1936 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1937 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1938 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1939 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1940 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1941 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1942 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1943 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1944 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1945 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1946 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1947 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1948 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1949 start_va = 0x5220000 end_va = 0x522ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 1950 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1951 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1952 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1953 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1954 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1955 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1956 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1957 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1958 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1959 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1960 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1961 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1962 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1963 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1964 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1965 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1966 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1967 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1968 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1969 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1970 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1971 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1972 start_va = 0x5220000 end_va = 0x522ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 1973 start_va = 0x5230000 end_va = 0x523ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 1974 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1975 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1976 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1977 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1978 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1979 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1980 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1981 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1982 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1983 start_va = 0x5220000 end_va = 0x522ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 1984 start_va = 0x5230000 end_va = 0x523ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 1985 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1986 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1987 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1988 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1989 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1990 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1991 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1992 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1993 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1994 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1995 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1996 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1997 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1998 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 1999 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2000 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2001 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2002 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2003 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2004 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2005 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2006 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2007 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2008 start_va = 0x5220000 end_va = 0x522ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 2009 start_va = 0x5220000 end_va = 0x522ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 2010 start_va = 0x5230000 end_va = 0x523ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 2011 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2012 start_va = 0x5250000 end_va = 0x525ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005250000" filename = "" Region: id = 2013 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2014 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2015 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2016 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2017 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2018 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2019 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2020 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2021 start_va = 0x5220000 end_va = 0x522ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 2022 start_va = 0x5220000 end_va = 0x522ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 2023 start_va = 0x5230000 end_va = 0x523ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 2024 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2025 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2026 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2027 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2028 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2029 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2030 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2031 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2032 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2033 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2034 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2035 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2036 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2037 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2038 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2039 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2040 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2041 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2042 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2043 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2044 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2045 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2046 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2047 start_va = 0x5220000 end_va = 0x522ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 2048 start_va = 0x5220000 end_va = 0x522ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 2049 start_va = 0x5230000 end_va = 0x523ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 2050 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2051 start_va = 0x5220000 end_va = 0x522ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 2052 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2053 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2054 start_va = 0x5220000 end_va = 0x522ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 2055 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2056 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2057 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2058 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2059 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2060 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2061 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2062 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2063 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2064 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2065 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2066 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2067 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2068 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2069 start_va = 0x5220000 end_va = 0x522ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 2070 start_va = 0x5220000 end_va = 0x522ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 2071 start_va = 0x5230000 end_va = 0x523ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 2072 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2073 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2074 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2075 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2076 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2077 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2078 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2079 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2080 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2081 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2082 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2083 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2084 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2085 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2086 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2087 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2088 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2089 start_va = 0x5220000 end_va = 0x522ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 2090 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2091 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2092 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2093 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2094 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2095 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2096 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2097 start_va = 0x5220000 end_va = 0x522ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 2098 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2099 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2100 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2101 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2102 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2103 start_va = 0x5210000 end_va = 0x5210fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 2104 start_va = 0x5210000 end_va = 0x5218fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 2105 start_va = 0x5210000 end_va = 0x5210fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 2106 start_va = 0x5210000 end_va = 0x5218fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 2107 start_va = 0x5210000 end_va = 0x5210fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 2108 start_va = 0x5210000 end_va = 0x5218fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 2109 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2110 start_va = 0x5220000 end_va = 0x522ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 2111 start_va = 0x5230000 end_va = 0x523ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 2112 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2113 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2114 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2115 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2116 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2117 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2118 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2119 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2120 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2121 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2122 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2123 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2124 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2125 start_va = 0x5250000 end_va = 0x525ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005250000" filename = "" Region: id = 2126 start_va = 0x5260000 end_va = 0x526ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005260000" filename = "" Region: id = 2127 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2128 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2129 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2130 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2131 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2132 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2133 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2134 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2135 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2136 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2137 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2138 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2139 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2140 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2141 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2142 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2143 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2144 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2145 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2146 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2147 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2148 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2149 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2150 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2151 start_va = 0x5250000 end_va = 0x525ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005250000" filename = "" Region: id = 2152 start_va = 0x5260000 end_va = 0x526ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005260000" filename = "" Region: id = 2153 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2154 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2155 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2156 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2157 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2158 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2159 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2160 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2161 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2162 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2163 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2164 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2165 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2166 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2167 start_va = 0x52a0000 end_va = 0x5301fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll") Region: id = 2168 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2169 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2170 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2171 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2172 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2173 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2174 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2175 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2176 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2177 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2178 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2179 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2180 start_va = 0x5250000 end_va = 0x525ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005250000" filename = "" Region: id = 2181 start_va = 0x5260000 end_va = 0x526ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005260000" filename = "" Region: id = 2182 start_va = 0x5270000 end_va = 0x527ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005270000" filename = "" Region: id = 2183 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2184 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2185 start_va = 0x5250000 end_va = 0x525ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005250000" filename = "" Region: id = 2186 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2187 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2188 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2189 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2190 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2191 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2192 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2193 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2194 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2195 start_va = 0x5250000 end_va = 0x525ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005250000" filename = "" Region: id = 2196 start_va = 0x5260000 end_va = 0x526ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005260000" filename = "" Region: id = 2197 start_va = 0x5270000 end_va = 0x527ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005270000" filename = "" Region: id = 2198 start_va = 0x5280000 end_va = 0x528ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005280000" filename = "" Region: id = 2199 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2200 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2201 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2202 start_va = 0x5250000 end_va = 0x525ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005250000" filename = "" Region: id = 2203 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2204 start_va = 0x6cc80000 end_va = 0x6ccb9fff monitored = 0 entry_point = 0x6cc99be0 region_type = mapped_file name = "vaultcli.dll" filename = "\\Windows\\SysWOW64\\vaultcli.dll" (normalized: "c:\\windows\\syswow64\\vaultcli.dll") Region: id = 2205 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2206 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2207 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2208 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2209 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2210 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2211 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2212 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2213 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2214 start_va = 0x5250000 end_va = 0x525ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005250000" filename = "" Region: id = 2215 start_va = 0x67e10000 end_va = 0x67ec5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.security.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Security\\4e4cb6e2e651b6d243241e4edd14b3f3\\System.Security.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.security\\4e4cb6e2e651b6d243241e4edd14b3f3\\system.security.ni.dll") Region: id = 2216 start_va = 0x75830000 end_va = 0x759a7fff monitored = 0 entry_point = 0x75888a90 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 2217 start_va = 0x754c0000 end_va = 0x754cdfff monitored = 0 entry_point = 0x754c5410 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 2218 start_va = 0x70430000 end_va = 0x70437fff monitored = 0 entry_point = 0x70431d70 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\SysWOW64\\dpapi.dll" (normalized: "c:\\windows\\syswow64\\dpapi.dll") Region: id = 2219 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2220 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2221 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2222 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2223 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2224 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2225 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2226 start_va = 0x5210000 end_va = 0x521ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 2227 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2228 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2229 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2230 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2231 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2232 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2233 start_va = 0x5310000 end_va = 0x534ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005310000" filename = "" Region: id = 2234 start_va = 0x5350000 end_va = 0x544ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005350000" filename = "" Region: id = 2236 start_va = 0x4b70000 end_va = 0x4b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b70000" filename = "" Region: id = 2237 start_va = 0x4b70000 end_va = 0x4b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b70000" filename = "" Region: id = 2238 start_va = 0x4b70000 end_va = 0x4b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b70000" filename = "" Region: id = 2239 start_va = 0x5310000 end_va = 0x534ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005310000" filename = "" Region: id = 2240 start_va = 0x5350000 end_va = 0x544ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005350000" filename = "" Region: id = 2246 start_va = 0x4b70000 end_va = 0x4b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b70000" filename = "" Region: id = 2247 start_va = 0x4b70000 end_va = 0x4b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b70000" filename = "" Region: id = 2248 start_va = 0x4cc0000 end_va = 0x4ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cc0000" filename = "" Region: id = 2249 start_va = 0x4cc0000 end_va = 0x4ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cc0000" filename = "" Region: id = 2250 start_va = 0x4cc0000 end_va = 0x4ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cc0000" filename = "" Region: id = 2251 start_va = 0x4cc0000 end_va = 0x4ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cc0000" filename = "" Region: id = 2252 start_va = 0x4cc0000 end_va = 0x4ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cc0000" filename = "" Region: id = 2253 start_va = 0x71f80000 end_va = 0x71faefff monitored = 0 entry_point = 0x71f8bb70 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 2254 start_va = 0x71fb0000 end_va = 0x72033fff monitored = 0 entry_point = 0x71fd6530 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 2255 start_va = 0x74ec0000 end_va = 0x74ec6fff monitored = 0 entry_point = 0x74ec1e10 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 2256 start_va = 0x71f00000 end_va = 0x71f12fff monitored = 0 entry_point = 0x71f025d0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc6.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc6.dll") Region: id = 2257 start_va = 0x71ee0000 end_va = 0x71ef3fff monitored = 0 entry_point = 0x71ee3c10 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc.dll") Region: id = 2258 start_va = 0x70690000 end_va = 0x70697fff monitored = 0 entry_point = 0x70691fc0 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 2259 start_va = 0x5310000 end_va = 0x534ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005310000" filename = "" Region: id = 2260 start_va = 0x5350000 end_va = 0x544ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005350000" filename = "" Region: id = 2261 start_va = 0x72040000 end_va = 0x7208efff monitored = 0 entry_point = 0x7204d850 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 2262 start_va = 0x71f70000 end_va = 0x71f77fff monitored = 0 entry_point = 0x71f71920 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 2263 start_va = 0x71f20000 end_va = 0x71f66fff monitored = 0 entry_point = 0x71f358d0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 2264 start_va = 0x6cc70000 end_va = 0x6cc79fff monitored = 0 entry_point = 0x6cc73200 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 2265 start_va = 0x704c0000 end_va = 0x70523fff monitored = 0 entry_point = 0x704dafd0 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll") Region: id = 2266 start_va = 0x704b0000 end_va = 0x704bffff monitored = 0 entry_point = 0x704b4600 region_type = mapped_file name = "mskeyprotect.dll" filename = "\\Windows\\SysWOW64\\mskeyprotect.dll" (normalized: "c:\\windows\\syswow64\\mskeyprotect.dll") Region: id = 2267 start_va = 0x70490000 end_va = 0x704affff monitored = 0 entry_point = 0x7049d120 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll") Region: id = 2268 start_va = 0x70460000 end_va = 0x7048bfff monitored = 0 entry_point = 0x7047bb10 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\SysWOW64\\ntasn1.dll" (normalized: "c:\\windows\\syswow64\\ntasn1.dll") Region: id = 2269 start_va = 0x70440000 end_va = 0x70459fff monitored = 0 entry_point = 0x7044fa70 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\SysWOW64\\ncryptsslp.dll" (normalized: "c:\\windows\\syswow64\\ncryptsslp.dll") Region: id = 2270 start_va = 0x5450000 end_va = 0x548ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005450000" filename = "" Region: id = 2271 start_va = 0x5490000 end_va = 0x558ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 2272 start_va = 0x5590000 end_va = 0x598afff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005590000" filename = "" Region: id = 2273 start_va = 0x4cc0000 end_va = 0x4ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cc0000" filename = "" Region: id = 2274 start_va = 0x4cc0000 end_va = 0x4ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cc0000" filename = "" Region: id = 2275 start_va = 0x4cc0000 end_va = 0x4ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cc0000" filename = "" Region: id = 2276 start_va = 0x4cc0000 end_va = 0x4ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cc0000" filename = "" Region: id = 2277 start_va = 0x4cc0000 end_va = 0x4ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cc0000" filename = "" Region: id = 2278 start_va = 0x75a70000 end_va = 0x75b8efff monitored = 0 entry_point = 0x75ab5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2279 start_va = 0x4cc0000 end_va = 0x4ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cc0000" filename = "" Region: id = 2281 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2282 start_va = 0x4cc0000 end_va = 0x4cc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004cc0000" filename = "" Region: id = 2283 start_va = 0x5990000 end_va = 0x5a4bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005990000" filename = "" Region: id = 2284 start_va = 0x4cc0000 end_va = 0x4cc3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004cc0000" filename = "" Region: id = 2285 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2286 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2287 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2288 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2289 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2290 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2291 start_va = 0x5a50000 end_va = 0x5acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a50000" filename = "" Region: id = 2292 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2293 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2294 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2295 start_va = 0x5240000 end_va = 0x524ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 2296 start_va = 0x74800000 end_va = 0x74805fff monitored = 0 entry_point = 0x74801460 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 2297 start_va = 0x50d0000 end_va = 0x515efff monitored = 0 entry_point = 0x50ddd60 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll") Region: id = 2298 start_va = 0x67d70000 end_va = 0x67e01fff monitored = 0 entry_point = 0x67d7dd60 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll") Region: id = 2299 start_va = 0x50d0000 end_va = 0x51fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 2300 start_va = 0x50d0000 end_va = 0x50d3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 2301 start_va = 0x51f0000 end_va = 0x51fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051f0000" filename = "" Region: id = 2303 start_va = 0x50e0000 end_va = 0x50e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000050e0000" filename = "" Region: id = 2304 start_va = 0x50f0000 end_va = 0x50f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000050f0000" filename = "" Thread: id = 10 os_tid = 0x91c [0189.274] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0189.338] RoInitialize () returned 0x1 [0189.338] RoUninitialize () returned 0x0 [0190.039] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x364 [0190.039] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x368 [0190.115] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e60c | out: phkResult=0x19e60c*=0x378) returned 0x0 [0190.116] RegQueryValueExW (in: hKey=0x378, lpValueName="InstallationType", lpReserved=0x0, lpType=0x19e62c, lpData=0x0, lpcbData=0x19e628*=0x0 | out: lpType=0x19e62c*=0x1, lpData=0x0, lpcbData=0x19e628*=0xe) returned 0x0 [0190.116] RegQueryValueExW (in: hKey=0x378, lpValueName="InstallationType", lpReserved=0x0, lpType=0x19e62c, lpData=0x20e472c, lpcbData=0x19e628*=0xe | out: lpType=0x19e62c*=0x1, lpData="Client", lpcbData=0x19e628*=0xe) returned 0x0 [0190.118] RegCloseKey (hKey=0x378) returned 0x0 [0190.504] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe.config", nBufferLength=0x105, lpBuffer=0x19df70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe.config", lpFilePart=0x0) returned 0x69 [0191.043] GetCurrentProcess () returned 0xffffffff [0191.044] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e328 | out: TokenHandle=0x19e328*=0x378) returned 1 [0191.058] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x19de04, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0191.065] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19e328 | out: lpFileInformation=0x19e328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0191.066] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x19ddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0191.069] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19e328 | out: lpFileInformation=0x19e328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0191.070] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x19dd60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0191.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e254) returned 1 [0191.070] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0191.074] GetFileType (hFile=0x37c) returned 0x1 [0191.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e250) returned 1 [0191.075] GetFileType (hFile=0x37c) returned 0x1 [0191.119] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x19e31c | out: lpFileSizeHigh=0x19e31c*=0x0) returned 0x8c8f [0191.120] ReadFile (in: hFile=0x37c, lpBuffer=0x20e86a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e2d8, lpOverlapped=0x0 | out: lpBuffer=0x20e86a0*, lpNumberOfBytesRead=0x19e2d8*=0x1000, lpOverlapped=0x0) returned 1 [0191.150] ReadFile (in: hFile=0x37c, lpBuffer=0x20e86a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e174, lpOverlapped=0x0 | out: lpBuffer=0x20e86a0*, lpNumberOfBytesRead=0x19e174*=0x1000, lpOverlapped=0x0) returned 1 [0191.157] ReadFile (in: hFile=0x37c, lpBuffer=0x20e86a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e028, lpOverlapped=0x0 | out: lpBuffer=0x20e86a0*, lpNumberOfBytesRead=0x19e028*=0x1000, lpOverlapped=0x0) returned 1 [0191.162] ReadFile (in: hFile=0x37c, lpBuffer=0x20e86a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e028, lpOverlapped=0x0 | out: lpBuffer=0x20e86a0*, lpNumberOfBytesRead=0x19e028*=0x1000, lpOverlapped=0x0) returned 1 [0191.162] ReadFile (in: hFile=0x37c, lpBuffer=0x20e86a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e028, lpOverlapped=0x0 | out: lpBuffer=0x20e86a0*, lpNumberOfBytesRead=0x19e028*=0x1000, lpOverlapped=0x0) returned 1 [0191.163] ReadFile (in: hFile=0x37c, lpBuffer=0x20e86a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19df60, lpOverlapped=0x0 | out: lpBuffer=0x20e86a0*, lpNumberOfBytesRead=0x19df60*=0x1000, lpOverlapped=0x0) returned 1 [0191.174] ReadFile (in: hFile=0x37c, lpBuffer=0x20e86a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e0dc, lpOverlapped=0x0 | out: lpBuffer=0x20e86a0*, lpNumberOfBytesRead=0x19e0dc*=0x1000, lpOverlapped=0x0) returned 1 [0191.177] ReadFile (in: hFile=0x37c, lpBuffer=0x20e86a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19dff0, lpOverlapped=0x0 | out: lpBuffer=0x20e86a0*, lpNumberOfBytesRead=0x19dff0*=0x1000, lpOverlapped=0x0) returned 1 [0191.177] ReadFile (in: hFile=0x37c, lpBuffer=0x20e86a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19dff0, lpOverlapped=0x0 | out: lpBuffer=0x20e86a0*, lpNumberOfBytesRead=0x19dff0*=0xc8f, lpOverlapped=0x0) returned 1 [0191.177] ReadFile (in: hFile=0x37c, lpBuffer=0x20e86a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e0b0, lpOverlapped=0x0 | out: lpBuffer=0x20e86a0*, lpNumberOfBytesRead=0x19e0b0*=0x0, lpOverlapped=0x0) returned 1 [0191.178] CloseHandle (hObject=0x37c) returned 1 [0191.207] GetCurrentProcess () returned 0xffffffff [0191.207] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e450 | out: TokenHandle=0x19e450*=0x37c) returned 1 [0191.208] GetCurrentProcess () returned 0xffffffff [0191.208] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e450 | out: TokenHandle=0x19e450*=0x380) returned 1 [0191.209] GetCurrentProcess () returned 0xffffffff [0191.209] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e328 | out: TokenHandle=0x19e328*=0x384) returned 1 [0191.209] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe.config" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19e328 | out: lpFileInformation=0x19e328*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0191.210] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe.config", nBufferLength=0x105, lpBuffer=0x19ddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe.config", lpFilePart=0x0) returned 0x69 [0191.210] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe.config" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19e328 | out: lpFileInformation=0x19e328*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0191.212] GetCurrentProcess () returned 0xffffffff [0191.212] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e450 | out: TokenHandle=0x19e450*=0x388) returned 1 [0191.216] GetCurrentProcess () returned 0xffffffff [0191.216] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e450 | out: TokenHandle=0x19e450*=0x38c) returned 1 [0191.232] GetCurrentProcess () returned 0xffffffff [0191.232] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e214 | out: TokenHandle=0x19e214*=0x390) returned 1 [0191.281] GetCurrentProcess () returned 0xffffffff [0191.281] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e228 | out: TokenHandle=0x19e228*=0x394) returned 1 [0191.305] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x19def0 | out: phkResult=0x19def0*=0x0) returned 0x2 [0191.313] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f408 | out: phkResult=0x19f408*=0x398) returned 0x0 [0191.313] RegQueryValueExW (in: hKey=0x398, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x19f424, lpData=0x0, lpcbData=0x19f420*=0x0 | out: lpType=0x19f424*=0x0, lpData=0x0, lpcbData=0x19f420*=0x0) returned 0x2 [0191.313] RegCloseKey (hKey=0x398) returned 0x0 [0191.415] GetCurrentProcessId () returned 0x8f4 [0191.416] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x19ed74 | out: lpLuid=0x19ed74*(LowPart=0x14, HighPart=0)) returned 1 [0191.418] GetCurrentProcess () returned 0xffffffff [0191.418] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x19ed70 | out: TokenHandle=0x19ed70*=0x3a8) returned 1 [0191.419] AdjustTokenPrivileges (in: TokenHandle=0x3a8, DisableAllPrivileges=0, NewState=0x2105054*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0191.419] CloseHandle (hObject=0x3a8) returned 1 [0191.433] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x30e94b0, Length=0x20000, ResultLength=0x19f454 | out: SystemInformation=0x30e94b0, ResultLength=0x19f454*=0x175d8) returned 0x0 [0191.469] GetCurrentProcessId () returned 0x8f4 [0191.472] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x30e94b0, Length=0x20000, ResultLength=0x19f444 | out: SystemInformation=0x30e94b0, ResultLength=0x19f444*=0x175d8) returned 0x0 [0191.773] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x19ee2c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0191.773] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x19ee94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0191.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f2f4) returned 1 [0191.774] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19f370 | out: lpFileInformation=0x19f370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0191.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f2f0) returned 1 [0191.881] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x19f07c | out: pfEnabled=0x19f07c) returned 0x0 [0192.028] CreateBindCtx (in: reserved=0x0, ppbc=0x19f420 | out: ppbc=0x19f420*=0x59a328) returned 0x0 [0192.029] IUnknown:QueryInterface (in: This=0x59a328, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eedc | out: ppvObject=0x19eedc*=0x59a328) returned 0x0 [0192.030] IUnknown:QueryInterface (in: This=0x59a328, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ee98 | out: ppvObject=0x19ee98*=0x0) returned 0x80004002 [0192.030] IUnknown:QueryInterface (in: This=0x59a328, riid=0x6bdafb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ecb4 | out: ppvObject=0x19ecb4*=0x0) returned 0x80004002 [0192.030] IUnknown:QueryInterface (in: This=0x59a328, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19ea8c | out: ppvObject=0x19ea8c*=0x0) returned 0x80004002 [0192.030] IUnknown:AddRef (This=0x59a328) returned 0x3 [0192.030] IUnknown:QueryInterface (in: This=0x59a328, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e7f4 | out: ppvObject=0x19e7f4*=0x0) returned 0x80004002 [0192.030] IUnknown:QueryInterface (in: This=0x59a328, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e7a4 | out: ppvObject=0x19e7a4*=0x0) returned 0x80004002 [0192.030] IUnknown:QueryInterface (in: This=0x59a328, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e7b0 | out: ppvObject=0x19e7b0*=0x0) returned 0x80004002 [0192.030] CoGetContextToken (in: pToken=0x19e810 | out: pToken=0x19e810) returned 0x0 [0192.030] CObjectContext::QueryInterface () returned 0x0 [0192.030] CObjectContext::GetCurrentApartmentType () returned 0x0 [0192.030] Release () returned 0x0 [0192.031] CoGetObjectContext (in: riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x590a1c | out: ppv=0x590a1c*=0x564088) returned 0x0 [0192.089] CoGetContextToken (in: pToken=0x19ec18 | out: pToken=0x19ec18) returned 0x0 [0192.089] IUnknown:QueryInterface (in: This=0x59a328, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eca8 | out: ppvObject=0x19eca8*=0x0) returned 0x80004002 [0192.089] IUnknown:Release (This=0x59a328) returned 0x2 [0192.089] CoGetContextToken (in: pToken=0x19f1f0 | out: pToken=0x19f1f0) returned 0x0 [0192.090] CoGetContextToken (in: pToken=0x19f150 | out: pToken=0x19f150) returned 0x0 [0192.090] IUnknown:QueryInterface (in: This=0x59a328, riid=0x19f220*(Data1=0xe, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f21c | out: ppvObject=0x19f21c*=0x59a328) returned 0x0 [0192.090] IUnknown:AddRef (This=0x59a328) returned 0x4 [0192.090] IUnknown:Release (This=0x59a328) returned 0x3 [0192.091] IUnknown:Release (This=0x59a328) returned 0x2 [0192.091] CoGetContextToken (in: pToken=0x19f268 | out: pToken=0x19f268) returned 0x0 [0192.091] IUnknown:AddRef (This=0x59a328) returned 0x3 [0192.091] MkParseDisplayName (in: pbc=0x59a328, szUserName="WinMgmts:", pchEaten=0x19f454, ppmk=0x19f40c | out: pchEaten=0x19f454, ppmk=0x19f40c*=0x5937c0) returned 0x0 [0193.639] malloc (_Size=0x80) returned 0x7f6580 [0193.644] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5909e8 [0193.644] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0193.645] DllGetClassObject (in: rclsid=0x5a7854*(Data1=0x172bddf8, Data2=0xceea, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), riid=0x75c07590*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1f8 | out: ppv=0x19f1f8*=0x5909e8) returned 0x0 [0193.645] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5909e8 [0193.645] WinMGMTS:IClassFactory:CreateInstance (in: This=0x5909e8, pUnkOuter=0x0, riid=0x753d6800*(Data1=0x11a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1a0 | out: ppvObject=0x19f1a0*=0x58ebd0) returned 0x0 [0193.646] GetVersionExW (in: lpVersionInformation=0x19ef58*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x19efb8, dwMinorVersion=0x7459234f, dwBuildNumber=0xc0150008, dwPlatformId=0x0, szCSDVersion="\쯟≵) | out: lpVersionInformation=0x19ef58*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0193.646] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Wbem\\Scripting", ulOptions=0x0, samDesired=0x1, phkResult=0x19ef50 | out: phkResult=0x19ef50*=0x420) returned 0x0 [0193.646] RegQueryValueExW (in: hKey=0x420, lpValueName="Default Impersonation Level", lpReserved=0x0, lpType=0x0, lpData=0x19ef48, lpcbData=0x19ef54*=0x4 | out: lpType=0x0, lpData=0x19ef48*=0x3, lpcbData=0x19ef54*=0x4) returned 0x0 [0193.647] RegCloseKey (hKey=0x420) returned 0x0 [0193.647] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5a8650 [0193.647] GetSystemDirectoryW (in: lpBuffer=0x5a8650, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0193.647] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\advapi32.dll", hFile=0x0, dwFlags=0x0) returned 0x74810000 [0193.647] GetProcAddress (hModule=0x74810000, lpProcName="DuplicateTokenEx") returned 0x74830ad0 [0193.647] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0193.647] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x593608 [0193.648] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x58ebd0 [0193.648] WinMGMTS:IUnknown:Release (This=0x5909e8) returned 0x0 [0193.648] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0193.648] WinMGMTS:IParseDisplayName:ParseDisplayName (in: This=0x58ebd0, pbc=0x59a328, pszDisplayName="WinMgmts:", pchEaten=0x19f3b0, ppmkOut=0x19f3ac | out: pchEaten=0x19f3b0*=0x9, ppmkOut=0x19f3ac*=0x5937c0) returned 0x0 [0193.648] ApiSetQueryApiSetPresence () returned 0x0 [0193.648] _wcsnicmp (_String1="WinMgmts:", _String2="WINMGMTS:", _MaxCount=0x9) returned 0 [0193.649] IBindCtx:GetObjectParam (in: This=0x59a328, pszKey=0x6c5b3e5c, ppunk=0x19f258 | out: ppunk=0x19f258*=0x0) returned 0x80004005 [0193.649] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5a4228 [0193.649] _wcsnicmp (_String1="", _String2="{", _MaxCount=0x1) returned -123 [0193.649] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x582188 [0193.649] ResolveDelayLoadedAPI () returned 0x75c70060 [0193.650] CoCreateInstance (in: rclsid=0x6c5b1c58*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6c5b1c48*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x5821a0 | out: ppv=0x5821a0*=0x58ea10) returned 0x0 [0193.873] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x581ca8 [0193.873] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5963e0 [0193.873] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5a4288 [0193.874] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0193.874] GetCurrentThreadId () returned 0x91c [0193.874] _wcsnicmp (_String1="", _String2="[", _MaxCount=0x1) returned -91 [0193.874] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0193.874] GetCurrentThreadId () returned 0x91c [0193.876] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Wbem\\Scripting", ulOptions=0x0, samDesired=0x1, phkResult=0x19f0cc | out: phkResult=0x19f0cc*=0x428) returned 0x0 [0193.876] RegQueryValueExW (in: hKey=0x428, lpValueName="Default Namespace", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x19f0d0*=0x0 | out: lpType=0x0, lpData=0x0, lpcbData=0x19f0d0*=0x16) returned 0x0 [0193.876] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5a41a8 [0193.876] RegQueryValueExW (in: hKey=0x428, lpValueName="Default Namespace", lpReserved=0x0, lpType=0x0, lpData=0x5a41a8, lpcbData=0x19f0d0*=0x16 | out: lpType=0x0, lpData=0x5a41a8*=0x72, lpcbData=0x19f0d0*=0x16) returned 0x0 [0193.876] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5a42a8 [0193.877] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0193.877] RegCloseKey (hKey=0x428) returned 0x0 [0193.878] CoCreateInstance (in: rclsid=0x6c5b21a8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6c5b21b8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x19f104 | out: ppv=0x19f104*=0x56c750) returned 0x0 [0194.110] SysStringLen (param_1=".") returned 0x1 [0194.110] WbemDefPath:IWbemPath:SetServer (This=0x56c750, Name=".") returned 0x0 [0194.111] CoCreateInstance (in: rclsid=0x6c5b21a8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6c5b21b8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x19f0b0 | out: ppv=0x19f0b0*=0x56ce28) returned 0x0 [0194.111] CoCreateInstance (in: rclsid=0x6c5b21a8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6c5b21b8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x19f04c | out: ppv=0x19f04c*=0x582620) returned 0x0 [0194.111] WbemDefPath:IWbemPath:SetText (This=0x582620, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0194.111] WbemDefPath:IUnknown:Release (This=0x582620) returned 0x0 [0194.111] SysStringLen (param_1="root\\cimv2") returned 0xa [0194.111] WbemDefPath:IWbemPath:SetText (This=0x56ce28, uMode=0xc, pszPath="root\\cimv2") returned 0x0 [0194.111] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x56ce28, puCount=0x19f0c8 | out: puCount=0x19f0c8*=0x2) returned 0x0 [0194.111] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x56c750) returned 0x0 [0194.111] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x56ce28, uIndex=0x0, puNameBufLength=0x19f084*=0x0, pName=0x0 | out: puNameBufLength=0x19f084*=0x5, pName=0x0) returned 0x0 [0194.111] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x590c10 [0194.111] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x56ce28, uIndex=0x0, puNameBufLength=0x19f084*=0x5, pName="" | out: puNameBufLength=0x19f084*=0x5, pName="root") returned 0x0 [0194.111] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0194.111] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x56c750, uIndex=0x0, pszName="root") returned 0x0 [0194.111] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x56ce28, uIndex=0x1, puNameBufLength=0x19f084*=0x0, pName=0x0 | out: puNameBufLength=0x19f084*=0x6, pName=0x0) returned 0x0 [0194.111] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x56eb38 [0194.111] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x56ce28, uIndex=0x1, puNameBufLength=0x19f084*=0x6, pName="祓瑳浥堮汭" | out: puNameBufLength=0x19f084*=0x6, pName="cimv2") returned 0x0 [0194.112] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0194.112] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x56c750, uIndex=0x1, pszName="cimv2") returned 0x0 [0194.112] WbemDefPath:IUnknown:Release (This=0x56ce28) returned 0x0 [0194.112] WbemDefPath:IWbemPath:GetText (in: This=0x56c750, lFlags=4, puBuffLength=0x19f0cc*=0x0, pszText=0x0 | out: puBuffLength=0x19f0cc*=0xf, pszText=0x0) returned 0x0 [0194.112] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x593ab8 [0194.112] WbemDefPath:IWbemPath:GetText (in: This=0x56c750, lFlags=4, puBuffLength=0x19f0cc*=0xf, pszText="cimv2" | out: puBuffLength=0x19f0cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0194.112] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0194.112] WbemDefPath:IUnknown:Release (This=0x56c750) returned 0x0 [0194.112] WbemLocator:IWbemLocator:ConnectServer (in: This=0x58ea10, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale=0x0, lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x19f14c | out: ppNamespace=0x19f14c*=0x560fb0) returned 0x0 [0197.640] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x56ce28 [0197.640] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x596440 [0197.640] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x59da58 [0197.640] WbemLocator:IUnknown:QueryInterface (in: This=0x560fb0, riid=0x6c5b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f13c | out: ppvObject=0x19f13c*=0x5aa8bc) returned 0x0 [0197.640] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5aa8bc, pProxy=0x560fb0, pAuthnSvc=0x19f118, pAuthzSvc=0x19f11c, pServerPrincName=0x0, pAuthnLevel=0x19f18c, pImpLevel=0x19f194, pAuthInfo=0x0, pCapabilites=0x19f120 | out: pAuthnSvc=0x19f118*=0xa, pAuthzSvc=0x19f11c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19f18c*=0x6, pImpLevel=0x19f194*=0x2, pAuthInfo=0x0, pCapabilites=0x19f120*=0x1) returned 0x0 [0197.640] WbemLocator:IUnknown:Release (This=0x5aa8bc) returned 0x1 [0197.641] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0197.641] GetCurrentThreadId () returned 0x91c [0197.641] WbemLocator:IUnknown:QueryInterface (in: This=0x560fb0, riid=0x6c5b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1b4 | out: ppvObject=0x19f1b4*=0x5aa8bc) returned 0x0 [0197.641] WbemLocator:IClientSecurity:CopyProxy (in: This=0x5aa8bc, pProxy=0x560fb0, ppCopy=0x19f1d8 | out: ppCopy=0x19f1d8*=0x560a60) returned 0x0 [0197.641] WbemLocator:IUnknown:QueryInterface (in: This=0x560a60, riid=0x6c5b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f050 | out: ppvObject=0x19f050*=0x5aa8bc) returned 0x0 [0197.641] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5aa8bc, pProxy=0x560a60, pAuthnSvc=0x19f080, pAuthzSvc=0x19f07c, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x19f080*=0xa, pAuthzSvc=0x19f07c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0197.641] WbemLocator:IUnknown:Release (This=0x5aa8bc) returned 0x3 [0197.641] WbemLocator:IUnknown:QueryInterface (in: This=0x560a60, riid=0x6c5b1f08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f034 | out: ppvObject=0x19f034*=0x5aa8e0) returned 0x0 [0197.642] WbemLocator:IUnknown:QueryInterface (in: This=0x560a60, riid=0x6c5b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f038 | out: ppvObject=0x19f038*=0x5aa8bc) returned 0x0 [0197.642] WbemLocator:IClientSecurity:SetBlanket (This=0x5aa8bc, pProxy=0x560a60, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0197.643] WbemLocator:IUnknown:Release (This=0x5aa8bc) returned 0x4 [0197.643] WbemLocator:IUnknown:Release (This=0x5aa8e0) returned 0x3 [0197.643] WbemLocator:IUnknown:Release (This=0x5aa8bc) returned 0x2 [0197.643] WbemLocator:IUnknown:AddRef (This=0x560a60) returned 0x3 [0197.643] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x596500 [0197.643] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5a41e8 [0197.643] WbemLocator:IUnknown:Release (This=0x560fb0) returned 0x2 [0197.643] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0197.643] GetCurrentThreadId () returned 0x91c [0197.644] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0197.644] GetCurrentThreadId () returned 0x91c [0197.644] WbemLocator:IUnknown:QueryInterface (in: This=0x560a60, riid=0x6c5b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1dc | out: ppvObject=0x19f1dc*=0x5aa8bc) returned 0x0 [0197.644] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5aa8bc, pProxy=0x560a60, pAuthnSvc=0x19f1c8, pAuthzSvc=0x19f1cc, pServerPrincName=0x0, pAuthnLevel=0x19f1d8, pImpLevel=0x19f1d4, pAuthInfo=0x0, pCapabilites=0x19f1d0 | out: pAuthnSvc=0x19f1c8*=0xa, pAuthzSvc=0x19f1cc*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19f1d8*=0x6, pImpLevel=0x19f1d4*=0x3, pAuthInfo=0x0, pCapabilites=0x19f1d0*=0x20) returned 0x0 [0197.644] WbemLocator:IUnknown:Release (This=0x5aa8bc) returned 0x2 [0197.644] ResolveDelayLoadedAPI () returned 0x75402060 [0197.645] CreatePointerMoniker (in: punk=0x56ce28, ppmk=0x19f3ac | out: ppmk=0x19f3ac*=0x5937c0) returned 0x0 [0197.645] IUnknown:AddRef (This=0x56ce28) returned 0x2 [0197.650] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0197.650] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0197.650] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0197.650] WbemLocator:IUnknown:Release (This=0x58ea10) returned 0x0 [0197.651] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0197.651] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0197.653] WinMGMTS:IUnknown:Release (This=0x58ebd0) returned 0x0 [0197.653] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0197.657] IUnknown:QueryInterface (in: This=0x5937c0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eed0 | out: ppvObject=0x19eed0*=0x5937c0) returned 0x0 [0197.658] IUnknown:QueryInterface (in: This=0x5937c0, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ee8c | out: ppvObject=0x19ee8c*=0x0) returned 0x80004002 [0197.658] IUnknown:QueryInterface (in: This=0x5937c0, riid=0x6bdafb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ecac | out: ppvObject=0x19ecac*=0x0) returned 0x80004002 [0197.658] IUnknown:QueryInterface (in: This=0x5937c0, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19ea84 | out: ppvObject=0x19ea84*=0x0) returned 0x80004002 [0197.658] IUnknown:AddRef (This=0x5937c0) returned 0x3 [0197.658] IUnknown:QueryInterface (in: This=0x5937c0, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e7ec | out: ppvObject=0x19e7ec*=0x0) returned 0x80004002 [0197.658] IUnknown:QueryInterface (in: This=0x5937c0, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e79c | out: ppvObject=0x19e79c*=0x0) returned 0x80004002 [0197.658] IUnknown:QueryInterface (in: This=0x5937c0, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e7a8 | out: ppvObject=0x19e7a8*=0x5937d4) returned 0x0 [0197.658] IMarshal:GetUnmarshalClass (in: This=0x5937d4, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e7b0 | out: pCid=0x19e7b0*(Data1=0x306, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0197.658] IUnknown:Release (This=0x5937d4) returned 0x3 [0197.658] CoGetContextToken (in: pToken=0x19e808 | out: pToken=0x19e808) returned 0x0 [0197.659] CoGetContextToken (in: pToken=0x19ec10 | out: pToken=0x19ec10) returned 0x0 [0197.659] IUnknown:QueryInterface (in: This=0x5937c0, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eca0 | out: ppvObject=0x19eca0*=0x0) returned 0x80004002 [0197.659] IUnknown:Release (This=0x5937c0) returned 0x2 [0197.659] CoGetContextToken (in: pToken=0x19f1e0 | out: pToken=0x19f1e0) returned 0x0 [0197.659] CoGetContextToken (in: pToken=0x19f140 | out: pToken=0x19f140) returned 0x0 [0197.659] IUnknown:QueryInterface (in: This=0x5937c0, riid=0x19f210*(Data1=0xf, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f20c | out: ppvObject=0x19f20c*=0x5937c0) returned 0x0 [0197.659] IUnknown:AddRef (This=0x5937c0) returned 0x4 [0197.659] IUnknown:Release (This=0x5937c0) returned 0x3 [0197.659] IUnknown:Release (This=0x59a328) returned 0x2 [0197.659] IUnknown:Release (This=0x5937c0) returned 0x2 [0197.663] CoGetContextToken (in: pToken=0x19f270 | out: pToken=0x19f270) returned 0x0 [0197.663] IUnknown:AddRef (This=0x5937c0) returned 0x3 [0197.663] BindMoniker (in: pmk=0x5937c0, grfOpt=0x0, iidResult=0x217eebc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvResult=0x19f410 | out: ppvResult=0x19f410*=0x56ce28) returned 0x0 [0197.664] IUnknown:QueryInterface (in: This=0x56ce28, riid=0x217eebc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f410 | out: ppvObject=0x19f410*=0x56ce28) returned 0x0 [0197.664] LoadRegTypeLib (in: rguid=0x6c5b2198*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x19ec6c*=0x0 | out: pptlib=0x19ec6c*=0x5af2d0) returned 0x0 [0198.016] ITypeLib:GetTypeInfoOfGuid (in: This=0x5af2d0, GUID=0x56ce6c*(Data1=0x62e522dc, Data2=0x8cf3, Data3=0x40a8, Data4=([0]=0x8b, [1]=0x2e, [2]=0x37, [3]=0xd5, [4]=0x95, [5]=0x65, [6]=0x1e, [7]=0x40)), ppTInfo=0x56ce54 | out: ppTInfo=0x56ce54*=0x5b0d24) returned 0x0 [0198.018] IUnknown:Release (This=0x5af2d0) returned 0x1 [0198.018] IUnknown:AddRef (This=0x5b0d24) returned 0x2 [0198.018] ITypeInfo:RemoteGetTypeAttr (in: This=0x5b0d24, ppTypeAttr=0x19eca8, pDummy=0xc6e7bdc6 | out: ppTypeAttr=0x19eca8, pDummy=0xc6e7bdc6) returned 0x0 [0198.041] ITypeInfo:LocalReleaseTypeAttr (This=0x5b0d24) returned 0x0 [0198.041] IUnknown:Release (This=0x5b0d24) returned 0x1 [0198.042] CoGetContextToken (in: pToken=0x19e808 | out: pToken=0x19e808) returned 0x0 [0198.042] CoGetContextToken (in: pToken=0x19ec10 | out: pToken=0x19ec10) returned 0x0 [0198.042] IUnknown:Release (This=0x5937c0) returned 0x2 [0198.284] CoGetContextToken (in: pToken=0x19eef0 | out: pToken=0x19eef0) returned 0x0 [0198.284] LoadRegTypeLib (in: rguid=0x6c5b2198*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x19eed8*=0x0 | out: pptlib=0x19eed8*=0x5af2d0) returned 0x0 [0198.285] ITypeLib:GetTypeInfoOfGuid (in: This=0x5af2d0, GUID=0x56ce5c*(Data1=0xd2f68443, Data2=0x85dc, Data3=0x427e, Data4=([0]=0x91, [1]=0xd8, [2]=0x36, [3]=0x65, [4]=0x54, [5]=0xcc, [6]=0x75, [7]=0x4c)), ppTInfo=0x56ce50 | out: ppTInfo=0x56ce50*=0x5b0d50) returned 0x0 [0198.285] IUnknown:Release (This=0x5af2d0) returned 0x2 [0198.285] IUnknown:AddRef (This=0x5b0d50) returned 0x2 [0198.285] DispGetIDsOfNames (in: ptinfo=0x5b0d50, rgszNames=0x19ef60*="InstancesOf", cNames=0x1, rgdispid=0x19ef50 | out: rgdispid=0x19ef50*=5) returned 0x0 [0198.287] IUnknown:Release (This=0x5b0d50) returned 0x1 [0198.288] IUnknown:AddRef (This=0x5b0d50) returned 0x2 [0198.288] ITypeInfo:LocalInvoke (This=0x5b0d50) returned 0x0 [0198.289] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0198.289] GetCurrentThreadId () returned 0x91c [0198.289] WbemLocator:IUnknown:AddRef (This=0x560a60) returned 0x3 [0198.289] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0198.290] GetCurrentThreadId () returned 0x91c [0198.290] IWbemServices:CreateInstanceEnum (in: This=0x560a60, strFilter="Win32_BaseBoard", lFlags=16, pCtx=0x0, ppEnum=0x19e764 | out: ppEnum=0x19e764*=0x5b3230) returned 0x0 [0198.299] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x596560 [0198.299] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x596260 [0198.299] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5956c0 [0198.299] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5a4308 [0198.299] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x59db10 [0198.300] IUnknown:QueryInterface (in: This=0x5b3230, riid=0x6c5b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e60c | out: ppvObject=0x19e60c*=0x5b3234) returned 0x0 [0198.300] IClientSecurity:QueryBlanket (in: This=0x5b3234, pProxy=0x5b3230, pAuthnSvc=0x19e5f8, pAuthzSvc=0x19e600, pServerPrincName=0x0, pAuthnLevel=0x19e634, pImpLevel=0x19e638, pAuthInfo=0x0, pCapabilites=0x19e5fc | out: pAuthnSvc=0x19e5f8*=0xa, pAuthzSvc=0x19e600*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19e634*=0x6, pImpLevel=0x19e638*=0x2, pAuthInfo=0x0, pCapabilites=0x19e5fc*=0x1) returned 0x0 [0198.300] IUnknown:Release (This=0x5b3234) returned 0x1 [0198.300] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0198.300] GetCurrentThreadId () returned 0x91c [0198.300] WbemLocator:IUnknown:QueryInterface (in: This=0x560a60, riid=0x6c5b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e5fc | out: ppvObject=0x19e5fc*=0x5aa8bc) returned 0x0 [0198.300] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5aa8bc, pProxy=0x560a60, pAuthnSvc=0x19e5e4, pAuthzSvc=0x19e5e8, pServerPrincName=0x0, pAuthnLevel=0x19e5f4, pImpLevel=0x19e5f8, pAuthInfo=0x0, pCapabilites=0x19e5ec | out: pAuthnSvc=0x19e5e4*=0xa, pAuthzSvc=0x19e5e8*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19e5f4*=0x6, pImpLevel=0x19e5f8*=0x3, pAuthInfo=0x0, pCapabilites=0x19e5ec*=0x20) returned 0x0 [0198.300] WbemLocator:IUnknown:Release (This=0x5aa8bc) returned 0x3 [0198.300] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0198.300] GetCurrentThreadId () returned 0x91c [0198.300] WbemLocator:IUnknown:QueryInterface (in: This=0x560a60, riid=0x6c5b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e5fc | out: ppvObject=0x19e5fc*=0x5aa8bc) returned 0x0 [0198.300] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5aa8bc, pProxy=0x560a60, pAuthnSvc=0x19e5e4, pAuthzSvc=0x19e5e8, pServerPrincName=0x0, pAuthnLevel=0x19e5f8, pImpLevel=0x19e5f4, pAuthInfo=0x0, pCapabilites=0x19e5ec | out: pAuthnSvc=0x19e5e4*=0xa, pAuthzSvc=0x19e5e8*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19e5f8*=0x6, pImpLevel=0x19e5f4*=0x3, pAuthInfo=0x0, pCapabilites=0x19e5ec*=0x20) returned 0x0 [0198.300] WbemLocator:IUnknown:Release (This=0x5aa8bc) returned 0x3 [0198.300] IUnknown:QueryInterface (in: This=0x5b3230, riid=0x6c5b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e62c | out: ppvObject=0x19e62c*=0x5b3234) returned 0x0 [0198.302] IClientSecurity:CopyProxy (in: This=0x5b3234, pProxy=0x5b3230, ppCopy=0x19e630 | out: ppCopy=0x19e630*=0x5b64c0) returned 0x0 [0198.302] IUnknown:QueryInterface (in: This=0x5b64c0, riid=0x6c5b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e584 | out: ppvObject=0x19e584*=0x5b64c4) returned 0x0 [0198.302] IClientSecurity:QueryBlanket (in: This=0x5b64c4, pProxy=0x5b64c0, pAuthnSvc=0x19e5b4, pAuthzSvc=0x19e5b0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x19e5b4*=0xa, pAuthzSvc=0x19e5b0*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0198.302] IUnknown:Release (This=0x5b64c4) returned 0x3 [0198.303] IUnknown:QueryInterface (in: This=0x5b64c0, riid=0x6c5b1f08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e568 | out: ppvObject=0x19e568*=0x5b3050) returned 0x0 [0198.303] IUnknown:QueryInterface (in: This=0x5b64c0, riid=0x6c5b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e56c | out: ppvObject=0x19e56c*=0x5b64c4) returned 0x0 [0198.303] IClientSecurity:SetBlanket (This=0x5b64c4, pProxy=0x5b64c0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0198.498] IUnknown:Release (This=0x5b64c4) returned 0x4 [0198.498] WbemLocator:IUnknown:Release (This=0x5b3050) returned 0x3 [0198.498] IUnknown:Release (This=0x5b3234) returned 0x2 [0198.498] IUnknown:AddRef (This=0x5b64c0) returned 0x3 [0198.498] IUnknown:Release (This=0x5b3230) returned 0x2 [0198.499] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x19e720 | out: pperrinfo=0x19e720*=0x0) returned 0x1 [0198.499] WbemLocator:IUnknown:Release (This=0x560a60) returned 0x2 [0198.499] IUnknown:Release (This=0x5b0d50) returned 0x1 [0198.499] LoadRegTypeLib (in: rguid=0x6c5b2198*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x19e734*=0x0 | out: pptlib=0x19e734*=0x5af2d0) returned 0x0 [0198.500] ITypeLib:GetTypeInfoOfGuid (in: This=0x5af2d0, GUID=0x596598*(Data1=0x4b83d61, Data2=0x21ae, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x33, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), ppTInfo=0x596580 | out: ppTInfo=0x596580*=0x5b0e58) returned 0x0 [0198.501] IUnknown:Release (This=0x5af2d0) returned 0x3 [0198.501] IUnknown:AddRef (This=0x5b0e58) returned 0x2 [0198.501] ITypeInfo:RemoteGetTypeAttr (in: This=0x5b0e58, ppTypeAttr=0x19e770, pDummy=0xc6e7b69e | out: ppTypeAttr=0x19e770, pDummy=0xc6e7b69e) returned 0x0 [0198.502] ITypeInfo:LocalReleaseTypeAttr (This=0x5b0e58) returned 0x0 [0198.502] IUnknown:Release (This=0x5b0e58) returned 0x1 [0198.560] CoGetContextToken (in: pToken=0x19e2d0 | out: pToken=0x19e2d0) returned 0x0 [0198.560] CoGetContextToken (in: pToken=0x19e6d8 | out: pToken=0x19e6d8) returned 0x0 [0198.561] CoGetContextToken (in: pToken=0x19f2b0 | out: pToken=0x19f2b0) returned 0x0 [0198.561] CoGetContextToken (in: pToken=0x19f210 | out: pToken=0x19f210) returned 0x0 [0198.563] CoGetContextToken (in: pToken=0x19f230 | out: pToken=0x19f230) returned 0x0 [0198.563] LoadRegTypeLib (in: rguid=0x6c5b2198*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x400, pptlib=0x19f220*=0x0 | out: pptlib=0x19f220*=0x5af2d0) returned 0x0 [0198.564] ITypeLib:GetTypeInfoOfGuid (in: This=0x5af2d0, GUID=0x596588*(Data1=0x76a6415f, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), ppTInfo=0x59657c | out: ppTInfo=0x59657c*=0x5b0e00) returned 0x0 [0198.564] IUnknown:Release (This=0x5af2d0) returned 0x4 [0198.564] IUnknown:AddRef (This=0x5b0e00) returned 0x2 [0198.565] ITypeInfo:LocalInvoke (This=0x5b0e00) returned 0x0 [0198.565] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0198.565] GetCurrentThreadId () returned 0x91c [0198.565] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5b7988 [0198.565] IUnknown:Release (This=0x5b0e00) returned 0x1 [0198.565] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0198.973] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x5b8608 [0198.981] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x5b9130 [0199.266] CoGetContextToken (in: pToken=0x19ef60 | out: pToken=0x19ef60) returned 0x0 [0199.317] CoGetContextToken (in: pToken=0x19ea60 | out: pToken=0x19ea60) returned 0x0 [0199.317] IUnknown:AddRef (This=0x5b0e00) returned 0x2 [0199.317] ITypeInfo:LocalInvoke (This=0x5b0e00) returned 0x0 [0199.318] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0199.318] GetCurrentThreadId () returned 0x91c [0199.318] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0199.318] GetCurrentThreadId () returned 0x91c [0199.318] IUnknown:AddRef (This=0x5b64c0) returned 0x3 [0199.318] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0199.318] GetCurrentThreadId () returned 0x91c [0199.318] IEnumWbemClassObject:Clone (in: This=0x5b64c0, ppEnum=0x19ea90 | out: ppEnum=0x19ea90*=0x5b6330) returned 0x0 [0199.320] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x595900 [0199.320] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x595960 [0199.320] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x595840 [0199.320] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5a4088 [0199.320] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x59ddf0 [0199.320] IUnknown:QueryInterface (in: This=0x5b6330, riid=0x6c5b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e93c | out: ppvObject=0x19e93c*=0x5b6334) returned 0x0 [0199.321] IClientSecurity:QueryBlanket (in: This=0x5b6334, pProxy=0x5b6330, pAuthnSvc=0x19e928, pAuthzSvc=0x19e930, pServerPrincName=0x0, pAuthnLevel=0x19e964, pImpLevel=0x19e968, pAuthInfo=0x0, pCapabilites=0x19e92c | out: pAuthnSvc=0x19e928*=0xa, pAuthzSvc=0x19e930*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19e964*=0x6, pImpLevel=0x19e968*=0x2, pAuthInfo=0x0, pCapabilites=0x19e92c*=0x1) returned 0x0 [0199.321] IUnknown:Release (This=0x5b6334) returned 0x1 [0199.321] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0199.321] GetCurrentThreadId () returned 0x91c [0199.321] IUnknown:QueryInterface (in: This=0x5b64c0, riid=0x6c5b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e92c | out: ppvObject=0x19e92c*=0x5b64c4) returned 0x0 [0199.321] IClientSecurity:QueryBlanket (in: This=0x5b64c4, pProxy=0x5b64c0, pAuthnSvc=0x19e914, pAuthzSvc=0x19e918, pServerPrincName=0x0, pAuthnLevel=0x19e924, pImpLevel=0x19e928, pAuthInfo=0x0, pCapabilites=0x19e91c | out: pAuthnSvc=0x19e914*=0xa, pAuthzSvc=0x19e918*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19e924*=0x6, pImpLevel=0x19e928*=0x3, pAuthInfo=0x0, pCapabilites=0x19e91c*=0x20) returned 0x0 [0199.321] IUnknown:Release (This=0x5b64c4) returned 0x3 [0199.321] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0199.321] GetCurrentThreadId () returned 0x91c [0199.321] IUnknown:QueryInterface (in: This=0x5b64c0, riid=0x6c5b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e92c | out: ppvObject=0x19e92c*=0x5b64c4) returned 0x0 [0199.321] IClientSecurity:QueryBlanket (in: This=0x5b64c4, pProxy=0x5b64c0, pAuthnSvc=0x19e914, pAuthzSvc=0x19e918, pServerPrincName=0x0, pAuthnLevel=0x19e928, pImpLevel=0x19e924, pAuthInfo=0x0, pCapabilites=0x19e91c | out: pAuthnSvc=0x19e914*=0xa, pAuthzSvc=0x19e918*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19e928*=0x6, pImpLevel=0x19e924*=0x3, pAuthInfo=0x0, pCapabilites=0x19e91c*=0x20) returned 0x0 [0199.321] IUnknown:Release (This=0x5b64c4) returned 0x3 [0199.321] IUnknown:QueryInterface (in: This=0x5b6330, riid=0x6c5b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e95c | out: ppvObject=0x19e95c*=0x5b6334) returned 0x0 [0199.321] IClientSecurity:CopyProxy (in: This=0x5b6334, pProxy=0x5b6330, ppCopy=0x19e960 | out: ppCopy=0x19e960*=0x5b63f8) returned 0x0 [0199.321] IUnknown:QueryInterface (in: This=0x5b63f8, riid=0x6c5b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e8b4 | out: ppvObject=0x19e8b4*=0x5b63fc) returned 0x0 [0199.322] IClientSecurity:QueryBlanket (in: This=0x5b63fc, pProxy=0x5b63f8, pAuthnSvc=0x19e8e4, pAuthzSvc=0x19e8e0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x19e8e4*=0xa, pAuthzSvc=0x19e8e0*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0199.322] IUnknown:Release (This=0x5b63fc) returned 0x3 [0199.322] IUnknown:QueryInterface (in: This=0x5b63f8, riid=0x6c5b1f08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e898 | out: ppvObject=0x19e898*=0x5b4340) returned 0x0 [0199.322] IUnknown:QueryInterface (in: This=0x5b63f8, riid=0x6c5b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e89c | out: ppvObject=0x19e89c*=0x5b63fc) returned 0x0 [0199.322] IClientSecurity:SetBlanket (This=0x5b63fc, pProxy=0x5b63f8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0199.324] IUnknown:Release (This=0x5b63fc) returned 0x4 [0199.324] WbemLocator:IUnknown:Release (This=0x5b4340) returned 0x3 [0199.324] IUnknown:Release (This=0x5b6334) returned 0x2 [0199.324] IUnknown:AddRef (This=0x5b63f8) returned 0x3 [0199.324] IUnknown:Release (This=0x5b6330) returned 0x2 [0199.324] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x19ea50 | out: pperrinfo=0x19ea50*=0x0) returned 0x1 [0199.324] IUnknown:Release (This=0x5b64c0) returned 0x2 [0199.324] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0199.324] GetCurrentThreadId () returned 0x91c [0199.324] IUnknown:AddRef (This=0x5b63f8) returned 0x3 [0199.324] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0199.324] GetCurrentThreadId () returned 0x91c [0199.325] IEnumWbemClassObject:Reset (This=0x5b63f8) returned 0x0 [0199.325] IUnknown:Release (This=0x5b63f8) returned 0x2 [0199.325] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5b7a48 [0199.325] IUnknown:Release (This=0x5b0e00) returned 0x1 [0199.352] CoGetContextToken (in: pToken=0x19e248 | out: pToken=0x19e248) returned 0x0 [0199.352] CoGetContextToken (in: pToken=0x19e650 | out: pToken=0x19e650) returned 0x0 [0199.389] CoGetContextToken (in: pToken=0x19f048 | out: pToken=0x19f048) returned 0x0 [0199.390] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0199.390] GetCurrentThreadId () returned 0x91c [0199.390] IUnknown:AddRef (This=0x5b63f8) returned 0x3 [0199.390] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0199.390] GetCurrentThreadId () returned 0x91c [0199.390] IEnumWbemClassObject:Next (in: This=0x5b63f8, lTimeout=-1, uCount=0x1, apObjects=0x19f3bc, puReturned=0x19f39c | out: apObjects=0x19f3bc*=0x5c2230, puReturned=0x19f39c*=0x1) returned 0x0 [0199.395] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x594a00 [0199.395] IUnknown:AddRef (This=0x5c2230) returned 0x2 [0199.395] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x582620 [0199.395] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5959c0 [0199.395] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x595a20 [0199.395] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5a4248 [0199.395] WbemLocator:IUnknown:AddRef (This=0x560a60) returned 0x3 [0199.395] IUnknown:AddRef (This=0x5b63f8) returned 0x4 [0199.395] IUnknown:QueryInterface (in: This=0x5b63f8, riid=0x6c5b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f3e8 | out: ppvObject=0x19f3e8*=0x5b63fc) returned 0x0 [0199.395] IClientSecurity:QueryBlanket (in: This=0x5b63fc, pProxy=0x5b63f8, pAuthnSvc=0x19f36c, pAuthzSvc=0x19f374, pServerPrincName=0x0, pAuthnLevel=0x19f398, pImpLevel=0x19f3a4, pAuthInfo=0x0, pCapabilites=0x19f368 | out: pAuthnSvc=0x19f36c*=0xa, pAuthzSvc=0x19f374*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19f398*=0x6, pImpLevel=0x19f3a4*=0x3, pAuthInfo=0x0, pCapabilites=0x19f368*=0x20) returned 0x0 [0199.395] IUnknown:Release (This=0x5b63fc) returned 0x4 [0199.395] WbemLocator:IUnknown:Release (This=0x560a60) returned 0x2 [0199.396] WbemLocator:IUnknown:AddRef (This=0x560a60) returned 0x3 [0199.396] IUnknown:Release (This=0x5b63f8) returned 0x3 [0199.396] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0199.396] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5a90a8 [0199.396] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5a4288 [0199.396] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5c0940 [0199.396] IUnknown:AddRef (This=0x5c2230) returned 0x3 [0199.396] IUnknown:Release (This=0x5c2230) returned 0x2 [0199.396] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x19f334 | out: pperrinfo=0x19f334*=0x0) returned 0x1 [0199.396] IUnknown:Release (This=0x5b63f8) returned 0x2 [0199.396] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x19f3ec | out: pperrinfo=0x19f3ec*=0x0) returned 0x1 [0199.397] LoadRegTypeLib (in: rguid=0x6c5b2198*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x19eb94*=0x0 | out: pptlib=0x19eb94*=0x5af2d0) returned 0x0 [0199.398] ITypeLib:GetTypeInfoOfGuid (in: This=0x5af2d0, GUID=0x6c5b4c08*(Data1=0xd6bdafb2, Data2=0x9435, Data3=0x491f, Data4=([0]=0xbb, [1]=0x87, [2]=0x6a, [3]=0xa0, [4]=0xf0, [5]=0xbc, [6]=0x31, [7]=0xa2)), ppTInfo=0x5a90c4 | out: ppTInfo=0x5a90c4*=0x5b0e84) returned 0x0 [0199.398] IUnknown:Release (This=0x5af2d0) returned 0x5 [0199.398] IUnknown:AddRef (This=0x5b0e84) returned 0x2 [0199.398] ITypeInfo:RemoteGetTypeAttr (in: This=0x5b0e84, ppTypeAttr=0x19ebd0, pDummy=0xc6e7bafe | out: ppTypeAttr=0x19ebd0, pDummy=0xc6e7bafe) returned 0x0 [0199.399] ITypeInfo:LocalReleaseTypeAttr (This=0x5b0e84) returned 0x0 [0199.399] IUnknown:Release (This=0x5b0e84) returned 0x1 [0199.400] CoGetContextToken (in: pToken=0x19e730 | out: pToken=0x19e730) returned 0x0 [0199.400] CoGetContextToken (in: pToken=0x19eb38 | out: pToken=0x19eb38) returned 0x0 [0199.404] CoGetContextToken (in: pToken=0x19ef00 | out: pToken=0x19ef00) returned 0x0 [0199.404] LoadRegTypeLib (in: rguid=0x6c5b2198*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x19eee8*=0x0 | out: pptlib=0x19eee8*=0x5af2d0) returned 0x0 [0199.405] ITypeLib:GetTypeInfoOfGuid (in: This=0x5af2d0, GUID=0x6c5b1e68*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x5a90c0 | out: ppTInfo=0x5a90c0*=0x5b0eb0) returned 0x0 [0199.405] IUnknown:Release (This=0x5af2d0) returned 0x6 [0199.405] IUnknown:AddRef (This=0x5b0eb0) returned 0x2 [0199.406] DispGetIDsOfNames (in: ptinfo=0x5b0eb0, rgszNames=0x19ef70*="SerialNumber", cNames=0x1, rgdispid=0x19ef60 | out: rgdispid=0x19ef60*=-1) returned 0x80020006 [0199.443] IUnknown:AddRef (This=0x5c2230) returned 0x3 [0199.444] IWbemClassObject:Get (in: This=0x5c2230, wszName="SerialNumber", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x19eeb8*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x19eeb8*=0) returned 0x0 [0199.444] IUnknown:Release (This=0x5c2230) returned 0x2 [0199.444] SysStringLen (param_1="SerialNumber") returned 0xc [0199.444] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5c07d8 [0199.444] SysStringLen (param_1="SerialNumber") returned 0xc [0199.444] IUnknown:Release (This=0x5b0eb0) returned 0x1 [0199.444] IUnknown:AddRef (This=0x5b0eb0) returned 0x2 [0199.444] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0199.444] GetCurrentThreadId () returned 0x91c [0199.444] SysStringLen (param_1="SerialNumber") returned 0xc [0199.444] IWbemClassObject:Get (in: This=0x5c2230, wszName="SerialNumber", lFlags=0, pVal=0x19ed00*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19ecf8*=0, plFlavor=0x0 | out: pVal=0x19ed00*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="..XXXXXXXXXXXXX.", varVal2=0x0), pType=0x19ecf8*=8, plFlavor=0x0) returned 0x0 [0199.445] IUnknown:Release (This=0x5b0eb0) returned 0x1 [0199.445] SysStringByteLen (bstr="..XXXXXXXXXXXXX.") returned 0x20 [0199.445] SysStringByteLen (bstr="..XXXXXXXXXXXXX.") returned 0x20 [0199.525] CoGetContextToken (in: pToken=0x19f048 | out: pToken=0x19f048) returned 0x0 [0199.525] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0199.527] GetCurrentThreadId () returned 0x91c [0199.527] IUnknown:AddRef (This=0x5b63f8) returned 0x3 [0199.527] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0199.527] GetCurrentThreadId () returned 0x91c [0199.527] IEnumWbemClassObject:Next (in: This=0x5b63f8, lTimeout=-1, uCount=0x1, apObjects=0x19f3bc, puReturned=0x19f39c | out: apObjects=0x19f3bc*=0x0, puReturned=0x19f39c*=0x0) returned 0x1 [0199.529] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x19f334 | out: pperrinfo=0x19f334*=0x0) returned 0x1 [0199.529] IUnknown:Release (This=0x5b63f8) returned 0x2 [0199.529] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x19f3ec | out: pperrinfo=0x19f3ec*=0x0) returned 0x1 [0199.634] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x458 [0199.635] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x468 [0199.646] SetEvent (hEvent=0x468) returned 1 [0199.673] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f3c4*=0x458, lpdwindex=0x19f1e4 | out: lpdwindex=0x19f1e4) returned 0x0 [0199.673] CoGetContextToken (in: pToken=0x19f290 | out: pToken=0x19f290) returned 0x0 [0199.673] CoGetContextToken (in: pToken=0x19f1f0 | out: pToken=0x19f1f0) returned 0x0 [0199.674] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c1ae8, riid=0x19f2c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f2bc | out: ppvObject=0x19f2bc*=0x5c1ae8) returned 0x0 [0199.674] WbemDefPath:IUnknown:AddRef (This=0x5c1ae8) returned 0x3 [0199.674] WbemDefPath:IUnknown:Release (This=0x5c1ae8) returned 0x2 [0199.678] WbemDefPath:IWbemPath:SetText (This=0x5c1ae8, uMode=0x4, pszPath="win32_processor") returned 0x0 [0199.681] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5c1ae8, puCount=0x19f444 | out: puCount=0x19f444*=0x0) returned 0x0 [0199.681] WbemDefPath:IWbemPath:GetText (in: This=0x5c1ae8, lFlags=2, puBuffLength=0x19f440*=0x0, pszText=0x0 | out: puBuffLength=0x19f440*=0x10, pszText=0x0) returned 0x0 [0199.681] WbemDefPath:IWbemPath:GetText (in: This=0x5c1ae8, lFlags=2, puBuffLength=0x19f440*=0x10, pszText="000000000000000" | out: puBuffLength=0x19f440*=0x10, pszText="win32_processor") returned 0x0 [0199.682] WbemDefPath:IWbemPath:GetInfo (in: This=0x5c1ae8, uRequestedInfo=0x0, puResponse=0x19f44c | out: puResponse=0x19f44c*=0xc15) returned 0x0 [0199.682] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5c1ae8, puCount=0x19f444 | out: puCount=0x19f444*=0x0) returned 0x0 [0199.682] WbemDefPath:IWbemPath:GetInfo (in: This=0x5c1ae8, uRequestedInfo=0x0, puResponse=0x19f44c | out: puResponse=0x19f44c*=0xc15) returned 0x0 [0199.682] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5c1ae8, puCount=0x19f434 | out: puCount=0x19f434*=0x0) returned 0x0 [0199.682] WbemDefPath:IWbemPath:GetText (in: This=0x5c1ae8, lFlags=2, puBuffLength=0x19f430*=0x0, pszText=0x0 | out: puBuffLength=0x19f430*=0x10, pszText=0x0) returned 0x0 [0199.682] WbemDefPath:IWbemPath:GetText (in: This=0x5c1ae8, lFlags=2, puBuffLength=0x19f430*=0x10, pszText="000000000000000" | out: puBuffLength=0x19f430*=0x10, pszText="win32_processor") returned 0x0 [0199.682] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5c1ae8, puCount=0x19f434 | out: puCount=0x19f434*=0x0) returned 0x0 [0199.682] WbemDefPath:IWbemPath:GetText (in: This=0x5c1ae8, lFlags=2, puBuffLength=0x19f430*=0x0, pszText=0x0 | out: puBuffLength=0x19f430*=0x10, pszText=0x0) returned 0x0 [0199.683] WbemDefPath:IWbemPath:GetText (in: This=0x5c1ae8, lFlags=2, puBuffLength=0x19f430*=0x10, pszText="000000000000000" | out: puBuffLength=0x19f430*=0x10, pszText="win32_processor") returned 0x0 [0199.683] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5c1ae8, puCount=0x19f3c4 | out: puCount=0x19f3c4*=0x0) returned 0x0 [0199.684] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x490 [0199.684] SetEvent (hEvent=0x468) returned 1 [0199.684] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19ec24*=0x490, lpdwindex=0x19ea44 | out: lpdwindex=0x19ea44) returned 0x0 [0199.691] CoGetContextToken (in: pToken=0x19eaf0 | out: pToken=0x19eaf0) returned 0x0 [0199.691] CoGetContextToken (in: pToken=0x19ea50 | out: pToken=0x19ea50) returned 0x0 [0199.691] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c3310, riid=0x19eb20*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19eb1c | out: ppvObject=0x19eb1c*=0x5c3310) returned 0x0 [0199.692] WbemDefPath:IUnknown:AddRef (This=0x5c3310) returned 0x3 [0199.692] WbemDefPath:IUnknown:Release (This=0x5c3310) returned 0x2 [0199.692] WbemDefPath:IWbemPath:SetText (This=0x5c3310, uMode=0x4, pszPath="//./root/cimv2") returned 0x0 [0199.692] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5c3310, puCount=0x19f3b0 | out: puCount=0x19f3b0*=0x2) returned 0x0 [0199.692] WbemDefPath:IWbemPath:GetText (in: This=0x5c3310, lFlags=4, puBuffLength=0x19f3ac*=0x0, pszText=0x0 | out: puBuffLength=0x19f3ac*=0xf, pszText=0x0) returned 0x0 [0199.692] WbemDefPath:IWbemPath:GetText (in: This=0x5c3310, lFlags=4, puBuffLength=0x19f3ac*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3ac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0199.692] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x494 [0199.692] SetEvent (hEvent=0x468) returned 1 [0199.692] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f30c*=0x494, lpdwindex=0x19f12c | out: lpdwindex=0x19f12c) returned 0x0 [0199.696] CoGetContextToken (in: pToken=0x19f1d8 | out: pToken=0x19f1d8) returned 0x0 [0199.696] CoGetContextToken (in: pToken=0x19f138 | out: pToken=0x19f138) returned 0x0 [0199.696] WbemDefPath:IUnknown:QueryInterface (in: This=0x59e028, riid=0x19f208*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x59e028) returned 0x0 [0199.696] WbemDefPath:IUnknown:AddRef (This=0x59e028) returned 0x3 [0199.696] WbemDefPath:IUnknown:Release (This=0x59e028) returned 0x2 [0199.696] WbemDefPath:IWbemPath:SetText (This=0x59e028, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0199.696] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x59e028, puCount=0x19f388 | out: puCount=0x19f388*=0x2) returned 0x0 [0199.696] WbemDefPath:IWbemPath:GetText (in: This=0x59e028, lFlags=4, puBuffLength=0x19f384*=0x0, pszText=0x0 | out: puBuffLength=0x19f384*=0xf, pszText=0x0) returned 0x0 [0199.696] WbemDefPath:IWbemPath:GetText (in: This=0x59e028, lFlags=4, puBuffLength=0x19f384*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f384*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0199.858] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f2a8*=0x4a8, lpdwindex=0x19f15c | out: lpdwindex=0x19f15c) returned 0x0 [0201.085] CoGetContextToken (in: pToken=0x19f0a0 | out: pToken=0x19f0a0) returned 0x0 [0201.085] CoGetContextToken (in: pToken=0x19f048 | out: pToken=0x19f048) returned 0x0 [0201.085] IUnknown:QueryInterface (in: This=0x564140, riid=0x6bd28724*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f028 | out: ppvObject=0x19f028*=0x564150) returned 0x0 [0201.086] CObjectContext::ContextCallback () returned 0x0 [0201.094] IUnknown:Release (This=0x564150) returned 0x1 [0201.095] CoUnmarshalInterface (in: pStm=0x5a40c8, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f090 | out: ppv=0x19f090*=0x5b3740) returned 0x0 [0201.095] CoMarshalInterface (pStm=0x5a40c8, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5b3740, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0201.095] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3740, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ef34 | out: ppvObject=0x19ef34*=0x5b3740) returned 0x0 [0201.096] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3740, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19eef0 | out: ppvObject=0x19eef0*=0x0) returned 0x80004002 [0201.096] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3740, riid=0x6bdafb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed0c | out: ppvObject=0x19ed0c*=0x0) returned 0x80004002 [0201.097] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3740, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19eae4 | out: ppvObject=0x19eae4*=0x0) returned 0x80004002 [0201.098] WbemLocator:IUnknown:AddRef (This=0x5b3740) returned 0x3 [0201.098] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3740, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e84c | out: ppvObject=0x19e84c*=0x0) returned 0x80004002 [0201.098] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3740, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0201.098] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3740, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e808 | out: ppvObject=0x19e808*=0x5b369c) returned 0x0 [0201.098] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5b369c, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e810 | out: pCid=0x19e810*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0201.098] WbemLocator:IUnknown:Release (This=0x5b369c) returned 0x3 [0201.098] CoGetContextToken (in: pToken=0x19e868 | out: pToken=0x19e868) returned 0x0 [0201.098] CoGetContextToken (in: pToken=0x19ec70 | out: pToken=0x19ec70) returned 0x0 [0201.098] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3740, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed00 | out: ppvObject=0x19ed00*=0x5b3724) returned 0x0 [0201.098] WbemLocator:IRpcOptions:Query (in: This=0x5b3724, pPrx=0x5b3740, dwProperty=2, pdwValue=0x19ed28 | out: pdwValue=0x19ed28) returned 0x0 [0201.098] WbemLocator:IUnknown:Release (This=0x5b3724) returned 0x3 [0201.098] WbemLocator:IUnknown:Release (This=0x5b3740) returned 0x2 [0201.099] WbemLocator:IUnknown:Release (This=0x5b3740) returned 0x1 [0201.099] CoGetContextToken (in: pToken=0x19efe0 | out: pToken=0x19efe0) returned 0x0 [0201.099] WbemLocator:IUnknown:AddRef (This=0x5b3740) returned 0x2 [0201.099] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3740, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x5b371c) returned 0x0 [0201.099] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5b371c, pProxy=0x5b3740, pAuthnSvc=0x19f2ec, pAuthzSvc=0x19f2e8, pServerPrincName=0x19f2e0, pAuthnLevel=0x19f2e4, pImpLevel=0x19f2d4, pAuthInfo=0x19f2d8, pCapabilites=0x19f2dc | out: pAuthnSvc=0x19f2ec*=0xa, pAuthzSvc=0x19f2e8*=0x0, pServerPrincName=0x19f2e0, pAuthnLevel=0x19f2e4*=0x6, pImpLevel=0x19f2d4*=0x2, pAuthInfo=0x19f2d8, pCapabilites=0x19f2dc*=0x1) returned 0x0 [0201.099] WbemLocator:IUnknown:Release (This=0x5b371c) returned 0x2 [0201.099] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3740, riid=0x6c5910f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f290 | out: ppvObject=0x19f290*=0x5b3740) returned 0x0 [0201.099] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3740, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f28c | out: ppvObject=0x19f28c*=0x5b371c) returned 0x0 [0201.099] WbemLocator:IClientSecurity:SetBlanket (This=0x5b371c, pProxy=0x5b3740, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0201.099] WbemLocator:IUnknown:Release (This=0x5b371c) returned 0x3 [0201.099] WbemLocator:IUnknown:Release (This=0x5b3740) returned 0x2 [0201.101] CoTaskMemFree (pv=0x5c2d78) [0201.101] WbemLocator:IUnknown:Release (This=0x5b3740) returned 0x1 [0201.101] SysStringLen (param_1=0x0) returned 0x0 [0201.101] CoGetContextToken (in: pToken=0x19f258 | out: pToken=0x19f258) returned 0x0 [0201.101] CoGetContextToken (in: pToken=0x19f1b8 | out: pToken=0x19f1b8) returned 0x0 [0201.101] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3740, riid=0x19f288*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19f284 | out: ppvObject=0x19f284*=0x5b25b0) returned 0x0 [0201.102] WbemLocator:IUnknown:AddRef (This=0x5b25b0) returned 0x3 [0201.102] WbemLocator:IUnknown:Release (This=0x5b25b0) returned 0x2 [0201.102] CoGetContextToken (in: pToken=0x19f218 | out: pToken=0x19f218) returned 0x0 [0201.102] WbemLocator:IUnknown:AddRef (This=0x5b25b0) returned 0x3 [0201.102] WbemLocator:IUnknown:QueryInterface (in: This=0x5b25b0, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x5b371c) returned 0x0 [0201.102] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5b371c, pProxy=0x5b25b0, pAuthnSvc=0x19f2ec, pAuthzSvc=0x19f2e8, pServerPrincName=0x19f2e0, pAuthnLevel=0x19f2e4, pImpLevel=0x19f2d4, pAuthInfo=0x19f2d8, pCapabilites=0x19f2dc | out: pAuthnSvc=0x19f2ec*=0xa, pAuthzSvc=0x19f2e8*=0x0, pServerPrincName=0x19f2e0, pAuthnLevel=0x19f2e4*=0x6, pImpLevel=0x19f2d4*=0x2, pAuthInfo=0x19f2d8, pCapabilites=0x19f2dc*=0x1) returned 0x0 [0201.102] WbemLocator:IUnknown:Release (This=0x5b371c) returned 0x3 [0201.102] WbemLocator:IUnknown:QueryInterface (in: This=0x5b25b0, riid=0x6c5910f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f290 | out: ppvObject=0x19f290*=0x5b3740) returned 0x0 [0201.102] WbemLocator:IUnknown:QueryInterface (in: This=0x5b25b0, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f28c | out: ppvObject=0x19f28c*=0x5b371c) returned 0x0 [0201.102] WbemLocator:IClientSecurity:SetBlanket (This=0x5b371c, pProxy=0x5b25b0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0201.103] WbemLocator:IUnknown:Release (This=0x5b371c) returned 0x4 [0201.103] WbemLocator:IUnknown:Release (This=0x5b3740) returned 0x3 [0201.103] CoTaskMemFree (pv=0x5c30d8) [0201.103] WbemLocator:IUnknown:Release (This=0x5b25b0) returned 0x2 [0201.103] SysStringLen (param_1=0x0) returned 0x0 [0201.103] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x59e028, puCount=0x19f3ac | out: puCount=0x19f3ac*=0x2) returned 0x0 [0201.103] WbemDefPath:IWbemPath:GetText (in: This=0x59e028, lFlags=4, puBuffLength=0x19f3a8*=0x0, pszText=0x0 | out: puBuffLength=0x19f3a8*=0xf, pszText=0x0) returned 0x0 [0201.103] WbemDefPath:IWbemPath:GetText (in: This=0x59e028, lFlags=4, puBuffLength=0x19f3a8*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3a8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0201.103] CoGetContextToken (in: pToken=0x19f018 | out: pToken=0x19f018) returned 0x0 [0201.104] CoUnmarshalInterface (in: pStm=0x5a40c8, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f008 | out: ppv=0x19f008*=0x5b3740) returned 0x0 [0201.104] CoMarshalInterface (pStm=0x5a40c8, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5b3740, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0201.104] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3740, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eeac | out: ppvObject=0x19eeac*=0x5b3740) returned 0x0 [0201.104] WbemLocator:IUnknown:Release (This=0x5b3740) returned 0x3 [0201.104] WbemLocator:IUnknown:Release (This=0x5b3740) returned 0x2 [0201.104] CoGetContextToken (in: pToken=0x19ef58 | out: pToken=0x19ef58) returned 0x0 [0201.104] WbemLocator:IUnknown:AddRef (This=0x5b3740) returned 0x3 [0201.105] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3740, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f214 | out: ppvObject=0x19f214*=0x5b371c) returned 0x0 [0201.105] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5b371c, pProxy=0x5b3740, pAuthnSvc=0x19f264, pAuthzSvc=0x19f260, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c, pImpLevel=0x19f24c, pAuthInfo=0x19f250, pCapabilites=0x19f254 | out: pAuthnSvc=0x19f264*=0xa, pAuthzSvc=0x19f260*=0x0, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c*=0x6, pImpLevel=0x19f24c*=0x3, pAuthInfo=0x19f250, pCapabilites=0x19f254*=0x20) returned 0x0 [0201.105] WbemLocator:IUnknown:Release (This=0x5b371c) returned 0x3 [0201.105] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3740, riid=0x6c5910f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f208 | out: ppvObject=0x19f208*=0x5b3740) returned 0x0 [0201.105] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3740, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x5b371c) returned 0x0 [0201.105] WbemLocator:IClientSecurity:SetBlanket (This=0x5b371c, pProxy=0x5b3740, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0201.105] WbemLocator:IUnknown:Release (This=0x5b371c) returned 0x4 [0201.105] WbemLocator:IUnknown:Release (This=0x5b3740) returned 0x3 [0201.105] WbemLocator:IUnknown:Release (This=0x5b3740) returned 0x2 [0201.105] SysStringLen (param_1=0x0) returned 0x0 [0201.105] CoGetContextToken (in: pToken=0x19f1d0 | out: pToken=0x19f1d0) returned 0x0 [0201.105] WbemLocator:IUnknown:AddRef (This=0x5b25b0) returned 0x3 [0201.105] WbemLocator:IUnknown:Release (This=0x5b25b0) returned 0x2 [0201.105] CoGetContextToken (in: pToken=0x19f190 | out: pToken=0x19f190) returned 0x0 [0201.105] WbemLocator:IUnknown:AddRef (This=0x5b25b0) returned 0x3 [0201.106] WbemLocator:IUnknown:QueryInterface (in: This=0x5b25b0, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f214 | out: ppvObject=0x19f214*=0x5b371c) returned 0x0 [0201.106] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5b371c, pProxy=0x5b25b0, pAuthnSvc=0x19f264, pAuthzSvc=0x19f260, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c, pImpLevel=0x19f24c, pAuthInfo=0x19f250, pCapabilites=0x19f254 | out: pAuthnSvc=0x19f264*=0xa, pAuthzSvc=0x19f260*=0x0, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c*=0x6, pImpLevel=0x19f24c*=0x3, pAuthInfo=0x19f250, pCapabilites=0x19f254*=0x20) returned 0x0 [0201.106] WbemLocator:IUnknown:Release (This=0x5b371c) returned 0x3 [0201.106] WbemLocator:IUnknown:QueryInterface (in: This=0x5b25b0, riid=0x6c5910f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f208 | out: ppvObject=0x19f208*=0x5b3740) returned 0x0 [0201.106] WbemLocator:IUnknown:QueryInterface (in: This=0x5b25b0, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x5b371c) returned 0x0 [0201.106] WbemLocator:IClientSecurity:SetBlanket (This=0x5b371c, pProxy=0x5b25b0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0201.106] WbemLocator:IUnknown:Release (This=0x5b371c) returned 0x4 [0201.106] WbemLocator:IUnknown:Release (This=0x5b3740) returned 0x3 [0201.106] WbemLocator:IUnknown:Release (This=0x5b25b0) returned 0x2 [0201.106] SysStringLen (param_1=0x0) returned 0x0 [0201.106] WbemDefPath:IWbemPath:GetText (in: This=0x5c1ae8, lFlags=2, puBuffLength=0x19f3b0*=0x0, pszText=0x0 | out: puBuffLength=0x19f3b0*=0x10, pszText=0x0) returned 0x0 [0201.106] WbemDefPath:IWbemPath:GetText (in: This=0x5c1ae8, lFlags=2, puBuffLength=0x19f3b0*=0x10, pszText="000000000000000" | out: puBuffLength=0x19f3b0*=0x10, pszText="win32_processor") returned 0x0 [0201.113] IWbemServices:GetObject (in: This=0x5b25b0, strObjectPath="win32_processor", lFlags=0, pCtx=0x0, ppObject=0x19f364*=0x0, ppCallResult=0x0 | out: ppObject=0x19f364*=0x5df778, ppCallResult=0x0) returned 0x0 [0201.132] IWbemClassObject:Get (in: This=0x5df778, wszName="__PATH", lFlags=0, pVal=0x19f34c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f3f4*=0, plFlavor=0x19f3f0*=0 | out: pVal=0x19f34c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_Processor", varVal2=0x0), pType=0x19f3f4*=8, plFlavor=0x19f3f0*=64) returned 0x0 [0201.135] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_Processor") returned 0x46 [0201.135] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_Processor") returned 0x46 [0201.136] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4e0 [0201.136] SetEvent (hEvent=0x468) returned 1 [0201.136] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f308*=0x4e0, lpdwindex=0x19f124 | out: lpdwindex=0x19f124) returned 0x0 [0201.139] CoGetContextToken (in: pToken=0x19f1d8 | out: pToken=0x19f1d8) returned 0x0 [0201.139] CoGetContextToken (in: pToken=0x19f138 | out: pToken=0x19f138) returned 0x0 [0201.139] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0880, riid=0x19f208*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x5e0880) returned 0x0 [0201.139] WbemDefPath:IUnknown:AddRef (This=0x5e0880) returned 0x3 [0201.139] WbemDefPath:IUnknown:Release (This=0x5e0880) returned 0x2 [0201.139] WbemDefPath:IWbemPath:SetText (This=0x5e0880, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_Processor") returned 0x0 [0201.140] IWbemClassObject:Get (in: This=0x5df778, wszName="__CLASS", lFlags=0, pVal=0x19f3bc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f43c*=0, plFlavor=0x19f438*=0 | out: pVal=0x19f3bc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Processor", varVal2=0x0), pType=0x19f43c*=8, plFlavor=0x19f438*=64) returned 0x0 [0201.140] SysStringByteLen (bstr="Win32_Processor") returned 0x1e [0201.140] SysStringByteLen (bstr="Win32_Processor") returned 0x1e [0201.140] CoGetContextToken (in: pToken=0x19f1d8 | out: pToken=0x19f1d8) returned 0x0 [0201.140] WbemLocator:IUnknown:AddRef (This=0x5b25b0) returned 0x3 [0201.140] IWbemServices:CreateInstanceEnum (in: This=0x5b25b0, strFilter="Win32_Processor", lFlags=17, pCtx=0x0, ppEnum=0x19f3b8 | out: ppEnum=0x19f3b8*=0x5b6588) returned 0x0 [0201.142] IUnknown:QueryInterface (in: This=0x5b6588, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f24c | out: ppvObject=0x19f24c*=0x5b658c) returned 0x0 [0201.143] IClientSecurity:QueryBlanket (in: This=0x5b658c, pProxy=0x5b6588, pAuthnSvc=0x19f29c, pAuthzSvc=0x19f298, pServerPrincName=0x19f290, pAuthnLevel=0x19f294, pImpLevel=0x19f284, pAuthInfo=0x19f288, pCapabilites=0x19f28c | out: pAuthnSvc=0x19f29c*=0xa, pAuthzSvc=0x19f298*=0x0, pServerPrincName=0x19f290, pAuthnLevel=0x19f294*=0x6, pImpLevel=0x19f284*=0x2, pAuthInfo=0x19f288, pCapabilites=0x19f28c*=0x1) returned 0x0 [0201.143] IUnknown:Release (This=0x5b658c) returned 0x1 [0201.143] IUnknown:QueryInterface (in: This=0x5b6588, riid=0x6c5910f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f240 | out: ppvObject=0x19f240*=0x5b4140) returned 0x0 [0201.143] IUnknown:QueryInterface (in: This=0x5b6588, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f23c | out: ppvObject=0x19f23c*=0x5b658c) returned 0x0 [0201.143] IClientSecurity:SetBlanket (This=0x5b658c, pProxy=0x5b6588, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0201.168] IUnknown:Release (This=0x5b658c) returned 0x2 [0201.168] WbemLocator:IUnknown:Release (This=0x5b4140) returned 0x1 [0201.168] CoTaskMemFree (pv=0x5c2c88) [0201.168] IUnknown:QueryInterface (in: This=0x5b6588, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee34 | out: ppvObject=0x19ee34*=0x5b4140) returned 0x0 [0201.169] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4140, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19edf0 | out: ppvObject=0x19edf0*=0x0) returned 0x80004002 [0201.175] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4140, riid=0x6bdafb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ec0c | out: ppvObject=0x19ec0c*=0x0) returned 0x80004002 [0201.420] IUnknown:QueryInterface (in: This=0x5b6588, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e9e4 | out: ppvObject=0x19e9e4*=0x0) returned 0x80004002 [0201.468] WbemLocator:IUnknown:AddRef (This=0x5b4140) returned 0x3 [0201.468] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4140, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e74c | out: ppvObject=0x19e74c*=0x0) returned 0x80004002 [0201.468] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4140, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e6fc | out: ppvObject=0x19e6fc*=0x0) returned 0x80004002 [0201.468] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4140, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e708 | out: ppvObject=0x19e708*=0x5b409c) returned 0x0 [0201.468] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5b409c, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e710 | out: pCid=0x19e710*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0201.468] WbemLocator:IUnknown:Release (This=0x5b409c) returned 0x3 [0201.468] CoGetContextToken (in: pToken=0x19e768 | out: pToken=0x19e768) returned 0x0 [0201.468] CoGetContextToken (in: pToken=0x19eb70 | out: pToken=0x19eb70) returned 0x0 [0201.468] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4140, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec00 | out: ppvObject=0x19ec00*=0x5b4124) returned 0x0 [0201.468] WbemLocator:IRpcOptions:Query (in: This=0x5b4124, pPrx=0x5b4140, dwProperty=2, pdwValue=0x19ec28 | out: pdwValue=0x19ec28) returned 0x80004002 [0201.468] WbemLocator:IUnknown:Release (This=0x5b4124) returned 0x3 [0201.469] WbemLocator:IUnknown:Release (This=0x5b4140) returned 0x2 [0201.469] CoGetContextToken (in: pToken=0x19f148 | out: pToken=0x19f148) returned 0x0 [0201.469] CoGetContextToken (in: pToken=0x19f0a8 | out: pToken=0x19f0a8) returned 0x0 [0201.469] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4140, riid=0x19f178*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f174 | out: ppvObject=0x19f174*=0x5b6588) returned 0x0 [0201.469] IUnknown:AddRef (This=0x5b6588) returned 0x4 [0201.469] IUnknown:Release (This=0x5b6588) returned 0x3 [0201.469] IUnknown:Release (This=0x5b6588) returned 0x2 [0201.469] WbemLocator:IUnknown:Release (This=0x5b25b0) returned 0x2 [0201.469] SysStringLen (param_1=0x0) returned 0x0 [0201.469] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x59e028, puCount=0x19f3f4 | out: puCount=0x19f3f4*=0x2) returned 0x0 [0201.469] WbemDefPath:IWbemPath:GetText (in: This=0x59e028, lFlags=4, puBuffLength=0x19f3f0*=0x0, pszText=0x0 | out: puBuffLength=0x19f3f0*=0xf, pszText=0x0) returned 0x0 [0201.469] WbemDefPath:IWbemPath:GetText (in: This=0x59e028, lFlags=4, puBuffLength=0x19f3f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0201.469] CoGetContextToken (in: pToken=0x19f238 | out: pToken=0x19f238) returned 0x0 [0201.469] IUnknown:AddRef (This=0x5b6588) returned 0x3 [0201.469] IEnumWbemClassObject:Clone (in: This=0x5b6588, ppEnum=0x19f3f4 | out: ppEnum=0x19f3f4*=0x5b6650) returned 0x0 [0201.559] IUnknown:QueryInterface (in: This=0x5b6650, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f2b8 | out: ppvObject=0x19f2b8*=0x5b6654) returned 0x0 [0201.559] IClientSecurity:QueryBlanket (in: This=0x5b6654, pProxy=0x5b6650, pAuthnSvc=0x19f308, pAuthzSvc=0x19f304, pServerPrincName=0x19f2fc, pAuthnLevel=0x19f300, pImpLevel=0x19f2f0, pAuthInfo=0x19f2f4, pCapabilites=0x19f2f8 | out: pAuthnSvc=0x19f308*=0xa, pAuthzSvc=0x19f304*=0x0, pServerPrincName=0x19f2fc, pAuthnLevel=0x19f300*=0x6, pImpLevel=0x19f2f0*=0x2, pAuthInfo=0x19f2f4, pCapabilites=0x19f2f8*=0x1) returned 0x0 [0201.559] IUnknown:Release (This=0x5b6654) returned 0x1 [0201.559] IUnknown:QueryInterface (in: This=0x5b6650, riid=0x6c5910f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f2ac | out: ppvObject=0x19f2ac*=0x5b5040) returned 0x0 [0201.559] IUnknown:QueryInterface (in: This=0x5b6650, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f2a8 | out: ppvObject=0x19f2a8*=0x5b6654) returned 0x0 [0201.559] IClientSecurity:SetBlanket (This=0x5b6654, pProxy=0x5b6650, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0201.690] IUnknown:Release (This=0x5b6654) returned 0x2 [0201.690] WbemLocator:IUnknown:Release (This=0x5b5040) returned 0x1 [0201.690] CoTaskMemFree (pv=0x5c2f88) [0201.690] IUnknown:QueryInterface (in: This=0x5b6650, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee94 | out: ppvObject=0x19ee94*=0x5b5040) returned 0x0 [0201.690] WbemLocator:IUnknown:QueryInterface (in: This=0x5b5040, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ee50 | out: ppvObject=0x19ee50*=0x0) returned 0x80004002 [0201.994] WbemLocator:IUnknown:QueryInterface (in: This=0x5b5040, riid=0x6bdafb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ec6c | out: ppvObject=0x19ec6c*=0x0) returned 0x80004002 [0202.378] IUnknown:QueryInterface (in: This=0x5b6650, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19ea44 | out: ppvObject=0x19ea44*=0x0) returned 0x80004002 [0202.780] WbemLocator:IUnknown:AddRef (This=0x5b5040) returned 0x3 [0202.780] WbemLocator:IUnknown:QueryInterface (in: This=0x5b5040, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e7ac | out: ppvObject=0x19e7ac*=0x0) returned 0x80004002 [0202.780] WbemLocator:IUnknown:QueryInterface (in: This=0x5b5040, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e75c | out: ppvObject=0x19e75c*=0x0) returned 0x80004002 [0202.780] WbemLocator:IUnknown:QueryInterface (in: This=0x5b5040, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e768 | out: ppvObject=0x19e768*=0x5b4f9c) returned 0x0 [0202.780] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5b4f9c, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e770 | out: pCid=0x19e770*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0202.781] WbemLocator:IUnknown:Release (This=0x5b4f9c) returned 0x3 [0202.781] CoGetContextToken (in: pToken=0x19e7c8 | out: pToken=0x19e7c8) returned 0x0 [0202.781] CoGetContextToken (in: pToken=0x19ebd0 | out: pToken=0x19ebd0) returned 0x0 [0202.781] WbemLocator:IUnknown:QueryInterface (in: This=0x5b5040, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec60 | out: ppvObject=0x19ec60*=0x5b5024) returned 0x0 [0202.781] WbemLocator:IRpcOptions:Query (in: This=0x5b5024, pPrx=0x5b5040, dwProperty=2, pdwValue=0x19ec88 | out: pdwValue=0x19ec88) returned 0x80004002 [0202.781] WbemLocator:IUnknown:Release (This=0x5b5024) returned 0x3 [0202.781] WbemLocator:IUnknown:Release (This=0x5b5040) returned 0x2 [0202.781] CoGetContextToken (in: pToken=0x19f1a8 | out: pToken=0x19f1a8) returned 0x0 [0202.781] CoGetContextToken (in: pToken=0x19f108 | out: pToken=0x19f108) returned 0x0 [0202.781] WbemLocator:IUnknown:QueryInterface (in: This=0x5b5040, riid=0x19f1d8*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f1d4 | out: ppvObject=0x19f1d4*=0x5b6650) returned 0x0 [0202.781] IUnknown:AddRef (This=0x5b6650) returned 0x4 [0202.781] IUnknown:Release (This=0x5b6650) returned 0x3 [0202.781] IUnknown:Release (This=0x5b6650) returned 0x2 [0202.781] IUnknown:Release (This=0x5b6588) returned 0x2 [0202.782] SysStringLen (param_1=0x0) returned 0x0 [0202.782] IEnumWbemClassObject:Reset (This=0x5b6650) returned 0x0 [0202.829] CoTaskMemAlloc (cb=0x4) returned 0x5c1ea8 [0202.830] IEnumWbemClassObject:Next (in: This=0x5b6650, lTimeout=-1, uCount=0x1, apObjects=0x5c1ea8, puReturned=0x2184f44 | out: apObjects=0x5c1ea8*=0x5eee38, puReturned=0x2184f44*=0x1) returned 0x0 [0212.657] IUnknown:QueryInterface (in: This=0x5eee38, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea58 | out: ppvObject=0x19ea58*=0x5eee38) returned 0x0 [0212.657] IUnknown:QueryInterface (in: This=0x5eee38, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ea14 | out: ppvObject=0x19ea14*=0x0) returned 0x80004002 [0212.657] IUnknown:QueryInterface (in: This=0x5eee38, riid=0x6bdafb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e834 | out: ppvObject=0x19e834*=0x0) returned 0x80004002 [0212.657] IUnknown:QueryInterface (in: This=0x5eee38, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e60c | out: ppvObject=0x19e60c*=0x0) returned 0x80004002 [0212.658] IUnknown:AddRef (This=0x5eee38) returned 0x3 [0212.658] IUnknown:QueryInterface (in: This=0x5eee38, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e374 | out: ppvObject=0x19e374*=0x0) returned 0x80004002 [0212.658] IUnknown:QueryInterface (in: This=0x5eee38, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e324 | out: ppvObject=0x19e324*=0x0) returned 0x80004002 [0212.658] IUnknown:QueryInterface (in: This=0x5eee38, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e330 | out: ppvObject=0x19e330*=0x5eee3c) returned 0x0 [0212.658] IMarshal:GetUnmarshalClass (in: This=0x5eee3c, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e338 | out: pCid=0x19e338*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0212.658] IUnknown:Release (This=0x5eee3c) returned 0x3 [0212.658] CoGetContextToken (in: pToken=0x19e390 | out: pToken=0x19e390) returned 0x0 [0212.659] CoGetContextToken (in: pToken=0x19e798 | out: pToken=0x19e798) returned 0x0 [0212.659] IUnknown:QueryInterface (in: This=0x5eee38, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e828 | out: ppvObject=0x19e828*=0x0) returned 0x80004002 [0212.659] IUnknown:Release (This=0x5eee38) returned 0x2 [0212.659] CoGetContextToken (in: pToken=0x19ed68 | out: pToken=0x19ed68) returned 0x0 [0212.659] CoGetContextToken (in: pToken=0x19ecc8 | out: pToken=0x19ecc8) returned 0x0 [0212.659] IUnknown:QueryInterface (in: This=0x5eee38, riid=0x19ed98*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ed94 | out: ppvObject=0x19ed94*=0x5eee38) returned 0x0 [0212.659] IUnknown:AddRef (This=0x5eee38) returned 0x4 [0212.659] IUnknown:Release (This=0x5eee38) returned 0x3 [0212.660] IUnknown:Release (This=0x5eee38) returned 0x2 [0212.661] CoTaskMemFree (pv=0x5c1ea8) [0212.661] CoGetContextToken (in: pToken=0x19f0d0 | out: pToken=0x19f0d0) returned 0x0 [0212.661] IUnknown:AddRef (This=0x5eee38) returned 0x3 [0212.662] IWbemClassObject:Get (in: This=0x5eee38, wszName="__GENUS", lFlags=0, pVal=0x19f3e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f464*=0, plFlavor=0x19f460*=0 | out: pVal=0x19f3e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f464*=3, plFlavor=0x19f460*=64) returned 0x0 [0212.663] IWbemClassObject:Get (in: This=0x5eee38, wszName="__PATH", lFlags=0, pVal=0x19f3c8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f44c*=0, plFlavor=0x19f448*=0 | out: pVal=0x19f3c8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"", varVal2=0x0), pType=0x19f44c*=8, plFlavor=0x19f448*=64) returned 0x0 [0212.664] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x66 [0212.664] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x66 [0212.665] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4e4 [0212.665] SetEvent (hEvent=0x468) returned 1 [0212.666] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f3a0*=0x4e4, lpdwindex=0x19f1bc | out: lpdwindex=0x19f1bc) returned 0x0 [0212.677] CoGetContextToken (in: pToken=0x19f270 | out: pToken=0x19f270) returned 0x0 [0212.677] CoGetContextToken (in: pToken=0x19f1d0 | out: pToken=0x19f1d0) returned 0x0 [0212.677] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0960, riid=0x19f2a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x5e0960) returned 0x0 [0212.677] WbemDefPath:IUnknown:AddRef (This=0x5e0960) returned 0x3 [0212.677] WbemDefPath:IUnknown:Release (This=0x5e0960) returned 0x2 [0212.677] WbemDefPath:IWbemPath:SetText (This=0x5e0960, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x0 [0212.678] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x59e028, puCount=0x19f420 | out: puCount=0x19f420*=0x2) returned 0x0 [0212.678] WbemDefPath:IWbemPath:GetText (in: This=0x59e028, lFlags=4, puBuffLength=0x19f41c*=0x0, pszText=0x0 | out: puBuffLength=0x19f41c*=0xf, pszText=0x0) returned 0x0 [0212.678] WbemDefPath:IWbemPath:GetText (in: This=0x59e028, lFlags=4, puBuffLength=0x19f41c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f41c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0212.678] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x59e028, puCount=0x19f400 | out: puCount=0x19f400*=0x2) returned 0x0 [0212.678] WbemDefPath:IWbemPath:GetText (in: This=0x59e028, lFlags=4, puBuffLength=0x19f3fc*=0x0, pszText=0x0 | out: puBuffLength=0x19f3fc*=0xf, pszText=0x0) returned 0x0 [0212.678] WbemDefPath:IWbemPath:GetText (in: This=0x59e028, lFlags=4, puBuffLength=0x19f3fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0212.687] IWbemClassObject:Get (in: This=0x5eee38, wszName="processorID", lFlags=0, pVal=0x19f3fc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21857f4*=0, plFlavor=0x21857f8*=0 | out: pVal=0x19f3fc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0F8BFBFF00050654", varVal2=0x0), pType=0x21857f4*=8, plFlavor=0x21857f8*=0) returned 0x0 [0212.687] SysStringByteLen (bstr="0F8BFBFF00050654") returned 0x20 [0212.687] SysStringByteLen (bstr="0F8BFBFF00050654") returned 0x20 [0212.688] IWbemClassObject:Get (in: This=0x5eee38, wszName="processorID", lFlags=0, pVal=0x19f404*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21857f4*=8, plFlavor=0x21857f8*=0 | out: pVal=0x19f404*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0F8BFBFF00050654", varVal2=0x0), pType=0x21857f4*=8, plFlavor=0x21857f8*=0) returned 0x0 [0212.688] SysStringByteLen (bstr="0F8BFBFF00050654") returned 0x20 [0212.688] SysStringByteLen (bstr="0F8BFBFF00050654") returned 0x20 [0212.690] CoTaskMemAlloc (cb=0x4) returned 0x5c1d88 [0212.690] IEnumWbemClassObject:Next (in: This=0x5b6650, lTimeout=-1, uCount=0x1, apObjects=0x5c1d88, puReturned=0x2184f44 | out: apObjects=0x5c1d88*=0x0, puReturned=0x2184f44*=0x0) returned 0x1 [0212.692] CoTaskMemFree (pv=0x5c1d88) [0212.692] CoGetContextToken (in: pToken=0x19f320 | out: pToken=0x19f320) returned 0x0 [0212.692] WbemLocator:IUnknown:Release (This=0x5b5040) returned 0x1 [0212.692] IUnknown:Release (This=0x5b6650) returned 0x0 [0212.723] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4e8 [0212.723] SetEvent (hEvent=0x468) returned 1 [0212.724] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f3c4*=0x4e8, lpdwindex=0x19f1e4 | out: lpdwindex=0x19f1e4) returned 0x0 [0212.729] CoGetContextToken (in: pToken=0x19f290 | out: pToken=0x19f290) returned 0x0 [0212.729] CoGetContextToken (in: pToken=0x19f1f0 | out: pToken=0x19f1f0) returned 0x0 [0212.729] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e09d0, riid=0x19f2c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f2bc | out: ppvObject=0x19f2bc*=0x5e09d0) returned 0x0 [0212.730] WbemDefPath:IUnknown:AddRef (This=0x5e09d0) returned 0x3 [0212.730] WbemDefPath:IUnknown:Release (This=0x5e09d0) returned 0x2 [0212.730] WbemDefPath:IWbemPath:SetText (This=0x5e09d0, uMode=0x4, pszPath="Win32_NetworkAdapterConfiguration") returned 0x0 [0212.730] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5e09d0, puCount=0x19f444 | out: puCount=0x19f444*=0x0) returned 0x0 [0212.730] WbemDefPath:IWbemPath:GetText (in: This=0x5e09d0, lFlags=2, puBuffLength=0x19f440*=0x0, pszText=0x0 | out: puBuffLength=0x19f440*=0x22, pszText=0x0) returned 0x0 [0212.730] WbemDefPath:IWbemPath:GetText (in: This=0x5e09d0, lFlags=2, puBuffLength=0x19f440*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x19f440*=0x22, pszText="Win32_NetworkAdapterConfiguration") returned 0x0 [0212.730] WbemDefPath:IWbemPath:GetInfo (in: This=0x5e09d0, uRequestedInfo=0x0, puResponse=0x19f44c | out: puResponse=0x19f44c*=0xc15) returned 0x0 [0212.730] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5e09d0, puCount=0x19f444 | out: puCount=0x19f444*=0x0) returned 0x0 [0212.730] WbemDefPath:IWbemPath:GetInfo (in: This=0x5e09d0, uRequestedInfo=0x0, puResponse=0x19f44c | out: puResponse=0x19f44c*=0xc15) returned 0x0 [0212.730] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5e09d0, puCount=0x19f434 | out: puCount=0x19f434*=0x0) returned 0x0 [0212.730] WbemDefPath:IWbemPath:GetText (in: This=0x5e09d0, lFlags=2, puBuffLength=0x19f430*=0x0, pszText=0x0 | out: puBuffLength=0x19f430*=0x22, pszText=0x0) returned 0x0 [0212.730] WbemDefPath:IWbemPath:GetText (in: This=0x5e09d0, lFlags=2, puBuffLength=0x19f430*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x19f430*=0x22, pszText="Win32_NetworkAdapterConfiguration") returned 0x0 [0212.730] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5e09d0, puCount=0x19f434 | out: puCount=0x19f434*=0x0) returned 0x0 [0212.730] WbemDefPath:IWbemPath:GetText (in: This=0x5e09d0, lFlags=2, puBuffLength=0x19f430*=0x0, pszText=0x0 | out: puBuffLength=0x19f430*=0x22, pszText=0x0) returned 0x0 [0212.730] WbemDefPath:IWbemPath:GetText (in: This=0x5e09d0, lFlags=2, puBuffLength=0x19f430*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x19f430*=0x22, pszText="Win32_NetworkAdapterConfiguration") returned 0x0 [0212.730] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5e09d0, puCount=0x19f3c4 | out: puCount=0x19f3c4*=0x0) returned 0x0 [0212.730] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5c3310, puCount=0x19f3b0 | out: puCount=0x19f3b0*=0x2) returned 0x0 [0212.730] WbemDefPath:IWbemPath:GetText (in: This=0x5c3310, lFlags=4, puBuffLength=0x19f3ac*=0x0, pszText=0x0 | out: puBuffLength=0x19f3ac*=0xf, pszText=0x0) returned 0x0 [0212.730] WbemDefPath:IWbemPath:GetText (in: This=0x5c3310, lFlags=4, puBuffLength=0x19f3ac*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3ac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0212.731] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4ec [0212.731] SetEvent (hEvent=0x468) returned 1 [0212.731] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f30c*=0x4ec, lpdwindex=0x19f12c | out: lpdwindex=0x19f12c) returned 0x0 [0212.734] CoGetContextToken (in: pToken=0x19f1d8 | out: pToken=0x19f1d8) returned 0x0 [0212.734] CoGetContextToken (in: pToken=0x19f138 | out: pToken=0x19f138) returned 0x0 [0212.735] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0a40, riid=0x19f208*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x5e0a40) returned 0x0 [0212.735] WbemDefPath:IUnknown:AddRef (This=0x5e0a40) returned 0x3 [0212.735] WbemDefPath:IUnknown:Release (This=0x5e0a40) returned 0x2 [0212.735] WbemDefPath:IWbemPath:SetText (This=0x5e0a40, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0212.735] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5e0a40, puCount=0x19f388 | out: puCount=0x19f388*=0x2) returned 0x0 [0212.735] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=4, puBuffLength=0x19f384*=0x0, pszText=0x0 | out: puBuffLength=0x19f384*=0xf, pszText=0x0) returned 0x0 [0212.735] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=4, puBuffLength=0x19f384*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f384*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0212.756] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f2a8*=0x500, lpdwindex=0x19f15c | out: lpdwindex=0x19f15c) returned 0x0 [0212.793] CoGetContextToken (in: pToken=0x19f0a0 | out: pToken=0x19f0a0) returned 0x0 [0212.793] CoGetContextToken (in: pToken=0x19f048 | out: pToken=0x19f048) returned 0x0 [0212.793] IUnknown:QueryInterface (in: This=0x564140, riid=0x6bd28724*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f028 | out: ppvObject=0x19f028*=0x564150) returned 0x0 [0212.794] CObjectContext::ContextCallback () returned 0x0 [0212.796] IUnknown:Release (This=0x564150) returned 0x1 [0212.797] CoUnmarshalInterface (in: pStm=0x5a4808, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f090 | out: ppv=0x19f090*=0x5b4840) returned 0x0 [0212.797] CoMarshalInterface (pStm=0x5a4808, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5b4840, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0212.797] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4840, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ef34 | out: ppvObject=0x19ef34*=0x5b4840) returned 0x0 [0212.798] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4840, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19eef0 | out: ppvObject=0x19eef0*=0x0) returned 0x80004002 [0212.798] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4840, riid=0x6bdafb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed0c | out: ppvObject=0x19ed0c*=0x0) returned 0x80004002 [0212.799] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4840, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19eae4 | out: ppvObject=0x19eae4*=0x0) returned 0x80004002 [0212.799] WbemLocator:IUnknown:AddRef (This=0x5b4840) returned 0x3 [0212.799] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4840, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e84c | out: ppvObject=0x19e84c*=0x0) returned 0x80004002 [0212.800] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4840, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0212.800] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4840, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e808 | out: ppvObject=0x19e808*=0x5b479c) returned 0x0 [0212.800] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5b479c, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e810 | out: pCid=0x19e810*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0212.800] WbemLocator:IUnknown:Release (This=0x5b479c) returned 0x3 [0212.800] CoGetContextToken (in: pToken=0x19e868 | out: pToken=0x19e868) returned 0x0 [0212.800] CoGetContextToken (in: pToken=0x19ec70 | out: pToken=0x19ec70) returned 0x0 [0212.800] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4840, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed00 | out: ppvObject=0x19ed00*=0x5b4824) returned 0x0 [0212.800] WbemLocator:IRpcOptions:Query (in: This=0x5b4824, pPrx=0x5b4840, dwProperty=2, pdwValue=0x19ed28 | out: pdwValue=0x19ed28) returned 0x0 [0212.800] WbemLocator:IUnknown:Release (This=0x5b4824) returned 0x3 [0212.800] WbemLocator:IUnknown:Release (This=0x5b4840) returned 0x2 [0212.800] WbemLocator:IUnknown:Release (This=0x5b4840) returned 0x1 [0212.800] CoGetContextToken (in: pToken=0x19efe0 | out: pToken=0x19efe0) returned 0x0 [0212.800] WbemLocator:IUnknown:AddRef (This=0x5b4840) returned 0x2 [0212.801] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4840, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x5b481c) returned 0x0 [0212.801] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5b481c, pProxy=0x5b4840, pAuthnSvc=0x19f2ec, pAuthzSvc=0x19f2e8, pServerPrincName=0x19f2e0, pAuthnLevel=0x19f2e4, pImpLevel=0x19f2d4, pAuthInfo=0x19f2d8, pCapabilites=0x19f2dc | out: pAuthnSvc=0x19f2ec*=0xa, pAuthzSvc=0x19f2e8*=0x0, pServerPrincName=0x19f2e0, pAuthnLevel=0x19f2e4*=0x6, pImpLevel=0x19f2d4*=0x2, pAuthInfo=0x19f2d8, pCapabilites=0x19f2dc*=0x1) returned 0x0 [0212.801] WbemLocator:IUnknown:Release (This=0x5b481c) returned 0x2 [0212.801] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4840, riid=0x6c5910f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f290 | out: ppvObject=0x19f290*=0x5b4840) returned 0x0 [0212.801] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4840, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f28c | out: ppvObject=0x19f28c*=0x5b481c) returned 0x0 [0212.801] WbemLocator:IClientSecurity:SetBlanket (This=0x5b481c, pProxy=0x5b4840, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0212.801] WbemLocator:IUnknown:Release (This=0x5b481c) returned 0x3 [0212.801] WbemLocator:IUnknown:Release (This=0x5b4840) returned 0x2 [0212.801] CoTaskMemFree (pv=0x5c3018) [0212.802] WbemLocator:IUnknown:Release (This=0x5b4840) returned 0x1 [0212.802] SysStringLen (param_1=0x0) returned 0x0 [0212.802] CoGetContextToken (in: pToken=0x19f258 | out: pToken=0x19f258) returned 0x0 [0212.802] CoGetContextToken (in: pToken=0x19f1b8 | out: pToken=0x19f1b8) returned 0x0 [0212.802] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4840, riid=0x19f288*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19f284 | out: ppvObject=0x19f284*=0x5b26a0) returned 0x0 [0212.802] WbemLocator:IUnknown:AddRef (This=0x5b26a0) returned 0x3 [0212.802] WbemLocator:IUnknown:Release (This=0x5b26a0) returned 0x2 [0212.803] CoGetContextToken (in: pToken=0x19f218 | out: pToken=0x19f218) returned 0x0 [0212.803] WbemLocator:IUnknown:AddRef (This=0x5b26a0) returned 0x3 [0212.803] WbemLocator:IUnknown:QueryInterface (in: This=0x5b26a0, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x5b481c) returned 0x0 [0212.803] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5b481c, pProxy=0x5b26a0, pAuthnSvc=0x19f2ec, pAuthzSvc=0x19f2e8, pServerPrincName=0x19f2e0, pAuthnLevel=0x19f2e4, pImpLevel=0x19f2d4, pAuthInfo=0x19f2d8, pCapabilites=0x19f2dc | out: pAuthnSvc=0x19f2ec*=0xa, pAuthzSvc=0x19f2e8*=0x0, pServerPrincName=0x19f2e0, pAuthnLevel=0x19f2e4*=0x6, pImpLevel=0x19f2d4*=0x2, pAuthInfo=0x19f2d8, pCapabilites=0x19f2dc*=0x1) returned 0x0 [0212.803] WbemLocator:IUnknown:Release (This=0x5b481c) returned 0x3 [0212.803] WbemLocator:IUnknown:QueryInterface (in: This=0x5b26a0, riid=0x6c5910f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f290 | out: ppvObject=0x19f290*=0x5b4840) returned 0x0 [0212.803] WbemLocator:IUnknown:QueryInterface (in: This=0x5b26a0, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f28c | out: ppvObject=0x19f28c*=0x5b481c) returned 0x0 [0212.803] WbemLocator:IClientSecurity:SetBlanket (This=0x5b481c, pProxy=0x5b26a0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0212.803] WbemLocator:IUnknown:Release (This=0x5b481c) returned 0x4 [0212.803] WbemLocator:IUnknown:Release (This=0x5b4840) returned 0x3 [0212.803] CoTaskMemFree (pv=0x5c30d8) [0212.804] WbemLocator:IUnknown:Release (This=0x5b26a0) returned 0x2 [0212.804] SysStringLen (param_1=0x0) returned 0x0 [0212.804] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5e0a40, puCount=0x19f3ac | out: puCount=0x19f3ac*=0x2) returned 0x0 [0212.804] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=4, puBuffLength=0x19f3a8*=0x0, pszText=0x0 | out: puBuffLength=0x19f3a8*=0xf, pszText=0x0) returned 0x0 [0212.804] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=4, puBuffLength=0x19f3a8*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3a8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0212.804] CoGetContextToken (in: pToken=0x19f018 | out: pToken=0x19f018) returned 0x0 [0212.804] CoUnmarshalInterface (in: pStm=0x5a4808, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f008 | out: ppv=0x19f008*=0x5b4840) returned 0x0 [0212.805] CoMarshalInterface (pStm=0x5a4808, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5b4840, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0212.805] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4840, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eeac | out: ppvObject=0x19eeac*=0x5b4840) returned 0x0 [0212.805] WbemLocator:IUnknown:Release (This=0x5b4840) returned 0x3 [0212.805] WbemLocator:IUnknown:Release (This=0x5b4840) returned 0x2 [0212.805] CoGetContextToken (in: pToken=0x19ef58 | out: pToken=0x19ef58) returned 0x0 [0212.805] WbemLocator:IUnknown:AddRef (This=0x5b4840) returned 0x3 [0212.806] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4840, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f214 | out: ppvObject=0x19f214*=0x5b481c) returned 0x0 [0212.806] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5b481c, pProxy=0x5b4840, pAuthnSvc=0x19f264, pAuthzSvc=0x19f260, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c, pImpLevel=0x19f24c, pAuthInfo=0x19f250, pCapabilites=0x19f254 | out: pAuthnSvc=0x19f264*=0xa, pAuthzSvc=0x19f260*=0x0, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c*=0x6, pImpLevel=0x19f24c*=0x3, pAuthInfo=0x19f250, pCapabilites=0x19f254*=0x20) returned 0x0 [0212.806] WbemLocator:IUnknown:Release (This=0x5b481c) returned 0x3 [0212.806] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4840, riid=0x6c5910f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f208 | out: ppvObject=0x19f208*=0x5b4840) returned 0x0 [0212.806] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4840, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x5b481c) returned 0x0 [0212.806] WbemLocator:IClientSecurity:SetBlanket (This=0x5b481c, pProxy=0x5b4840, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0212.806] WbemLocator:IUnknown:Release (This=0x5b481c) returned 0x4 [0212.806] WbemLocator:IUnknown:Release (This=0x5b4840) returned 0x3 [0212.806] WbemLocator:IUnknown:Release (This=0x5b4840) returned 0x2 [0212.806] SysStringLen (param_1=0x0) returned 0x0 [0212.807] CoGetContextToken (in: pToken=0x19f1d0 | out: pToken=0x19f1d0) returned 0x0 [0212.807] WbemLocator:IUnknown:AddRef (This=0x5b26a0) returned 0x3 [0212.807] WbemLocator:IUnknown:Release (This=0x5b26a0) returned 0x2 [0212.808] CoGetContextToken (in: pToken=0x19f190 | out: pToken=0x19f190) returned 0x0 [0212.808] WbemLocator:IUnknown:AddRef (This=0x5b26a0) returned 0x3 [0212.808] WbemLocator:IUnknown:QueryInterface (in: This=0x5b26a0, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f214 | out: ppvObject=0x19f214*=0x5b481c) returned 0x0 [0212.809] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5b481c, pProxy=0x5b26a0, pAuthnSvc=0x19f264, pAuthzSvc=0x19f260, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c, pImpLevel=0x19f24c, pAuthInfo=0x19f250, pCapabilites=0x19f254 | out: pAuthnSvc=0x19f264*=0xa, pAuthzSvc=0x19f260*=0x0, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c*=0x6, pImpLevel=0x19f24c*=0x3, pAuthInfo=0x19f250, pCapabilites=0x19f254*=0x20) returned 0x0 [0212.809] WbemLocator:IUnknown:Release (This=0x5b481c) returned 0x3 [0212.809] WbemLocator:IUnknown:QueryInterface (in: This=0x5b26a0, riid=0x6c5910f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f208 | out: ppvObject=0x19f208*=0x5b4840) returned 0x0 [0212.809] WbemLocator:IUnknown:QueryInterface (in: This=0x5b26a0, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x5b481c) returned 0x0 [0212.809] WbemLocator:IClientSecurity:SetBlanket (This=0x5b481c, pProxy=0x5b26a0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0212.809] WbemLocator:IUnknown:Release (This=0x5b481c) returned 0x4 [0212.809] WbemLocator:IUnknown:Release (This=0x5b4840) returned 0x3 [0212.809] WbemLocator:IUnknown:Release (This=0x5b26a0) returned 0x2 [0212.809] SysStringLen (param_1=0x0) returned 0x0 [0212.810] WbemDefPath:IWbemPath:GetText (in: This=0x5e09d0, lFlags=2, puBuffLength=0x19f3b0*=0x0, pszText=0x0 | out: puBuffLength=0x19f3b0*=0x22, pszText=0x0) returned 0x0 [0212.810] WbemDefPath:IWbemPath:GetText (in: This=0x5e09d0, lFlags=2, puBuffLength=0x19f3b0*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x19f3b0*=0x22, pszText="Win32_NetworkAdapterConfiguration") returned 0x0 [0212.810] IWbemServices:GetObject (in: This=0x5b26a0, strObjectPath="Win32_NetworkAdapterConfiguration", lFlags=0, pCtx=0x0, ppObject=0x19f364*=0x0, ppCallResult=0x0 | out: ppObject=0x19f364*=0x5f1088, ppCallResult=0x0) returned 0x0 [0212.841] IWbemClassObject:Get (in: This=0x5f1088, wszName="__PATH", lFlags=0, pVal=0x19f34c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f3f4*=0, plFlavor=0x19f3f0*=0 | out: pVal=0x19f34c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_NetworkAdapterConfiguration", varVal2=0x0), pType=0x19f3f4*=8, plFlavor=0x19f3f0*=64) returned 0x0 [0212.841] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_NetworkAdapterConfiguration") returned 0x6a [0212.841] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_NetworkAdapterConfiguration") returned 0x6a [0212.841] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x504 [0212.841] SetEvent (hEvent=0x468) returned 1 [0212.841] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f308*=0x504, lpdwindex=0x19f124 | out: lpdwindex=0x19f124) returned 0x0 [0212.847] CoGetContextToken (in: pToken=0x19f1d8 | out: pToken=0x19f1d8) returned 0x0 [0212.847] CoGetContextToken (in: pToken=0x19f138 | out: pToken=0x19f138) returned 0x0 [0212.847] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0420, riid=0x19f208*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x5e0420) returned 0x0 [0212.847] WbemDefPath:IUnknown:AddRef (This=0x5e0420) returned 0x3 [0212.847] WbemDefPath:IUnknown:Release (This=0x5e0420) returned 0x2 [0212.847] WbemDefPath:IWbemPath:SetText (This=0x5e0420, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_NetworkAdapterConfiguration") returned 0x0 [0212.848] IWbemClassObject:Get (in: This=0x5f1088, wszName="__CLASS", lFlags=0, pVal=0x19f3bc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f43c*=0, plFlavor=0x19f438*=0 | out: pVal=0x19f3bc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_NetworkAdapterConfiguration", varVal2=0x0), pType=0x19f43c*=8, plFlavor=0x19f438*=64) returned 0x0 [0212.848] SysStringByteLen (bstr="Win32_NetworkAdapterConfiguration") returned 0x42 [0212.848] SysStringByteLen (bstr="Win32_NetworkAdapterConfiguration") returned 0x42 [0212.848] CoGetContextToken (in: pToken=0x19f1b0 | out: pToken=0x19f1b0) returned 0x0 [0212.848] WbemLocator:IUnknown:AddRef (This=0x5b26a0) returned 0x3 [0212.848] IWbemServices:CreateInstanceEnum (in: This=0x5b26a0, strFilter="Win32_NetworkAdapterConfiguration", lFlags=17, pCtx=0x0, ppEnum=0x19f3b8 | out: ppEnum=0x19f3b8*=0x5b67e0) returned 0x0 [0212.851] IUnknown:QueryInterface (in: This=0x5b67e0, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f228 | out: ppvObject=0x19f228*=0x5b67e4) returned 0x0 [0212.851] IClientSecurity:QueryBlanket (in: This=0x5b67e4, pProxy=0x5b67e0, pAuthnSvc=0x19f278, pAuthzSvc=0x19f274, pServerPrincName=0x19f26c, pAuthnLevel=0x19f270, pImpLevel=0x19f260, pAuthInfo=0x19f264, pCapabilites=0x19f268 | out: pAuthnSvc=0x19f278*=0xa, pAuthzSvc=0x19f274*=0x0, pServerPrincName=0x19f26c, pAuthnLevel=0x19f270*=0x6, pImpLevel=0x19f260*=0x2, pAuthInfo=0x19f264, pCapabilites=0x19f268*=0x1) returned 0x0 [0212.851] IUnknown:Release (This=0x5b67e4) returned 0x1 [0212.851] IUnknown:QueryInterface (in: This=0x5b67e0, riid=0x6c5910f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f21c | out: ppvObject=0x19f21c*=0x5b5140) returned 0x0 [0212.851] IUnknown:QueryInterface (in: This=0x5b67e0, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f218 | out: ppvObject=0x19f218*=0x5b67e4) returned 0x0 [0212.851] IClientSecurity:SetBlanket (This=0x5b67e4, pProxy=0x5b67e0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0212.862] IUnknown:Release (This=0x5b67e4) returned 0x2 [0212.862] WbemLocator:IUnknown:Release (This=0x5b5140) returned 0x1 [0212.862] CoTaskMemFree (pv=0x5c2c88) [0212.862] IUnknown:QueryInterface (in: This=0x5b67e0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee10 | out: ppvObject=0x19ee10*=0x5b5140) returned 0x0 [0212.862] WbemLocator:IUnknown:QueryInterface (in: This=0x5b5140, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19edcc | out: ppvObject=0x19edcc*=0x0) returned 0x80004002 [0212.889] WbemLocator:IUnknown:QueryInterface (in: This=0x5b5140, riid=0x6bdafb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ebec | out: ppvObject=0x19ebec*=0x0) returned 0x80004002 [0212.898] IUnknown:QueryInterface (in: This=0x5b67e0, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e9c4 | out: ppvObject=0x19e9c4*=0x0) returned 0x80004002 [0212.919] WbemLocator:IUnknown:AddRef (This=0x5b5140) returned 0x3 [0212.919] WbemLocator:IUnknown:QueryInterface (in: This=0x5b5140, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e72c | out: ppvObject=0x19e72c*=0x0) returned 0x80004002 [0212.919] WbemLocator:IUnknown:QueryInterface (in: This=0x5b5140, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e6dc | out: ppvObject=0x19e6dc*=0x0) returned 0x80004002 [0212.919] WbemLocator:IUnknown:QueryInterface (in: This=0x5b5140, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e6e8 | out: ppvObject=0x19e6e8*=0x5b509c) returned 0x0 [0212.919] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5b509c, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e6f0 | out: pCid=0x19e6f0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0212.919] WbemLocator:IUnknown:Release (This=0x5b509c) returned 0x3 [0212.919] CoGetContextToken (in: pToken=0x19e748 | out: pToken=0x19e748) returned 0x0 [0212.919] CoGetContextToken (in: pToken=0x19eb50 | out: pToken=0x19eb50) returned 0x0 [0212.919] WbemLocator:IUnknown:QueryInterface (in: This=0x5b5140, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ebe0 | out: ppvObject=0x19ebe0*=0x5b5124) returned 0x0 [0212.919] WbemLocator:IRpcOptions:Query (in: This=0x5b5124, pPrx=0x5b5140, dwProperty=2, pdwValue=0x19ec08 | out: pdwValue=0x19ec08) returned 0x80004002 [0212.919] WbemLocator:IUnknown:Release (This=0x5b5124) returned 0x3 [0212.920] WbemLocator:IUnknown:Release (This=0x5b5140) returned 0x2 [0212.920] CoGetContextToken (in: pToken=0x19f120 | out: pToken=0x19f120) returned 0x0 [0212.920] CoGetContextToken (in: pToken=0x19f080 | out: pToken=0x19f080) returned 0x0 [0212.920] WbemLocator:IUnknown:QueryInterface (in: This=0x5b5140, riid=0x19f150*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f14c | out: ppvObject=0x19f14c*=0x5b67e0) returned 0x0 [0212.920] IUnknown:AddRef (This=0x5b67e0) returned 0x4 [0212.920] IUnknown:Release (This=0x5b67e0) returned 0x3 [0212.920] IUnknown:Release (This=0x5b67e0) returned 0x2 [0212.920] WbemLocator:IUnknown:Release (This=0x5b26a0) returned 0x2 [0212.920] SysStringLen (param_1=0x0) returned 0x0 [0212.920] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5e0a40, puCount=0x19f3f4 | out: puCount=0x19f3f4*=0x2) returned 0x0 [0212.920] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=4, puBuffLength=0x19f3f0*=0x0, pszText=0x0 | out: puBuffLength=0x19f3f0*=0xf, pszText=0x0) returned 0x0 [0212.920] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=4, puBuffLength=0x19f3f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0212.920] CoGetContextToken (in: pToken=0x19f238 | out: pToken=0x19f238) returned 0x0 [0212.920] IUnknown:AddRef (This=0x5b67e0) returned 0x3 [0212.920] IEnumWbemClassObject:Clone (in: This=0x5b67e0, ppEnum=0x19f3f4 | out: ppEnum=0x19f3f4*=0x5b6ee8) returned 0x0 [0212.973] IUnknown:QueryInterface (in: This=0x5b6ee8, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f2b8 | out: ppvObject=0x19f2b8*=0x5b6eec) returned 0x0 [0212.974] IClientSecurity:QueryBlanket (in: This=0x5b6eec, pProxy=0x5b6ee8, pAuthnSvc=0x19f308, pAuthzSvc=0x19f304, pServerPrincName=0x19f2fc, pAuthnLevel=0x19f300, pImpLevel=0x19f2f0, pAuthInfo=0x19f2f4, pCapabilites=0x19f2f8 | out: pAuthnSvc=0x19f308*=0xa, pAuthzSvc=0x19f304*=0x0, pServerPrincName=0x19f2fc, pAuthnLevel=0x19f300*=0x6, pImpLevel=0x19f2f0*=0x2, pAuthInfo=0x19f2f4, pCapabilites=0x19f2f8*=0x1) returned 0x0 [0212.974] IUnknown:Release (This=0x5b6eec) returned 0x1 [0212.974] IUnknown:QueryInterface (in: This=0x5b6ee8, riid=0x6c5910f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f2ac | out: ppvObject=0x19f2ac*=0x5b3540) returned 0x0 [0212.974] IUnknown:QueryInterface (in: This=0x5b6ee8, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f2a8 | out: ppvObject=0x19f2a8*=0x5b6eec) returned 0x0 [0212.974] IClientSecurity:SetBlanket (This=0x5b6eec, pProxy=0x5b6ee8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0213.156] IUnknown:Release (This=0x5b6eec) returned 0x2 [0213.156] WbemLocator:IUnknown:Release (This=0x5b3540) returned 0x1 [0213.156] CoTaskMemFree (pv=0x5c2c88) [0213.156] IUnknown:QueryInterface (in: This=0x5b6ee8, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee94 | out: ppvObject=0x19ee94*=0x5b3540) returned 0x0 [0213.156] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3540, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ee50 | out: ppvObject=0x19ee50*=0x0) returned 0x80004002 [0213.221] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3540, riid=0x6bdafb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ec6c | out: ppvObject=0x19ec6c*=0x0) returned 0x80004002 [0213.268] IUnknown:QueryInterface (in: This=0x5b6ee8, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19ea44 | out: ppvObject=0x19ea44*=0x0) returned 0x80004002 [0213.275] WbemLocator:IUnknown:AddRef (This=0x5b3540) returned 0x3 [0213.275] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3540, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e7ac | out: ppvObject=0x19e7ac*=0x0) returned 0x80004002 [0213.275] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3540, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e75c | out: ppvObject=0x19e75c*=0x0) returned 0x80004002 [0213.275] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3540, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e768 | out: ppvObject=0x19e768*=0x5b349c) returned 0x0 [0213.275] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5b349c, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e770 | out: pCid=0x19e770*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0213.275] WbemLocator:IUnknown:Release (This=0x5b349c) returned 0x3 [0213.275] CoGetContextToken (in: pToken=0x19e7c8 | out: pToken=0x19e7c8) returned 0x0 [0213.276] CoGetContextToken (in: pToken=0x19ebd0 | out: pToken=0x19ebd0) returned 0x0 [0213.276] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3540, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec60 | out: ppvObject=0x19ec60*=0x5b3524) returned 0x0 [0213.276] WbemLocator:IRpcOptions:Query (in: This=0x5b3524, pPrx=0x5b3540, dwProperty=2, pdwValue=0x19ec88 | out: pdwValue=0x19ec88) returned 0x80004002 [0213.276] WbemLocator:IUnknown:Release (This=0x5b3524) returned 0x3 [0213.276] WbemLocator:IUnknown:Release (This=0x5b3540) returned 0x2 [0213.276] CoGetContextToken (in: pToken=0x19f1a8 | out: pToken=0x19f1a8) returned 0x0 [0213.276] CoGetContextToken (in: pToken=0x19f108 | out: pToken=0x19f108) returned 0x0 [0213.276] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3540, riid=0x19f1d8*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f1d4 | out: ppvObject=0x19f1d4*=0x5b6ee8) returned 0x0 [0213.276] IUnknown:AddRef (This=0x5b6ee8) returned 0x4 [0213.276] IUnknown:Release (This=0x5b6ee8) returned 0x3 [0213.276] IUnknown:Release (This=0x5b6ee8) returned 0x2 [0213.276] IUnknown:Release (This=0x5b67e0) returned 0x2 [0213.276] SysStringLen (param_1=0x0) returned 0x0 [0213.276] IEnumWbemClassObject:Reset (This=0x5b6ee8) returned 0x0 [0213.288] CoTaskMemAlloc (cb=0x4) returned 0x5c1e28 [0213.288] IEnumWbemClassObject:Next (in: This=0x5b6ee8, lTimeout=-1, uCount=0x1, apObjects=0x5c1e28, puReturned=0x218744c | out: apObjects=0x5c1e28*=0x5f15a8, puReturned=0x218744c*=0x1) returned 0x0 [0213.296] IUnknown:QueryInterface (in: This=0x5f15a8, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea58 | out: ppvObject=0x19ea58*=0x5f15a8) returned 0x0 [0213.296] IUnknown:QueryInterface (in: This=0x5f15a8, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ea14 | out: ppvObject=0x19ea14*=0x0) returned 0x80004002 [0213.296] IUnknown:QueryInterface (in: This=0x5f15a8, riid=0x6bdafb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e834 | out: ppvObject=0x19e834*=0x0) returned 0x80004002 [0213.296] IUnknown:QueryInterface (in: This=0x5f15a8, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e60c | out: ppvObject=0x19e60c*=0x0) returned 0x80004002 [0213.297] IUnknown:AddRef (This=0x5f15a8) returned 0x3 [0213.297] IUnknown:QueryInterface (in: This=0x5f15a8, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e374 | out: ppvObject=0x19e374*=0x0) returned 0x80004002 [0213.297] IUnknown:QueryInterface (in: This=0x5f15a8, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e324 | out: ppvObject=0x19e324*=0x0) returned 0x80004002 [0213.297] IUnknown:QueryInterface (in: This=0x5f15a8, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e330 | out: ppvObject=0x19e330*=0x5f15ac) returned 0x0 [0213.297] IMarshal:GetUnmarshalClass (in: This=0x5f15ac, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e338 | out: pCid=0x19e338*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0213.297] IUnknown:Release (This=0x5f15ac) returned 0x3 [0213.297] CoGetContextToken (in: pToken=0x19e390 | out: pToken=0x19e390) returned 0x0 [0213.297] CoGetContextToken (in: pToken=0x19e798 | out: pToken=0x19e798) returned 0x0 [0213.297] IUnknown:QueryInterface (in: This=0x5f15a8, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e828 | out: ppvObject=0x19e828*=0x0) returned 0x80004002 [0213.297] IUnknown:Release (This=0x5f15a8) returned 0x2 [0213.297] CoGetContextToken (in: pToken=0x19ed68 | out: pToken=0x19ed68) returned 0x0 [0213.297] CoGetContextToken (in: pToken=0x19ecc8 | out: pToken=0x19ecc8) returned 0x0 [0213.297] IUnknown:QueryInterface (in: This=0x5f15a8, riid=0x19ed98*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ed94 | out: ppvObject=0x19ed94*=0x5f15a8) returned 0x0 [0213.297] IUnknown:AddRef (This=0x5f15a8) returned 0x4 [0213.297] IUnknown:Release (This=0x5f15a8) returned 0x3 [0213.297] IUnknown:Release (This=0x5f15a8) returned 0x2 [0213.298] CoTaskMemFree (pv=0x5c1e28) [0213.298] CoGetContextToken (in: pToken=0x19f0d0 | out: pToken=0x19f0d0) returned 0x0 [0213.298] IUnknown:AddRef (This=0x5f15a8) returned 0x3 [0213.298] IWbemClassObject:Get (in: This=0x5f15a8, wszName="__GENUS", lFlags=0, pVal=0x19f3e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f464*=0, plFlavor=0x19f460*=0 | out: pVal=0x19f3e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f464*=3, plFlavor=0x19f460*=64) returned 0x0 [0213.298] IWbemClassObject:Get (in: This=0x5f15a8, wszName="__PATH", lFlags=0, pVal=0x19f3c8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f44c*=0, plFlavor=0x19f448*=0 | out: pVal=0x19f3c8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=0", varVal2=0x0), pType=0x19f44c*=8, plFlavor=0x19f448*=64) returned 0x0 [0213.298] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=0") returned 0x7a [0213.298] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=0") returned 0x7a [0213.298] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x508 [0213.298] SetEvent (hEvent=0x468) returned 1 [0213.299] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f3a0*=0x508, lpdwindex=0x19f1bc | out: lpdwindex=0x19f1bc) returned 0x0 [0213.302] CoGetContextToken (in: pToken=0x19f270 | out: pToken=0x19f270) returned 0x0 [0213.302] CoGetContextToken (in: pToken=0x19f1d0 | out: pToken=0x19f1d0) returned 0x0 [0213.302] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e06c0, riid=0x19f2a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x5e06c0) returned 0x0 [0213.302] WbemDefPath:IUnknown:AddRef (This=0x5e06c0) returned 0x3 [0213.302] WbemDefPath:IUnknown:Release (This=0x5e06c0) returned 0x2 [0213.302] WbemDefPath:IWbemPath:SetText (This=0x5e06c0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=0") returned 0x0 [0213.303] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5e0a40, puCount=0x19f420 | out: puCount=0x19f420*=0x2) returned 0x0 [0213.303] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=4, puBuffLength=0x19f41c*=0x0, pszText=0x0 | out: puBuffLength=0x19f41c*=0xf, pszText=0x0) returned 0x0 [0213.303] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=4, puBuffLength=0x19f41c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f41c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0213.307] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5e0a40, puCount=0x19f3ec | out: puCount=0x19f3ec*=0x2) returned 0x0 [0213.307] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=4, puBuffLength=0x19f3e8*=0x0, pszText=0x0 | out: puBuffLength=0x19f3e8*=0xf, pszText=0x0) returned 0x0 [0213.307] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=4, puBuffLength=0x19f3e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0213.307] IWbemClassObject:Get (in: This=0x5f15a8, wszName="IPEnabled", lFlags=0, pVal=0x19f3e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2187ce4*=0, plFlavor=0x2187ce8*=0 | out: pVal=0x19f3e8*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2187ce4*=11, plFlavor=0x2187ce8*=0) returned 0x0 [0213.307] IWbemClassObject:Get (in: This=0x5f15a8, wszName="IPEnabled", lFlags=0, pVal=0x19f3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2187ce4*=11, plFlavor=0x2187ce8*=0 | out: pVal=0x19f3f0*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2187ce4*=11, plFlavor=0x2187ce8*=0) returned 0x0 [0213.357] IUnknown:Release (This=0x5f15a8) returned 0x2 [0213.361] CoTaskMemAlloc (cb=0x4) returned 0x5c1e98 [0213.361] IEnumWbemClassObject:Next (in: This=0x5b6ee8, lTimeout=-1, uCount=0x1, apObjects=0x5c1e98, puReturned=0x218744c | out: apObjects=0x5c1e98*=0x4f53238, puReturned=0x218744c*=0x1) returned 0x0 [0213.365] IUnknown:QueryInterface (in: This=0x4f53238, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea58 | out: ppvObject=0x19ea58*=0x4f53238) returned 0x0 [0213.366] IUnknown:QueryInterface (in: This=0x4f53238, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ea14 | out: ppvObject=0x19ea14*=0x0) returned 0x80004002 [0213.366] IUnknown:QueryInterface (in: This=0x4f53238, riid=0x6bdafb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e834 | out: ppvObject=0x19e834*=0x0) returned 0x80004002 [0213.366] IUnknown:QueryInterface (in: This=0x4f53238, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e60c | out: ppvObject=0x19e60c*=0x0) returned 0x80004002 [0213.366] IUnknown:AddRef (This=0x4f53238) returned 0x3 [0213.367] IUnknown:QueryInterface (in: This=0x4f53238, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e374 | out: ppvObject=0x19e374*=0x0) returned 0x80004002 [0213.367] IUnknown:QueryInterface (in: This=0x4f53238, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e324 | out: ppvObject=0x19e324*=0x0) returned 0x80004002 [0213.367] IUnknown:QueryInterface (in: This=0x4f53238, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e330 | out: ppvObject=0x19e330*=0x4f5323c) returned 0x0 [0213.367] IMarshal:GetUnmarshalClass (in: This=0x4f5323c, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e338 | out: pCid=0x19e338*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0213.367] IUnknown:Release (This=0x4f5323c) returned 0x3 [0213.367] CoGetContextToken (in: pToken=0x19e390 | out: pToken=0x19e390) returned 0x0 [0213.368] CoGetContextToken (in: pToken=0x19e798 | out: pToken=0x19e798) returned 0x0 [0213.368] IUnknown:QueryInterface (in: This=0x4f53238, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e828 | out: ppvObject=0x19e828*=0x0) returned 0x80004002 [0213.368] IUnknown:Release (This=0x4f53238) returned 0x2 [0213.368] CoGetContextToken (in: pToken=0x19ed68 | out: pToken=0x19ed68) returned 0x0 [0213.368] CoGetContextToken (in: pToken=0x19ecc8 | out: pToken=0x19ecc8) returned 0x0 [0213.368] IUnknown:QueryInterface (in: This=0x4f53238, riid=0x19ed98*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ed94 | out: ppvObject=0x19ed94*=0x4f53238) returned 0x0 [0213.368] IUnknown:AddRef (This=0x4f53238) returned 0x4 [0213.369] IUnknown:Release (This=0x4f53238) returned 0x3 [0213.369] IUnknown:Release (This=0x4f53238) returned 0x2 [0213.369] CoTaskMemFree (pv=0x5c1e98) [0213.369] CoGetContextToken (in: pToken=0x19f0d0 | out: pToken=0x19f0d0) returned 0x0 [0213.369] IUnknown:AddRef (This=0x4f53238) returned 0x3 [0213.369] IWbemClassObject:Get (in: This=0x4f53238, wszName="__GENUS", lFlags=0, pVal=0x19f3e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f464*=0, plFlavor=0x19f460*=0 | out: pVal=0x19f3e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f464*=3, plFlavor=0x19f460*=64) returned 0x0 [0213.370] IWbemClassObject:Get (in: This=0x4f53238, wszName="__PATH", lFlags=0, pVal=0x19f3c8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f44c*=0, plFlavor=0x19f448*=0 | out: pVal=0x19f3c8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=1", varVal2=0x0), pType=0x19f44c*=8, plFlavor=0x19f448*=64) returned 0x0 [0213.370] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=1") returned 0x7a [0213.370] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=1") returned 0x7a [0213.370] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x50c [0213.370] SetEvent (hEvent=0x468) returned 1 [0213.371] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f3a0*=0x50c, lpdwindex=0x19f1bc | out: lpdwindex=0x19f1bc) returned 0x0 [0213.378] CoGetContextToken (in: pToken=0x19f270 | out: pToken=0x19f270) returned 0x0 [0213.378] CoGetContextToken (in: pToken=0x19f1d0 | out: pToken=0x19f1d0) returned 0x0 [0213.378] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0490, riid=0x19f2a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x5e0490) returned 0x0 [0213.378] WbemDefPath:IUnknown:AddRef (This=0x5e0490) returned 0x3 [0213.379] WbemDefPath:IUnknown:Release (This=0x5e0490) returned 0x2 [0213.379] WbemDefPath:IWbemPath:SetText (This=0x5e0490, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=1") returned 0x0 [0213.379] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5e0a40, puCount=0x19f420 | out: puCount=0x19f420*=0x2) returned 0x0 [0213.379] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=4, puBuffLength=0x19f41c*=0x0, pszText=0x0 | out: puBuffLength=0x19f41c*=0xf, pszText=0x0) returned 0x0 [0213.379] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=4, puBuffLength=0x19f41c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f41c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0213.379] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5e0a40, puCount=0x19f3ec | out: puCount=0x19f3ec*=0x2) returned 0x0 [0213.379] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=4, puBuffLength=0x19f3e8*=0x0, pszText=0x0 | out: puBuffLength=0x19f3e8*=0xf, pszText=0x0) returned 0x0 [0213.379] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=4, puBuffLength=0x19f3e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0213.380] IWbemClassObject:Get (in: This=0x4f53238, wszName="IPEnabled", lFlags=0, pVal=0x19f3e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21887bc*=0, plFlavor=0x21887c0*=0 | out: pVal=0x19f3e8*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21887bc*=11, plFlavor=0x21887c0*=0) returned 0x0 [0213.380] IWbemClassObject:Get (in: This=0x4f53238, wszName="IPEnabled", lFlags=0, pVal=0x19f3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21887bc*=11, plFlavor=0x21887c0*=0 | out: pVal=0x19f3f0*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21887bc*=11, plFlavor=0x21887c0*=0) returned 0x0 [0213.381] IUnknown:Release (This=0x4f53238) returned 0x2 [0213.381] CoTaskMemAlloc (cb=0x4) returned 0x5c1e98 [0213.381] IEnumWbemClassObject:Next (in: This=0x5b6ee8, lTimeout=-1, uCount=0x1, apObjects=0x5c1e98, puReturned=0x218744c | out: apObjects=0x5c1e98*=0x4f53638, puReturned=0x218744c*=0x1) returned 0x0 [0213.384] IUnknown:QueryInterface (in: This=0x4f53638, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea58 | out: ppvObject=0x19ea58*=0x4f53638) returned 0x0 [0213.384] IUnknown:QueryInterface (in: This=0x4f53638, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ea14 | out: ppvObject=0x19ea14*=0x0) returned 0x80004002 [0213.384] IUnknown:QueryInterface (in: This=0x4f53638, riid=0x6bdafb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e834 | out: ppvObject=0x19e834*=0x0) returned 0x80004002 [0213.384] IUnknown:QueryInterface (in: This=0x4f53638, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e60c | out: ppvObject=0x19e60c*=0x0) returned 0x80004002 [0213.385] IUnknown:AddRef (This=0x4f53638) returned 0x3 [0213.385] IUnknown:QueryInterface (in: This=0x4f53638, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e374 | out: ppvObject=0x19e374*=0x0) returned 0x80004002 [0213.385] IUnknown:QueryInterface (in: This=0x4f53638, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e324 | out: ppvObject=0x19e324*=0x0) returned 0x80004002 [0213.386] IUnknown:QueryInterface (in: This=0x4f53638, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e330 | out: ppvObject=0x19e330*=0x4f5363c) returned 0x0 [0213.386] IMarshal:GetUnmarshalClass (in: This=0x4f5363c, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e338 | out: pCid=0x19e338*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0213.386] IUnknown:Release (This=0x4f5363c) returned 0x3 [0213.386] CoGetContextToken (in: pToken=0x19e390 | out: pToken=0x19e390) returned 0x0 [0213.386] CoGetContextToken (in: pToken=0x19e798 | out: pToken=0x19e798) returned 0x0 [0213.386] IUnknown:QueryInterface (in: This=0x4f53638, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e828 | out: ppvObject=0x19e828*=0x0) returned 0x80004002 [0213.387] IUnknown:Release (This=0x4f53638) returned 0x2 [0213.387] CoGetContextToken (in: pToken=0x19ed68 | out: pToken=0x19ed68) returned 0x0 [0213.387] CoGetContextToken (in: pToken=0x19ecc8 | out: pToken=0x19ecc8) returned 0x0 [0213.387] IUnknown:QueryInterface (in: This=0x4f53638, riid=0x19ed98*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ed94 | out: ppvObject=0x19ed94*=0x4f53638) returned 0x0 [0213.387] IUnknown:AddRef (This=0x4f53638) returned 0x4 [0213.387] IUnknown:Release (This=0x4f53638) returned 0x3 [0213.387] IUnknown:Release (This=0x4f53638) returned 0x2 [0213.388] CoTaskMemFree (pv=0x5c1e98) [0213.388] CoGetContextToken (in: pToken=0x19f0d0 | out: pToken=0x19f0d0) returned 0x0 [0213.388] IUnknown:AddRef (This=0x4f53638) returned 0x3 [0213.388] IWbemClassObject:Get (in: This=0x4f53638, wszName="__GENUS", lFlags=0, pVal=0x19f3e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f464*=0, plFlavor=0x19f460*=0 | out: pVal=0x19f3e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f464*=3, plFlavor=0x19f460*=64) returned 0x0 [0213.388] IWbemClassObject:Get (in: This=0x4f53638, wszName="__PATH", lFlags=0, pVal=0x19f3c8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f44c*=0, plFlavor=0x19f448*=0 | out: pVal=0x19f3c8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=2", varVal2=0x0), pType=0x19f44c*=8, plFlavor=0x19f448*=64) returned 0x0 [0213.389] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=2") returned 0x7a [0213.389] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=2") returned 0x7a [0213.389] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x51c [0213.389] SetEvent (hEvent=0x468) returned 1 [0213.389] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f3a0*=0x51c, lpdwindex=0x19f1bc | out: lpdwindex=0x19f1bc) returned 0x0 [0213.396] CoGetContextToken (in: pToken=0x19f270 | out: pToken=0x19f270) returned 0x0 [0213.396] CoGetContextToken (in: pToken=0x19f1d0 | out: pToken=0x19f1d0) returned 0x0 [0213.396] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0730, riid=0x19f2a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x5e0730) returned 0x0 [0213.396] WbemDefPath:IUnknown:AddRef (This=0x5e0730) returned 0x3 [0213.397] WbemDefPath:IUnknown:Release (This=0x5e0730) returned 0x2 [0213.397] WbemDefPath:IWbemPath:SetText (This=0x5e0730, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=2") returned 0x0 [0213.397] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5e0a40, puCount=0x19f420 | out: puCount=0x19f420*=0x2) returned 0x0 [0213.397] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=4, puBuffLength=0x19f41c*=0x0, pszText=0x0 | out: puBuffLength=0x19f41c*=0xf, pszText=0x0) returned 0x0 [0213.397] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=4, puBuffLength=0x19f41c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f41c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0213.397] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5e0a40, puCount=0x19f3ec | out: puCount=0x19f3ec*=0x2) returned 0x0 [0213.397] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=4, puBuffLength=0x19f3e8*=0x0, pszText=0x0 | out: puBuffLength=0x19f3e8*=0xf, pszText=0x0) returned 0x0 [0213.398] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=4, puBuffLength=0x19f3e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0213.398] IWbemClassObject:Get (in: This=0x4f53638, wszName="IPEnabled", lFlags=0, pVal=0x19f3e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2189030*=0, plFlavor=0x2189034*=0 | out: pVal=0x19f3e8*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2189030*=11, plFlavor=0x2189034*=0) returned 0x0 [0213.398] IWbemClassObject:Get (in: This=0x4f53638, wszName="IPEnabled", lFlags=0, pVal=0x19f3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2189030*=11, plFlavor=0x2189034*=0 | out: pVal=0x19f3f0*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2189030*=11, plFlavor=0x2189034*=0) returned 0x0 [0213.398] IUnknown:Release (This=0x4f53638) returned 0x2 [0213.399] CoTaskMemAlloc (cb=0x4) returned 0x5c1e48 [0213.399] IEnumWbemClassObject:Next (in: This=0x5b6ee8, lTimeout=-1, uCount=0x1, apObjects=0x5c1e48, puReturned=0x218744c | out: apObjects=0x5c1e48*=0x4f53a20, puReturned=0x218744c*=0x1) returned 0x0 [0213.404] IUnknown:QueryInterface (in: This=0x4f53a20, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea58 | out: ppvObject=0x19ea58*=0x4f53a20) returned 0x0 [0213.404] IUnknown:QueryInterface (in: This=0x4f53a20, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ea14 | out: ppvObject=0x19ea14*=0x0) returned 0x80004002 [0213.404] IUnknown:QueryInterface (in: This=0x4f53a20, riid=0x6bdafb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e834 | out: ppvObject=0x19e834*=0x0) returned 0x80004002 [0213.405] IUnknown:QueryInterface (in: This=0x4f53a20, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e60c | out: ppvObject=0x19e60c*=0x0) returned 0x80004002 [0213.406] IUnknown:AddRef (This=0x4f53a20) returned 0x3 [0213.406] IUnknown:QueryInterface (in: This=0x4f53a20, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e374 | out: ppvObject=0x19e374*=0x0) returned 0x80004002 [0213.406] IUnknown:QueryInterface (in: This=0x4f53a20, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e324 | out: ppvObject=0x19e324*=0x0) returned 0x80004002 [0213.406] IUnknown:QueryInterface (in: This=0x4f53a20, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e330 | out: ppvObject=0x19e330*=0x4f53a24) returned 0x0 [0213.406] IMarshal:GetUnmarshalClass (in: This=0x4f53a24, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e338 | out: pCid=0x19e338*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0213.406] IUnknown:Release (This=0x4f53a24) returned 0x3 [0213.406] CoGetContextToken (in: pToken=0x19e390 | out: pToken=0x19e390) returned 0x0 [0213.407] CoGetContextToken (in: pToken=0x19e798 | out: pToken=0x19e798) returned 0x0 [0213.407] IUnknown:QueryInterface (in: This=0x4f53a20, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e828 | out: ppvObject=0x19e828*=0x0) returned 0x80004002 [0213.407] IUnknown:Release (This=0x4f53a20) returned 0x2 [0213.407] CoGetContextToken (in: pToken=0x19ed68 | out: pToken=0x19ed68) returned 0x0 [0213.407] CoGetContextToken (in: pToken=0x19ecc8 | out: pToken=0x19ecc8) returned 0x0 [0213.407] IUnknown:QueryInterface (in: This=0x4f53a20, riid=0x19ed98*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ed94 | out: ppvObject=0x19ed94*=0x4f53a20) returned 0x0 [0213.407] IUnknown:AddRef (This=0x4f53a20) returned 0x4 [0213.408] IUnknown:Release (This=0x4f53a20) returned 0x3 [0213.408] IUnknown:Release (This=0x4f53a20) returned 0x2 [0213.408] CoTaskMemFree (pv=0x5c1e48) [0213.408] CoGetContextToken (in: pToken=0x19f0d0 | out: pToken=0x19f0d0) returned 0x0 [0213.408] IUnknown:AddRef (This=0x4f53a20) returned 0x3 [0213.408] IWbemClassObject:Get (in: This=0x4f53a20, wszName="__GENUS", lFlags=0, pVal=0x19f3e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f464*=0, plFlavor=0x19f460*=0 | out: pVal=0x19f3e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f464*=3, plFlavor=0x19f460*=64) returned 0x0 [0213.408] IWbemClassObject:Get (in: This=0x4f53a20, wszName="__PATH", lFlags=0, pVal=0x19f3c8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f44c*=0, plFlavor=0x19f448*=0 | out: pVal=0x19f3c8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=3", varVal2=0x0), pType=0x19f44c*=8, plFlavor=0x19f448*=64) returned 0x0 [0213.409] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=3") returned 0x7a [0213.409] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=3") returned 0x7a [0213.409] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x518 [0213.409] SetEvent (hEvent=0x468) returned 1 [0213.409] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f3a0*=0x518, lpdwindex=0x19f1bc | out: lpdwindex=0x19f1bc) returned 0x0 [0213.421] CoGetContextToken (in: pToken=0x19f270 | out: pToken=0x19f270) returned 0x0 [0213.421] CoGetContextToken (in: pToken=0x19f1d0 | out: pToken=0x19f1d0) returned 0x0 [0213.421] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0650, riid=0x19f2a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x5e0650) returned 0x0 [0213.422] WbemDefPath:IUnknown:AddRef (This=0x5e0650) returned 0x3 [0213.422] WbemDefPath:IUnknown:Release (This=0x5e0650) returned 0x2 [0213.422] WbemDefPath:IWbemPath:SetText (This=0x5e0650, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=3") returned 0x0 [0213.422] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5e0a40, puCount=0x19f420 | out: puCount=0x19f420*=0x2) returned 0x0 [0213.422] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=4, puBuffLength=0x19f41c*=0x0, pszText=0x0 | out: puBuffLength=0x19f41c*=0xf, pszText=0x0) returned 0x0 [0213.422] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=4, puBuffLength=0x19f41c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f41c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0213.422] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5e0a40, puCount=0x19f3ec | out: puCount=0x19f3ec*=0x2) returned 0x0 [0213.422] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=4, puBuffLength=0x19f3e8*=0x0, pszText=0x0 | out: puBuffLength=0x19f3e8*=0xf, pszText=0x0) returned 0x0 [0213.423] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=4, puBuffLength=0x19f3e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0213.423] IWbemClassObject:Get (in: This=0x4f53a20, wszName="IPEnabled", lFlags=0, pVal=0x19f3e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21898a4*=0, plFlavor=0x21898a8*=0 | out: pVal=0x19f3e8*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21898a4*=11, plFlavor=0x21898a8*=0) returned 0x0 [0213.423] IWbemClassObject:Get (in: This=0x4f53a20, wszName="IPEnabled", lFlags=0, pVal=0x19f3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21898a4*=11, plFlavor=0x21898a8*=0 | out: pVal=0x19f3f0*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21898a4*=11, plFlavor=0x21898a8*=0) returned 0x0 [0213.423] IUnknown:Release (This=0x4f53a20) returned 0x2 [0213.423] CoTaskMemAlloc (cb=0x4) returned 0x5c1eb8 [0213.424] IEnumWbemClassObject:Next (in: This=0x5b6ee8, lTimeout=-1, uCount=0x1, apObjects=0x5c1eb8, puReturned=0x218744c | out: apObjects=0x5c1eb8*=0x4f53e10, puReturned=0x218744c*=0x1) returned 0x0 [0213.427] IUnknown:QueryInterface (in: This=0x4f53e10, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea58 | out: ppvObject=0x19ea58*=0x4f53e10) returned 0x0 [0213.428] IUnknown:QueryInterface (in: This=0x4f53e10, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ea14 | out: ppvObject=0x19ea14*=0x0) returned 0x80004002 [0213.428] IUnknown:QueryInterface (in: This=0x4f53e10, riid=0x6bdafb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e834 | out: ppvObject=0x19e834*=0x0) returned 0x80004002 [0213.428] IUnknown:QueryInterface (in: This=0x4f53e10, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e60c | out: ppvObject=0x19e60c*=0x0) returned 0x80004002 [0213.428] IUnknown:AddRef (This=0x4f53e10) returned 0x3 [0213.428] IUnknown:QueryInterface (in: This=0x4f53e10, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e374 | out: ppvObject=0x19e374*=0x0) returned 0x80004002 [0213.428] IUnknown:QueryInterface (in: This=0x4f53e10, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e324 | out: ppvObject=0x19e324*=0x0) returned 0x80004002 [0213.428] IUnknown:QueryInterface (in: This=0x4f53e10, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e330 | out: ppvObject=0x19e330*=0x4f53e14) returned 0x0 [0213.428] IMarshal:GetUnmarshalClass (in: This=0x4f53e14, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e338 | out: pCid=0x19e338*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0213.429] IUnknown:Release (This=0x4f53e14) returned 0x3 [0213.429] CoGetContextToken (in: pToken=0x19e390 | out: pToken=0x19e390) returned 0x0 [0213.429] CoGetContextToken (in: pToken=0x19e798 | out: pToken=0x19e798) returned 0x0 [0213.429] IUnknown:QueryInterface (in: This=0x4f53e10, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e828 | out: ppvObject=0x19e828*=0x0) returned 0x80004002 [0213.429] IUnknown:Release (This=0x4f53e10) returned 0x2 [0213.429] CoGetContextToken (in: pToken=0x19ed68 | out: pToken=0x19ed68) returned 0x0 [0213.429] CoGetContextToken (in: pToken=0x19ecc8 | out: pToken=0x19ecc8) returned 0x0 [0213.429] IUnknown:QueryInterface (in: This=0x4f53e10, riid=0x19ed98*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ed94 | out: ppvObject=0x19ed94*=0x4f53e10) returned 0x0 [0213.429] IUnknown:AddRef (This=0x4f53e10) returned 0x4 [0213.429] IUnknown:Release (This=0x4f53e10) returned 0x3 [0213.429] IUnknown:Release (This=0x4f53e10) returned 0x2 [0213.429] CoTaskMemFree (pv=0x5c1eb8) [0213.430] CoGetContextToken (in: pToken=0x19f0d0 | out: pToken=0x19f0d0) returned 0x0 [0213.430] IUnknown:AddRef (This=0x4f53e10) returned 0x3 [0213.430] IWbemClassObject:Get (in: This=0x4f53e10, wszName="__GENUS", lFlags=0, pVal=0x19f3e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f464*=0, plFlavor=0x19f460*=0 | out: pVal=0x19f3e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f464*=3, plFlavor=0x19f460*=64) returned 0x0 [0213.430] IWbemClassObject:Get (in: This=0x4f53e10, wszName="__PATH", lFlags=0, pVal=0x19f3c8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f44c*=0, plFlavor=0x19f448*=0 | out: pVal=0x19f3c8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=4", varVal2=0x0), pType=0x19f44c*=8, plFlavor=0x19f448*=64) returned 0x0 [0213.430] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=4") returned 0x7a [0213.430] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=4") returned 0x7a [0213.430] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x520 [0213.430] SetEvent (hEvent=0x468) returned 1 [0213.431] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f3a0*=0x520, lpdwindex=0x19f1bc | out: lpdwindex=0x19f1bc) returned 0x0 [0213.434] CoGetContextToken (in: pToken=0x19f270 | out: pToken=0x19f270) returned 0x0 [0213.434] CoGetContextToken (in: pToken=0x19f1d0 | out: pToken=0x19f1d0) returned 0x0 [0213.434] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0ab0, riid=0x19f2a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x5e0ab0) returned 0x0 [0213.434] WbemDefPath:IUnknown:AddRef (This=0x5e0ab0) returned 0x3 [0213.434] WbemDefPath:IUnknown:Release (This=0x5e0ab0) returned 0x2 [0213.434] WbemDefPath:IWbemPath:SetText (This=0x5e0ab0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=4") returned 0x0 [0213.434] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5e0a40, puCount=0x19f420 | out: puCount=0x19f420*=0x2) returned 0x0 [0213.434] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=4, puBuffLength=0x19f41c*=0x0, pszText=0x0 | out: puBuffLength=0x19f41c*=0xf, pszText=0x0) returned 0x0 [0213.434] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=4, puBuffLength=0x19f41c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f41c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0213.434] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5e0a40, puCount=0x19f3ec | out: puCount=0x19f3ec*=0x2) returned 0x0 [0213.435] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=4, puBuffLength=0x19f3e8*=0x0, pszText=0x0 | out: puBuffLength=0x19f3e8*=0xf, pszText=0x0) returned 0x0 [0213.435] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=4, puBuffLength=0x19f3e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0213.435] IWbemClassObject:Get (in: This=0x4f53e10, wszName="IPEnabled", lFlags=0, pVal=0x19f3e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x218a118*=0, plFlavor=0x218a11c*=0 | out: pVal=0x19f3e8*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xffff, varVal2=0x0), pType=0x218a118*=11, plFlavor=0x218a11c*=0) returned 0x0 [0213.435] IWbemClassObject:Get (in: This=0x4f53e10, wszName="IPEnabled", lFlags=0, pVal=0x19f3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x218a118*=11, plFlavor=0x218a11c*=0 | out: pVal=0x19f3f0*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xffff, varVal2=0x0), pType=0x218a118*=11, plFlavor=0x218a11c*=0) returned 0x0 [0213.438] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5e0a40, puCount=0x19f3ec | out: puCount=0x19f3ec*=0x2) returned 0x0 [0213.439] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=4, puBuffLength=0x19f3e8*=0x0, pszText=0x0 | out: puBuffLength=0x19f3e8*=0xf, pszText=0x0) returned 0x0 [0213.439] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=4, puBuffLength=0x19f3e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0213.439] IWbemClassObject:Get (in: This=0x4f53e10, wszName="MacAddress", lFlags=0, pVal=0x19f3e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x218a1b4*=0, plFlavor=0x218a1b8*=0 | out: pVal=0x19f3e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="38:6E:21:4A:9F:7D", varVal2=0x0), pType=0x218a1b4*=8, plFlavor=0x218a1b8*=0) returned 0x0 [0213.439] SysStringByteLen (bstr="38:6E:21:4A:9F:7D") returned 0x22 [0213.439] SysStringByteLen (bstr="38:6E:21:4A:9F:7D") returned 0x22 [0213.439] IWbemClassObject:Get (in: This=0x4f53e10, wszName="MacAddress", lFlags=0, pVal=0x19f3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x218a1b4*=8, plFlavor=0x218a1b8*=0 | out: pVal=0x19f3f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="38:6E:21:4A:9F:7D", varVal2=0x0), pType=0x218a1b4*=8, plFlavor=0x218a1b8*=0) returned 0x0 [0213.439] SysStringByteLen (bstr="38:6E:21:4A:9F:7D") returned 0x22 [0213.439] SysStringByteLen (bstr="38:6E:21:4A:9F:7D") returned 0x22 [0213.439] IUnknown:Release (This=0x4f53e10) returned 0x2 [0213.440] CoTaskMemAlloc (cb=0x4) returned 0x5c1f18 [0213.440] IEnumWbemClassObject:Next (in: This=0x5b6ee8, lTimeout=-1, uCount=0x1, apObjects=0x5c1f18, puReturned=0x218744c | out: apObjects=0x5c1f18*=0x5ec408, puReturned=0x218744c*=0x1) returned 0x0 [0213.441] IUnknown:QueryInterface (in: This=0x5ec408, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea58 | out: ppvObject=0x19ea58*=0x5ec408) returned 0x0 [0213.442] IUnknown:QueryInterface (in: This=0x5ec408, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ea14 | out: ppvObject=0x19ea14*=0x0) returned 0x80004002 [0213.442] IUnknown:QueryInterface (in: This=0x5ec408, riid=0x6bdafb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e834 | out: ppvObject=0x19e834*=0x0) returned 0x80004002 [0213.442] IUnknown:QueryInterface (in: This=0x5ec408, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e60c | out: ppvObject=0x19e60c*=0x0) returned 0x80004002 [0213.442] IUnknown:AddRef (This=0x5ec408) returned 0x3 [0213.442] IUnknown:QueryInterface (in: This=0x5ec408, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e374 | out: ppvObject=0x19e374*=0x0) returned 0x80004002 [0213.442] IUnknown:QueryInterface (in: This=0x5ec408, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e324 | out: ppvObject=0x19e324*=0x0) returned 0x80004002 [0213.442] IUnknown:QueryInterface (in: This=0x5ec408, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e330 | out: ppvObject=0x19e330*=0x5ec40c) returned 0x0 [0213.442] IMarshal:GetUnmarshalClass (in: This=0x5ec40c, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e338 | out: pCid=0x19e338*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0213.442] IUnknown:Release (This=0x5ec40c) returned 0x3 [0213.442] CoGetContextToken (in: pToken=0x19e390 | out: pToken=0x19e390) returned 0x0 [0213.442] CoGetContextToken (in: pToken=0x19e798 | out: pToken=0x19e798) returned 0x0 [0213.442] IUnknown:QueryInterface (in: This=0x5ec408, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e828 | out: ppvObject=0x19e828*=0x0) returned 0x80004002 [0213.443] IUnknown:Release (This=0x5ec408) returned 0x2 [0213.443] CoGetContextToken (in: pToken=0x19ed68 | out: pToken=0x19ed68) returned 0x0 [0213.443] CoGetContextToken (in: pToken=0x19ecc8 | out: pToken=0x19ecc8) returned 0x0 [0213.443] IUnknown:QueryInterface (in: This=0x5ec408, riid=0x19ed98*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ed94 | out: ppvObject=0x19ed94*=0x5ec408) returned 0x0 [0213.443] IUnknown:AddRef (This=0x5ec408) returned 0x4 [0213.443] IUnknown:Release (This=0x5ec408) returned 0x3 [0213.443] IUnknown:Release (This=0x5ec408) returned 0x2 [0213.443] CoTaskMemFree (pv=0x5c1f18) [0213.443] CoGetContextToken (in: pToken=0x19f0d0 | out: pToken=0x19f0d0) returned 0x0 [0213.443] IUnknown:AddRef (This=0x5ec408) returned 0x3 [0213.443] IWbemClassObject:Get (in: This=0x5ec408, wszName="__GENUS", lFlags=0, pVal=0x19f3e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f464*=0, plFlavor=0x19f460*=0 | out: pVal=0x19f3e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f464*=3, plFlavor=0x19f460*=64) returned 0x0 [0213.443] IWbemClassObject:Get (in: This=0x5ec408, wszName="__PATH", lFlags=0, pVal=0x19f3c8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f44c*=0, plFlavor=0x19f448*=0 | out: pVal=0x19f3c8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=5", varVal2=0x0), pType=0x19f44c*=8, plFlavor=0x19f448*=64) returned 0x0 [0213.443] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=5") returned 0x7a [0213.443] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=5") returned 0x7a [0213.443] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x524 [0213.444] SetEvent (hEvent=0x468) returned 1 [0213.444] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f3a0*=0x524, lpdwindex=0x19f1bc | out: lpdwindex=0x19f1bc) returned 0x0 [0213.447] CoGetContextToken (in: pToken=0x19f270 | out: pToken=0x19f270) returned 0x0 [0213.447] CoGetContextToken (in: pToken=0x19f1d0 | out: pToken=0x19f1d0) returned 0x0 [0213.447] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0570, riid=0x19f2a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x5e0570) returned 0x0 [0213.447] WbemDefPath:IUnknown:AddRef (This=0x5e0570) returned 0x3 [0213.447] WbemDefPath:IUnknown:Release (This=0x5e0570) returned 0x2 [0213.447] WbemDefPath:IWbemPath:SetText (This=0x5e0570, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=5") returned 0x0 [0213.447] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5e0a40, puCount=0x19f420 | out: puCount=0x19f420*=0x2) returned 0x0 [0213.447] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=4, puBuffLength=0x19f41c*=0x0, pszText=0x0 | out: puBuffLength=0x19f41c*=0xf, pszText=0x0) returned 0x0 [0213.448] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=4, puBuffLength=0x19f41c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f41c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0213.448] CoTaskMemAlloc (cb=0x4) returned 0x5c1e98 [0213.448] IEnumWbemClassObject:Next (in: This=0x5b6ee8, lTimeout=-1, uCount=0x1, apObjects=0x5c1e98, puReturned=0x218744c | out: apObjects=0x5c1e98*=0x0, puReturned=0x218744c*=0x0) returned 0x1 [0213.448] CoTaskMemFree (pv=0x5c1e98) [0213.449] CoGetContextToken (in: pToken=0x19f320 | out: pToken=0x19f320) returned 0x0 [0213.449] WbemLocator:IUnknown:Release (This=0x5b3540) returned 0x1 [0213.449] IUnknown:Release (This=0x5b6ee8) returned 0x0 [0213.501] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe", nBufferLength=0x105, lpBuffer=0x19ef38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe", lpFilePart=0x0) returned 0x62 [0213.505] GetEnvironmentVariableW (in: lpName="appdata", lpBuffer=0x19f354, nSize=0x80 | out: lpBuffer="") returned 0x25 [0213.522] GetUserNameW (in: lpBuffer=0x19f254, pcbBuffer=0x218bb10 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x218bb10) returned 1 [0213.529] GetComputerNameW (in: lpBuffer=0x19f254, nSize=0x218bf8c | out: lpBuffer="XC64ZB", nSize=0x218bf8c) returned 1 [0213.572] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe.config", nBufferLength=0x105, lpBuffer=0x19ee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe.config", lpFilePart=0x0) returned 0x69 [0213.574] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x19edf4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0213.584] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x19edc0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0213.584] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x19ee28, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0213.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f288) returned 1 [0213.584] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19f304 | out: lpFileInformation=0x19f304*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0213.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f284) returned 1 [0213.587] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x19ed64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0213.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f258) returned 1 [0213.587] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x52c [0213.588] GetFileType (hFile=0x52c) returned 0x1 [0213.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f254) returned 1 [0213.589] GetFileType (hFile=0x52c) returned 0x1 [0213.601] GetFileSize (in: hFile=0x52c, lpFileSizeHigh=0x19f290 | out: lpFileSizeHigh=0x19f290*=0x0) returned 0x8c8f [0213.602] ReadFile (in: hFile=0x52c, lpBuffer=0x218d48c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f24c, lpOverlapped=0x0 | out: lpBuffer=0x218d48c*, lpNumberOfBytesRead=0x19f24c*=0x1000, lpOverlapped=0x0) returned 1 [0213.608] ReadFile (in: hFile=0x52c, lpBuffer=0x218d48c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f1ec, lpOverlapped=0x0 | out: lpBuffer=0x218d48c*, lpNumberOfBytesRead=0x19f1ec*=0x1000, lpOverlapped=0x0) returned 1 [0213.609] ReadFile (in: hFile=0x52c, lpBuffer=0x218d48c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f168, lpOverlapped=0x0 | out: lpBuffer=0x218d48c*, lpNumberOfBytesRead=0x19f168*=0x1000, lpOverlapped=0x0) returned 1 [0213.609] ReadFile (in: hFile=0x52c, lpBuffer=0x218d48c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f168, lpOverlapped=0x0 | out: lpBuffer=0x218d48c*, lpNumberOfBytesRead=0x19f168*=0x1000, lpOverlapped=0x0) returned 1 [0213.609] ReadFile (in: hFile=0x52c, lpBuffer=0x218d48c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f168, lpOverlapped=0x0 | out: lpBuffer=0x218d48c*, lpNumberOfBytesRead=0x19f168*=0x1000, lpOverlapped=0x0) returned 1 [0213.612] ReadFile (in: hFile=0x52c, lpBuffer=0x218d48c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f168, lpOverlapped=0x0 | out: lpBuffer=0x218d48c*, lpNumberOfBytesRead=0x19f168*=0x1000, lpOverlapped=0x0) returned 1 [0213.612] ReadFile (in: hFile=0x52c, lpBuffer=0x218d48c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f1e8, lpOverlapped=0x0 | out: lpBuffer=0x218d48c*, lpNumberOfBytesRead=0x19f1e8*=0x1000, lpOverlapped=0x0) returned 1 [0213.613] ReadFile (in: hFile=0x52c, lpBuffer=0x218d48c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f168, lpOverlapped=0x0 | out: lpBuffer=0x218d48c*, lpNumberOfBytesRead=0x19f168*=0x1000, lpOverlapped=0x0) returned 1 [0213.613] ReadFile (in: hFile=0x52c, lpBuffer=0x218d48c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f168, lpOverlapped=0x0 | out: lpBuffer=0x218d48c*, lpNumberOfBytesRead=0x19f168*=0xc8f, lpOverlapped=0x0) returned 1 [0213.613] ReadFile (in: hFile=0x52c, lpBuffer=0x218d48c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f210, lpOverlapped=0x0 | out: lpBuffer=0x218d48c*, lpNumberOfBytesRead=0x19f210*=0x0, lpOverlapped=0x0) returned 1 [0213.614] CloseHandle (hObject=0x52c) returned 1 [0213.617] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe.config", nBufferLength=0x105, lpBuffer=0x19edbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe.config", lpFilePart=0x0) returned 0x69 [0213.617] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe.config", nBufferLength=0x105, lpBuffer=0x19ee24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe.config", lpFilePart=0x0) returned 0x69 [0213.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f284) returned 1 [0213.617] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe.config" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19f300 | out: lpFileInformation=0x19f300*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0213.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f280) returned 1 [0213.648] EtwEventRegister (in: ProviderId=0x219404c, EnableCallback=0x46c0bf6, CallbackContext=0x0, RegHandle=0x2194028 | out: RegHandle=0x2194028) returned 0x0 [0213.653] EtwEventSetInformation (RegHandle=0x5396b0, InformationClass=0x62, EventInformation=0x2, InformationLength=0x2193fec) returned 0x0 [0213.830] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x19f400 | out: UnbiasedTime=0x19f400) returned 1 [0213.839] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x19f3f0 | out: UnbiasedTime=0x19f3f0) returned 1 [0213.840] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x19f420 | out: UnbiasedTime=0x19f420) returned 1 [0213.840] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x19f410 | out: UnbiasedTime=0x19f410) returned 1 [0213.893] GetEnvironmentVariableW (in: lpName="appdata", lpBuffer=0x19f308, nSize=0x80 | out: lpBuffer="") returned 0x25 [0213.897] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\HSpMzoJ\\", nBufferLength=0x105, lpBuffer=0x19ef64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\HSpMzoJ\\", lpFilePart=0x0) returned 0x2e [0213.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f3c0) returned 1 [0213.897] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\HSpMzoJ\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\hspmzoj"), fInfoLevelId=0x0, lpFileInformation=0x19f43c | out: lpFileInformation=0x19f43c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0213.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f3bc) returned 1 [0213.898] GetEnvironmentVariableW (in: lpName="appdata", lpBuffer=0x19f308, nSize=0x80 | out: lpBuffer="") returned 0x25 [0213.898] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\HSpMzoJ\\", nBufferLength=0x105, lpBuffer=0x19ef68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\HSpMzoJ\\", lpFilePart=0x0) returned 0x2e [0213.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f350) returned 1 [0213.898] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\HSpMzoJ\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\hspmzoj"), fInfoLevelId=0x0, lpFileInformation=0x19f3cc | out: lpFileInformation=0x19f3cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0213.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f34c) returned 1 [0213.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f350) returned 1 [0213.900] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\HSpMzoJ" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\hspmzoj"), fInfoLevelId=0x0, lpFileInformation=0x19f3cc | out: lpFileInformation=0x19f3cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0213.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f34c) returned 1 [0213.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f350) returned 1 [0213.900] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming"), fInfoLevelId=0x0, lpFileInformation=0x19f3cc | out: lpFileInformation=0x19f3cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xd72af956, ftLastAccessTime.dwHighDateTime=0x1d8598c, ftLastWriteTime.dwLowDateTime=0xd72af956, ftLastWriteTime.dwHighDateTime=0x1d8598c, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0213.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f34c) returned 1 [0213.903] CreateDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\HSpMzoJ" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\hspmzoj"), lpSecurityAttributes=0x0) returned 1 [0213.904] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\HSpMzoJ\\HSpMzoJ.exe", nBufferLength=0x105, lpBuffer=0x19ef6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\HSpMzoJ\\HSpMzoJ.exe", lpFilePart=0x0) returned 0x39 [0213.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f3cc) returned 1 [0213.904] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\HSpMzoJ\\HSpMzoJ.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\hspmzoj\\hspmzoj.exe"), fInfoLevelId=0x0, lpFileInformation=0x19f448 | out: lpFileInformation=0x19f448*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0213.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f3c8) returned 1 [0213.905] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe", nBufferLength=0x105, lpBuffer=0x19ef6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe", lpFilePart=0x0) returned 0x62 [0213.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f3cc) returned 1 [0213.905] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe"), fInfoLevelId=0x0, lpFileInformation=0x19f448 | out: lpFileInformation=0x19f448*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acc8280, ftCreationTime.dwHighDateTime=0x1d86048, ftLastAccessTime.dwLowDateTime=0x8acc8280, ftLastAccessTime.dwHighDateTime=0x1d86048, ftLastWriteTime.dwLowDateTime=0xa463cf00, ftLastWriteTime.dwHighDateTime=0x1d86034, nFileSizeHigh=0x0, nFileSizeLow=0x98800)) returned 1 [0213.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f3c8) returned 1 [0213.905] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\HSpMzoJ\\HSpMzoJ.exe", nBufferLength=0x105, lpBuffer=0x19ef6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\HSpMzoJ\\HSpMzoJ.exe", lpFilePart=0x0) returned 0x39 [0213.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f3cc) returned 1 [0213.905] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\HSpMzoJ\\HSpMzoJ.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\hspmzoj\\hspmzoj.exe"), fInfoLevelId=0x0, lpFileInformation=0x19f448 | out: lpFileInformation=0x19f448*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0213.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f3c8) returned 1 [0213.906] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe", nBufferLength=0x105, lpBuffer=0x19ef1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe", lpFilePart=0x0) returned 0x62 [0213.906] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\HSpMzoJ\\HSpMzoJ.exe", nBufferLength=0x105, lpBuffer=0x19ef1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\HSpMzoJ\\HSpMzoJ.exe", lpFilePart=0x0) returned 0x39 [0213.906] CopyFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\HSpMzoJ\\HSpMzoJ.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\hspmzoj\\hspmzoj.exe"), bFailIfExists=0) returned 1 [0215.733] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x19f438 | out: phkResult=0x19f438*=0x540) returned 0x0 [0215.740] RegQueryValueExW (in: hKey=0x540, lpValueName="HSpMzoJ", lpReserved=0x0, lpType=0x19f434, lpData=0x0, lpcbData=0x19f430*=0x0 | out: lpType=0x19f434*=0x0, lpData=0x0, lpcbData=0x19f430*=0x0) returned 0x2 [0215.740] RegSetValueExW (in: hKey=0x540, lpValueName="HSpMzoJ", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\HSpMzoJ\\HSpMzoJ.exe", cbData=0x74 | out: lpData="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\HSpMzoJ\\HSpMzoJ.exe") returned 0x0 [0215.750] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x19f438 | out: phkResult=0x19f438*=0x0) returned 0x2 [0215.755] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\HSpMzoJ\\HSpMzoJ.exe", nBufferLength=0x105, lpBuffer=0x19ef4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\HSpMzoJ\\HSpMzoJ.exe", lpFilePart=0x0) returned 0x39 [0215.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f3ac) returned 1 [0215.756] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\HSpMzoJ\\HSpMzoJ.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\hspmzoj\\hspmzoj.exe"), fInfoLevelId=0x0, lpFileInformation=0x19f428 | out: lpFileInformation=0x19f428*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ee9bf, ftCreationTime.dwHighDateTime=0x1d86049, ftLastAccessTime.dwLowDateTime=0xc3ee9bf, ftLastAccessTime.dwHighDateTime=0x1d86049, ftLastWriteTime.dwLowDateTime=0xa463cf00, ftLastWriteTime.dwHighDateTime=0x1d86034, nFileSizeHigh=0x0, nFileSizeLow=0x98800)) returned 1 [0215.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f3a8) returned 1 [0215.770] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\HSpMzoJ\\HSpMzoJ.exe:Zone.Identifier" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\hspmzoj\\hspmzoj.exe:zone.identifier")) returned 0 [0216.023] CoTaskMemAlloc (cb=0x20c) returned 0x609d70 [0216.023] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x609d70 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0216.026] CoTaskMemFree (pv=0x609d70) [0216.026] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19eb40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0216.031] CoTaskMemAlloc (cb=0x20c) returned 0x60a578 [0216.031] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x60a578 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0216.031] CoTaskMemFree (pv=0x60a578) [0216.031] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19eb40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0217.385] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data", lpFilePart=0x0) returned 0x3c [0217.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0217.385] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0217.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0217.385] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data", lpFilePart=0x0) returned 0x42 [0217.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0217.386] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0217.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0217.386] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data", lpFilePart=0x0) returned 0x3d [0217.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0217.386] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\sputnik\\sputnik\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0217.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0217.387] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data", lpFilePart=0x0) returned 0x44 [0217.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0217.387] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\maplestudio\\chromeplus\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0217.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0217.387] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data", lpFilePart=0x0) returned 0x35 [0217.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0217.388] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0217.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0217.388] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data", lpFilePart=0x0) returned 0x3c [0217.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0217.389] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\ucozmedia\\uran\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0217.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0217.389] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data", lpFilePart=0x0) returned 0x36 [0217.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0217.390] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\qip surf\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0217.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0217.395] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data", lpFilePart=0x0) returned 0x39 [0217.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0217.396] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0217.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0217.396] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data", lpFilePart=0x0) returned 0x42 [0217.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0217.396] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\yandex\\yandexbrowser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0217.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0217.397] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Chrome\\Chrome\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Chrome\\Chrome\\User Data", lpFilePart=0x0) returned 0x3e [0217.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0217.397] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Chrome\\Chrome\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\360chrome\\chrome\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0217.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0217.397] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data", lpFilePart=0x0) returned 0x42 [0217.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0217.397] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\catalinagroup\\citrio\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0217.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0217.398] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data", lpFilePart=0x0) returned 0x3e [0217.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0217.398] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\elements browser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0217.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0217.399] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable", lpFilePart=0x0) returned 0x41 [0217.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0217.399] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0217.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0217.399] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data", lpFilePart=0x0) returned 0x36 [0217.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0217.400] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0217.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0217.400] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data", lpFilePart=0x0) returned 0x34 [0217.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0217.400] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\kometa\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0217.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0217.401] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data", lpFilePart=0x0) returned 0x34 [0217.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0217.401] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0217.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0217.401] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer", lpFilePart=0x0) returned 0x57 [0217.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0217.402] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\fenrir inc\\sleipnir5\\setting\\modules\\chromiumviewer"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0217.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0217.403] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data", lpFilePart=0x0) returned 0x49 [0217.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0217.403] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\bravesoftware\\brave-browser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0217.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0217.404] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data", lpFilePart=0x0) returned 0x35 [0217.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0217.404] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\iridium\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0217.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0217.405] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data", lpFilePart=0x0) returned 0x33 [0217.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0217.405] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0217.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0217.406] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data", lpFilePart=0x0) returned 0x39 [0217.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0217.407] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0217.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0217.407] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data", lpFilePart=0x0) returned 0x33 [0217.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0217.408] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0217.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0217.409] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data", lpFilePart=0x0) returned 0x35 [0217.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0217.409] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\orbitum\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0217.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0217.410] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data", lpFilePart=0x0) returned 0x3b [0217.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0217.410] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coowon\\coowon\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0217.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0217.411] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data", lpFilePart=0x0) returned 0x3b [0217.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0217.411] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0217.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0217.412] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data", lpFilePart=0x0) returned 0x34 [0217.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0217.412] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\liebao\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0217.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0217.469] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0x19d7c0, nSize=0x80 | out: lpBuffer="") returned 0x25 [0217.602] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\profiles.ini", lpFilePart=0x0) returned 0x52 [0217.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0217.602] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\moonchild productions\\pale moon\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0217.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0217.680] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\profiles.ini", lpFilePart=0x0) returned 0x52 [0217.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0217.680] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\moonchild productions\\pale moon\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0217.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0217.734] CoTaskMemAlloc (cb=0x20c) returned 0x60ec48 [0217.734] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x60ec48 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0217.734] CoTaskMemFree (pv=0x60ec48) [0217.734] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19eb0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0217.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f070) returned 1 [0217.737] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\UCBrowser\\", nBufferLength=0x105, lpBuffer=0x19eb78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\UCBrowser\\", lpFilePart=0x0) returned 0x2e [0217.738] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\UCBrowser\\", nBufferLength=0x105, lpBuffer=0x19eb4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\UCBrowser\\", lpFilePart=0x0) returned 0x2e [0217.739] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\UCBrowser\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\ucbrowser\\*"), lpFindFileData=0x19ed98 | out: lpFindFileData=0x19ed98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0217.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f034) returned 1 [0217.766] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\FTPWare\\COREFTP\\Sites", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f06c | out: phkResult=0x19f06c*=0x0) returned 0x2 [0217.825] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Flock\\Browser\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Flock\\Browser\\profiles.ini", lpFilePart=0x0) returned 0x40 [0217.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef00) returned 1 [0217.825] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Flock\\Browser\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\flock\\browser\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0217.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d5d8) returned 1 [0218.272] CoTaskMemAlloc (cb=0x20c) returned 0x60ec48 [0218.272] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x60ec48 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0218.272] CoTaskMemFree (pv=0x60ec48) [0218.272] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19eb08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0218.275] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\MySQL\\Workbench\\workbench_user_data.dat", nBufferLength=0x105, lpBuffer=0x19eba4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\MySQL\\Workbench\\workbench_user_data.dat", lpFilePart=0x0) returned 0x4d [0218.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f004) returned 1 [0218.276] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\MySQL\\Workbench\\workbench_user_data.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mysql\\workbench\\workbench_user_data.dat"), fInfoLevelId=0x0, lpFileInformation=0x19f080 | out: lpFileInformation=0x19f080*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0218.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f000) returned 1 [0218.346] CoTaskMemAlloc (cb=0x20c) returned 0x60ec48 [0218.346] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x60ec48 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0218.346] CoTaskMemFree (pv=0x60ec48) [0218.346] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0218.350] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Mail\\Opera Mail\\wand.dat", nBufferLength=0x105, lpBuffer=0x19eb8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Mail\\Opera Mail\\wand.dat", lpFilePart=0x0) returned 0x44 [0218.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efec) returned 1 [0218.350] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Mail\\Opera Mail\\wand.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera mail\\opera mail\\wand.dat"), fInfoLevelId=0x0, lpFileInformation=0x19f068 | out: lpFileInformation=0x19f068*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0218.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efe8) returned 1 [0218.354] CoTaskMemAlloc (cb=0x20c) returned 0x60ec48 [0218.354] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x60ec48 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0218.355] CoTaskMemFree (pv=0x60ec48) [0218.355] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x105, lpBuffer=0x19eb18, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0218.357] CoTaskMemAlloc (cb=0x20c) returned 0x60ec48 [0218.357] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x60ec48 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0218.357] CoTaskMemFree (pv=0x60ec48) [0218.357] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19eb18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0218.367] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Apple\\Apple Application Support\\plutil.exe", nBufferLength=0x105, lpBuffer=0x19eb84, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Common Files\\Apple\\Apple Application Support\\plutil.exe", lpFilePart=0x0) returned 0x4e [0218.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efe4) returned 1 [0218.367] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Apple\\Apple Application Support\\plutil.exe" (normalized: "c:\\program files (x86)\\common files\\apple\\apple application support\\plutil.exe"), fInfoLevelId=0x0, lpFileInformation=0x19f060 | out: lpFileInformation=0x19f060*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0218.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efe0) returned 1 [0218.452] CoTaskMemAlloc (cb=0x20c) returned 0x60ec48 [0218.452] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x60ec48 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0218.452] CoTaskMemFree (pv=0x60ec48) [0218.452] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19eaec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0218.453] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x19eb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x3a [0218.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efdc) returned 1 [0218.454] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\credentials"), fInfoLevelId=0x0, lpFileInformation=0x19f058 | out: lpFileInformation=0x19f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x58717184, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x58717184, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0218.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efd8) returned 1 [0218.454] CoTaskMemAlloc (cb=0x20c) returned 0x60ec48 [0218.454] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x60ec48 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0218.454] CoTaskMemFree (pv=0x60ec48) [0218.454] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19eaec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0218.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f058) returned 1 [0218.455] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x19eb60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x3a [0218.455] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x19eb34, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x3a [0218.455] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\credentials\\*"), lpFindFileData=0x19ed80 | out: lpFindFileData=0x19ed80*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x58717184, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x58717184, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x59ab28 [0218.457] FindNextFileW (in: hFindFile=0x59ab28, lpFindFileData=0x19ed90 | out: lpFindFileData=0x19ed90*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x58717184, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x58717184, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.458] FindNextFileW (in: hFindFile=0x59ab28, lpFindFileData=0x19ed90 | out: lpFindFileData=0x19ed90*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x508b12b7, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x58717184, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x5871986a, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x2ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DFBE70A7E5CC19A398EBF1B96859CE5D", cAlternateFileName="DFBE70~1")) returned 1 [0218.458] FindNextFileW (in: hFindFile=0x59ab28, lpFindFileData=0x19ed90 | out: lpFindFileData=0x19ed90*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0218.458] FindClose (in: hFindFile=0x59ab28 | out: hFindFile=0x59ab28) returned 1 [0218.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f018) returned 1 [0218.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f024) returned 1 [0218.462] CoTaskMemAlloc (cb=0x20c) returned 0x60ec48 [0218.462] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x60ec48 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0218.462] CoTaskMemFree (pv=0x60ec48) [0218.462] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19eaec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0218.462] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x19eb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x3c [0218.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efdc) returned 1 [0218.462] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\credentials"), fInfoLevelId=0x0, lpFileInformation=0x19f058 | out: lpFileInformation=0x19f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44687ae6, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x44687ae6, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0218.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efd8) returned 1 [0218.463] CoTaskMemAlloc (cb=0x20c) returned 0x60ec48 [0218.463] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x60ec48 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0218.463] CoTaskMemFree (pv=0x60ec48) [0218.463] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19eaec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0218.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f058) returned 1 [0218.463] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x19eb60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x3c [0218.463] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x19eb34, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x3c [0218.463] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\credentials\\*"), lpFindFileData=0x19ed80 | out: lpFindFileData=0x19ed80*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44687ae6, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x44687ae6, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x59af68 [0218.464] FindNextFileW (in: hFindFile=0x59af68, lpFindFileData=0x19ed90 | out: lpFindFileData=0x19ed90*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44687ae6, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x44687ae6, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.464] FindNextFileW (in: hFindFile=0x59af68, lpFindFileData=0x19ed90 | out: lpFindFileData=0x19ed90*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44687ae6, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x44687ae6, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.464] FindClose (in: hFindFile=0x59af68 | out: hFindFile=0x59af68) returned 1 [0218.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f018) returned 1 [0218.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f024) returned 1 [0218.556] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D", nBufferLength=0x105, lpBuffer=0x19eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D", lpFilePart=0x0) returned 0x5a [0218.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef9c) returned 1 [0218.556] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\credentials\\dfbe70a7e5cc19a398ebf1b96859ce5d"), fInfoLevelId=0x0, lpFileInformation=0x21baa04 | out: lpFileInformation=0x21baa04*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x508b12b7, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x58717184, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x5871986a, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x2ac0)) returned 1 [0218.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef98) returned 1 [0218.557] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D", nBufferLength=0x105, lpBuffer=0x19e9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D", lpFilePart=0x0) returned 0x5a [0218.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eed4) returned 1 [0218.557] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\credentials\\dfbe70a7e5cc19a398ebf1b96859ce5d"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x55c [0218.557] GetFileType (hFile=0x55c) returned 0x1 [0218.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eed0) returned 1 [0218.557] GetFileType (hFile=0x55c) returned 0x1 [0218.557] GetFileSize (in: hFile=0x55c, lpFileSizeHigh=0x19efdc | out: lpFileSizeHigh=0x19efdc*=0x0) returned 0x2ac0 [0218.557] ReadFile (in: hFile=0x55c, lpBuffer=0x21baccc, nNumberOfBytesToRead=0x2ac0, lpNumberOfBytesRead=0x19ef88, lpOverlapped=0x0 | out: lpBuffer=0x21baccc*, lpNumberOfBytesRead=0x19ef88*=0x2ac0, lpOverlapped=0x0) returned 1 [0218.559] CloseHandle (hObject=0x55c) returned 1 [0218.713] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D", nBufferLength=0x105, lpBuffer=0x19ead8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D", lpFilePart=0x0) returned 0x5a [0218.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef6c) returned 1 [0218.714] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\credentials\\dfbe70a7e5cc19a398ebf1b96859ce5d"), fInfoLevelId=0x0, lpFileInformation=0x19efe8 | out: lpFileInformation=0x19efe8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x508b12b7, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x58717184, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x5871986a, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x2ac0)) returned 1 [0218.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef68) returned 1 [0218.716] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x19ecb4 | out: pTimeZoneInformation=0x19ecb4) returned 0x2 [0218.719] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ed98 | out: phkResult=0x19ed98*=0x55c) returned 0x0 [0218.719] RegQueryValueExW (in: hKey=0x55c, lpValueName="TZI", lpReserved=0x0, lpType=0x19edb4, lpData=0x0, lpcbData=0x19edb0*=0x0 | out: lpType=0x19edb4*=0x3, lpData=0x0, lpcbData=0x19edb0*=0x2c) returned 0x0 [0218.721] RegQueryValueExW (in: hKey=0x55c, lpValueName="TZI", lpReserved=0x0, lpType=0x19edb4, lpData=0x21c0350, lpcbData=0x19edb0*=0x2c | out: lpType=0x19edb4*=0x3, lpData=0x21c0350*, lpcbData=0x19edb0*=0x2c) returned 0x0 [0218.721] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ebec | out: phkResult=0x19ebec*=0x0) returned 0x2 [0218.723] RegQueryValueExW (in: hKey=0x55c, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x19ed8c, lpData=0x0, lpcbData=0x19ed88*=0x0 | out: lpType=0x19ed8c*=0x1, lpData=0x0, lpcbData=0x19ed88*=0x20) returned 0x0 [0218.723] RegQueryValueExW (in: hKey=0x55c, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x19ed8c, lpData=0x21c0774, lpcbData=0x19ed88*=0x20 | out: lpType=0x19ed8c*=0x1, lpData="@tzres.dll,-320", lpcbData=0x19ed88*=0x20) returned 0x0 [0218.723] RegQueryValueExW (in: hKey=0x55c, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x19ed8c, lpData=0x0, lpcbData=0x19ed88*=0x0 | out: lpType=0x19ed8c*=0x1, lpData=0x0, lpcbData=0x19ed88*=0x20) returned 0x0 [0218.723] RegQueryValueExW (in: hKey=0x55c, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x19ed8c, lpData=0x21c07cc, lpcbData=0x19ed88*=0x20 | out: lpType=0x19ed8c*=0x1, lpData="@tzres.dll,-322", lpcbData=0x19ed88*=0x20) returned 0x0 [0218.723] RegQueryValueExW (in: hKey=0x55c, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x19ed8c, lpData=0x0, lpcbData=0x19ed88*=0x0 | out: lpType=0x19ed8c*=0x1, lpData=0x0, lpcbData=0x19ed88*=0x20) returned 0x0 [0218.723] RegQueryValueExW (in: hKey=0x55c, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x19ed8c, lpData=0x21c0824, lpcbData=0x19ed88*=0x20 | out: lpType=0x19ed8c*=0x1, lpData="@tzres.dll,-321", lpcbData=0x19ed88*=0x20) returned 0x0 [0218.725] CoTaskMemAlloc (cb=0x20c) returned 0x60ec48 [0218.725] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x60ec48 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0218.726] CoTaskMemFree (pv=0x60ec48) [0218.727] CoTaskMemAlloc (cb=0x20c) returned 0x60ec48 [0218.727] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x19eda8, pwszFileMUIPath=0x60ec48, pcchFileMUIPath=0x19edac, pululEnumerator=0x19eda0 | out: pwszLanguage=0x0, pcchLanguage=0x19eda8, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x19edac, pululEnumerator=0x19eda0) returned 1 [0218.753] CoTaskMemFree (pv=0x0) [0218.753] CoTaskMemFree (pv=0x60ec48) [0218.754] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x5210001 [0218.768] CoTaskMemAlloc (cb=0x3ec) returned 0x60b708 [0218.769] LoadStringW (in: hInstance=0x5210001, uID=0x140, lpBuffer=0x60b708, cchBufferMax=500 | out: lpBuffer="(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna") returned 0x3c [0218.769] CoTaskMemFree (pv=0x60b708) [0218.769] FreeLibrary (hLibModule=0x5210001) returned 1 [0218.770] CoTaskMemAlloc (cb=0x20c) returned 0x60ec48 [0218.770] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x60ec48 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0218.771] CoTaskMemFree (pv=0x60ec48) [0218.771] CoTaskMemAlloc (cb=0x20c) returned 0x60ec48 [0218.771] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x19eda8, pwszFileMUIPath=0x60ec48, pcchFileMUIPath=0x19edac, pululEnumerator=0x19eda0 | out: pwszLanguage=0x0, pcchLanguage=0x19eda8, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x19edac, pululEnumerator=0x19eda0) returned 1 [0218.774] CoTaskMemFree (pv=0x0) [0218.774] CoTaskMemFree (pv=0x60ec48) [0218.774] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x5210001 [0218.777] CoTaskMemAlloc (cb=0x3ec) returned 0x60b708 [0218.778] LoadStringW (in: hInstance=0x5210001, uID=0x142, lpBuffer=0x60b708, cchBufferMax=500 | out: lpBuffer="W. Europe Standard Time") returned 0x17 [0218.778] CoTaskMemFree (pv=0x60b708) [0218.778] FreeLibrary (hLibModule=0x5210001) returned 1 [0218.779] CoTaskMemAlloc (cb=0x20c) returned 0x60ec48 [0218.779] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x60ec48 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0218.779] CoTaskMemFree (pv=0x60ec48) [0218.779] CoTaskMemAlloc (cb=0x20c) returned 0x60ec48 [0218.779] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x19eda8, pwszFileMUIPath=0x60ec48, pcchFileMUIPath=0x19edac, pululEnumerator=0x19eda0 | out: pwszLanguage=0x0, pcchLanguage=0x19eda8, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x19edac, pululEnumerator=0x19eda0) returned 1 [0218.782] CoTaskMemFree (pv=0x0) [0218.782] CoTaskMemFree (pv=0x60ec48) [0218.782] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x5210001 [0218.785] CoTaskMemAlloc (cb=0x3ec) returned 0x60b708 [0218.786] LoadStringW (in: hInstance=0x5210001, uID=0x141, lpBuffer=0x60b708, cchBufferMax=500 | out: lpBuffer="W. Europe Daylight Time") returned 0x17 [0218.786] CoTaskMemFree (pv=0x60b708) [0218.786] FreeLibrary (hLibModule=0x5210001) returned 1 [0218.787] RegCloseKey (hKey=0x55c) returned 0x0 [0218.787] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D", nBufferLength=0x105, lpBuffer=0x19ead8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D", lpFilePart=0x0) returned 0x5a [0218.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef6c) returned 1 [0218.787] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\credentials\\dfbe70a7e5cc19a398ebf1b96859ce5d"), fInfoLevelId=0x0, lpFileInformation=0x19efe8 | out: lpFileInformation=0x19efe8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x508b12b7, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x58717184, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x5871986a, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x2ac0)) returned 1 [0218.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef68) returned 1 [0218.835] CoTaskMemAlloc (cb=0x20c) returned 0x60ec48 [0218.836] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x60ec48 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0218.836] CoTaskMemFree (pv=0x60ec48) [0218.836] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19eaec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0218.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f058) returned 1 [0218.838] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\", nBufferLength=0x105, lpBuffer=0x19eb60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\", lpFilePart=0x0) returned 0x38 [0218.838] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\", nBufferLength=0x105, lpBuffer=0x19eb34, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\", lpFilePart=0x0) returned 0x38 [0218.838] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\protect\\*"), lpFindFileData=0x19ed80 | out: lpFindFileData=0x19ed80*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x50866c1c, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x50866c1c, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x59ac28 [0218.839] FindNextFileW (in: hFindFile=0x59ac28, lpFindFileData=0x19ed90 | out: lpFindFileData=0x19ed90*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x50866c1c, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x50866c1c, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.840] FindNextFileW (in: hFindFile=0x59ac28, lpFindFileData=0x19ed90 | out: lpFindFileData=0x19ed90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44792966, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xcf68faea, ftLastWriteTime.dwHighDateTime=0x1d85953, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="CREDHIST", cAlternateFileName="")) returned 1 [0218.840] FindNextFileW (in: hFindFile=0x59ac28, lpFindFileData=0x19ed90 | out: lpFindFileData=0x19ed90*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x50866c1c, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x562658a2, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x562658a2, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0218.840] FindNextFileW (in: hFindFile=0x59ac28, lpFindFileData=0x19ed90 | out: lpFindFileData=0x19ed90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44792966, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xcf753085, ftLastWriteTime.dwHighDateTime=0x1d85953, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SYNCHIST", cAlternateFileName="")) returned 1 [0218.840] FindNextFileW (in: hFindFile=0x59ac28, lpFindFileData=0x19ed90 | out: lpFindFileData=0x19ed90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44792966, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xcf753085, ftLastWriteTime.dwHighDateTime=0x1d85953, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SYNCHIST", cAlternateFileName="")) returned 0 [0218.840] FindClose (in: hFindFile=0x59ac28 | out: hFindFile=0x59ac28) returned 1 [0218.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f018) returned 1 [0218.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f024) returned 1 [0218.854] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1", nBufferLength=0x105, lpBuffer=0x19eb88, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1", lpFilePart=0x0) returned 0x8b [0218.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efe8) returned 1 [0218.854] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1"), fInfoLevelId=0x0, lpFileInformation=0x19f064 | out: lpFileInformation=0x19f064*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x562658a2, ftCreationTime.dwHighDateTime=0x1d82a22, ftLastAccessTime.dwLowDateTime=0x562658a2, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0xcf6b6c82, ftLastWriteTime.dwHighDateTime=0x1d85953, nFileSizeHigh=0x0, nFileSizeLow=0x1d4)) returned 1 [0218.854] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efe4) returned 1 [0218.855] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1", nBufferLength=0x105, lpBuffer=0x19eb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1", lpFilePart=0x0) returned 0x8b [0218.855] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1", nBufferLength=0x105, lpBuffer=0x19eb6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1", lpFilePart=0x0) returned 0x8b [0218.855] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000", nBufferLength=0x105, lpBuffer=0x19eb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000", lpFilePart=0x0) returned 0x66 [0218.855] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\.", nBufferLength=0x105, lpBuffer=0x19eb04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000", lpFilePart=0x0) returned 0x66 [0219.029] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1", nBufferLength=0x105, lpBuffer=0x19ea74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1", lpFilePart=0x0) returned 0x8b [0219.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef68) returned 1 [0219.029] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x55c [0219.029] GetFileType (hFile=0x55c) returned 0x1 [0219.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef64) returned 1 [0219.029] GetFileType (hFile=0x55c) returned 0x1 [0219.030] GetFileSize (in: hFile=0x55c, lpFileSizeHigh=0x19f070 | out: lpFileSizeHigh=0x19f070*=0x0) returned 0x1d4 [0219.030] ReadFile (in: hFile=0x55c, lpBuffer=0x21ca014, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f01c, lpOverlapped=0x0 | out: lpBuffer=0x21ca014*, lpNumberOfBytesRead=0x19f01c*=0x1d4, lpOverlapped=0x0) returned 1 [0219.031] CloseHandle (hObject=0x55c) returned 1 [0220.261] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D", nBufferLength=0x105, lpBuffer=0x19ea74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D", lpFilePart=0x0) returned 0x5a [0220.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef68) returned 1 [0220.261] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\credentials\\dfbe70a7e5cc19a398ebf1b96859ce5d"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5b8 [0220.261] GetFileType (hFile=0x5b8) returned 0x1 [0220.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef64) returned 1 [0220.262] GetFileType (hFile=0x5b8) returned 0x1 [0220.262] GetFileSize (in: hFile=0x5b8, lpFileSizeHigh=0x19f070 | out: lpFileSizeHigh=0x19f070*=0x0) returned 0x2ac0 [0220.262] ReadFile (in: hFile=0x5b8, lpBuffer=0x21a2354, nNumberOfBytesToRead=0x2ac0, lpNumberOfBytesRead=0x19f01c, lpOverlapped=0x0 | out: lpBuffer=0x21a2354*, lpNumberOfBytesRead=0x19f01c*=0x2ac0, lpOverlapped=0x0) returned 1 [0220.262] CloseHandle (hObject=0x5b8) returned 1 [0220.351] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", lpFilePart=0x0) returned 0x42 [0220.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0220.351] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0220.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0220.357] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", lpFilePart=0x0) returned 0x42 [0220.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0220.357] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0220.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0220.414] CoTaskMemAlloc (cb=0x20c) returned 0x60ed80 [0220.414] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0x60ed80, nSize=0x104 | out: lpBuffer="") returned 0x25 [0220.414] CoTaskMemFree (pv=0x60ed80) [0220.416] CoTaskMemAlloc (cb=0x20c) returned 0x60ed80 [0220.416] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0x60ed80, nSize=0x104 | out: lpBuffer="") returned 0x25 [0220.416] CoTaskMemFree (pv=0x60ed80) [0220.418] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Psi\\profiles", nBufferLength=0x105, lpBuffer=0x19eb68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Psi\\profiles", lpFilePart=0x0) returned 0x32 [0220.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efc4) returned 1 [0220.418] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Psi\\profiles" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\psi\\profiles"), fInfoLevelId=0x0, lpFileInformation=0x19f040 | out: lpFileInformation=0x19f040*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0220.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efc0) returned 1 [0220.419] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Psi+\\profiles", nBufferLength=0x105, lpBuffer=0x19eb68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Psi+\\profiles", lpFilePart=0x0) returned 0x33 [0220.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efc4) returned 1 [0220.419] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Psi+\\profiles" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\psi+\\profiles"), fInfoLevelId=0x0, lpFileInformation=0x19f040 | out: lpFileInformation=0x19f040*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0220.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efc0) returned 1 [0220.562] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Qualcomm\\Eudora\\CommandLine", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f038 | out: phkResult=0x19f038*=0x0) returned 0x2 [0220.644] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\IncrediMail\\Identities", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f048 | out: phkResult=0x19f048*=0x0) returned 0x2 [0220.648] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Postbox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Postbox\\profiles.ini", lpFilePart=0x0) returned 0x3a [0220.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0220.649] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Postbox\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\postbox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0220.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0220.654] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Postbox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Postbox\\profiles.ini", lpFilePart=0x0) returned 0x3a [0220.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0220.655] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Postbox\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\postbox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0220.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0220.674] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\profiles.ini", lpFilePart=0x0) returned 0x3b [0220.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0220.675] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\waterfox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0220.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0220.685] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\profiles.ini", lpFilePart=0x0) returned 0x3b [0220.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0220.685] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\waterfox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0220.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0220.730] CoTaskMemAlloc (cb=0x20c) returned 0x60ed80 [0220.730] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x60ed80, nSize=0x104 | out: lpBuffer="") returned 0x2 [0220.730] CoTaskMemFree (pv=0x60ed80) [0220.732] GetFullPathNameW (in: lpFileName="C:\\cftp\\Ftplist.txt", nBufferLength=0x105, lpBuffer=0x19eba4, lpFilePart=0x0 | out: lpBuffer="C:\\cftp\\Ftplist.txt", lpFilePart=0x0) returned 0x13 [0220.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f004) returned 1 [0220.732] GetFileAttributesExW (in: lpFileName="C:\\cftp\\Ftplist.txt" (normalized: "c:\\cftp\\ftplist.txt"), fInfoLevelId=0x0, lpFileInformation=0x19f080 | out: lpFileInformation=0x19f080*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0220.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f000) returned 1 [0220.778] CoTaskMemAlloc (cb=0x20c) returned 0x60ed80 [0220.778] GetEnvironmentVariableW (in: lpName="appdata", lpBuffer=0x60ed80, nSize=0x104 | out: lpBuffer="") returned 0x25 [0220.778] CoTaskMemFree (pv=0x60ed80) [0220.780] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\The Bat!", nBufferLength=0x105, lpBuffer=0x19eb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\The Bat!", lpFilePart=0x0) returned 0x2e [0220.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efdc) returned 1 [0220.780] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\The Bat!" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\the bat!"), fInfoLevelId=0x0, lpFileInformation=0x19f058 | out: lpFileInformation=0x19f058*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0220.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efd8) returned 1 [0220.793] CoTaskMemAlloc (cb=0x20c) returned 0x60ed80 [0220.793] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x60ed80 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0220.793] CoTaskMemFree (pv=0x60ed80) [0220.793] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19eb00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0220.798] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FTPGetter\\servers.xml", nBufferLength=0x105, lpBuffer=0x19eb9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FTPGetter\\servers.xml", lpFilePart=0x0) returned 0x3b [0220.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19effc) returned 1 [0220.798] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FTPGetter\\servers.xml" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\ftpgetter\\servers.xml"), fInfoLevelId=0x0, lpFileInformation=0x19f078 | out: lpFileInformation=0x19f078*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0220.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eff8) returned 1 [0220.849] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\DownloadManager\\Passwords", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f04c | out: phkResult=0x19f04c*=0x0) returned 0x2 [0220.855] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon\\profiles.ini", lpFilePart=0x0) returned 0x43 [0220.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0220.855] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\comodo\\icedragon\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0220.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0220.860] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon\\profiles.ini", lpFilePart=0x0) returned 0x43 [0220.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0220.860] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\comodo\\icedragon\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0220.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0220.904] ExpandEnvironmentStringsW (in: lpSrc="%ProgramW6432%", lpDst=0x19ef60, nSize=0x64 | out: lpDst="C:\\Program Files") returned 0x11 [0220.904] ExpandEnvironmentStringsW (in: lpSrc="%ProgramW6432%", lpDst=0x19ef60, nSize=0x64 | out: lpDst="C:\\Program Files") returned 0x11 [0220.909] CoTaskMemAlloc (cb=0x20c) returned 0x60ed80 [0220.909] GetEnvironmentVariableW (in: lpName="ProgramFiles(x86)", lpBuffer=0x60ed80, nSize=0x104 | out: lpBuffer="") returned 0x16 [0220.909] CoTaskMemFree (pv=0x60ed80) [0220.910] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Private Internet Access\\data", nBufferLength=0x105, lpBuffer=0x19eba4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Private Internet Access\\data", lpFilePart=0x0) returned 0x2d [0220.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f000) returned 1 [0220.910] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Private Internet Access\\data" (normalized: "c:\\program files\\private internet access\\data"), fInfoLevelId=0x0, lpFileInformation=0x19f07c | out: lpFileInformation=0x19f07c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0220.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19effc) returned 1 [0220.911] GetFullPathNameW (in: lpFileName="\\Private Internet Access\\data", nBufferLength=0x105, lpBuffer=0x19eba4, lpFilePart=0x0 | out: lpBuffer="C:\\Private Internet Access\\data", lpFilePart=0x0) returned 0x1f [0220.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f000) returned 1 [0220.911] GetFileAttributesExW (in: lpFileName="C:\\Private Internet Access\\data" (normalized: "c:\\private internet access\\data"), fInfoLevelId=0x0, lpFileInformation=0x19f07c | out: lpFileInformation=0x19f07c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0220.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19effc) returned 1 [0220.914] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\profiles.ini", lpFilePart=0x0) returned 0x51 [0220.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0220.914] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\netgate technologies\\blackhawk\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0220.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0220.922] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\profiles.ini", lpFilePart=0x0) returned 0x51 [0220.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0220.922] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\netgate technologies\\blackhawk\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0220.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0220.936] CoTaskMemAlloc (cb=0x20c) returned 0x60ed80 [0220.936] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x60ed80 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0220.936] CoTaskMemFree (pv=0x60ed80) [0220.937] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19eb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0220.939] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mailbird\\Store\\Store.db", nBufferLength=0x105, lpBuffer=0x19ebcc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mailbird\\Store\\Store.db", lpFilePart=0x0) returned 0x3b [0220.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f02c) returned 1 [0220.939] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mailbird\\Store\\Store.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\mailbird\\store\\store.db"), fInfoLevelId=0x0, lpFileInformation=0x19f0a8 | out: lpFileInformation=0x19f0a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0220.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f028) returned 1 [0220.969] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\OpenVPN-GUI\\configs", ulOptions=0x0, samDesired=0x2001f, phkResult=0x19f06c | out: phkResult=0x19f06c*=0x0) returned 0x2 [0221.049] CoTaskMemAlloc (cb=0x20c) returned 0x60ed80 [0221.049] GetEnvironmentVariableW (in: lpName="appdata", lpBuffer=0x60ed80, nSize=0x104 | out: lpBuffer="") returned 0x25 [0221.049] CoTaskMemFree (pv=0x60ed80) [0221.051] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Pocomail\\accounts.ini", nBufferLength=0x105, lpBuffer=0x19eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Pocomail\\accounts.ini", lpFilePart=0x0) returned 0x3b [0221.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efc4) returned 1 [0221.051] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Pocomail\\accounts.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\pocomail\\accounts.ini"), fInfoLevelId=0x0, lpFileInformation=0x19f040 | out: lpFileInformation=0x19f040*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0221.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efc0) returned 1 [0221.374] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Wow6432Node\\RealVNC\\WinVNC4", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0221.374] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Wow6432Node\\RealVNC\\WinVNC4", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0221.375] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\RealVNC\\vncserver", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0221.379] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\RealVNC\\vncserver", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0221.379] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\RealVNC\\WinVNC4", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0221.379] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\RealVNC\\WinVNC4", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0221.380] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\ORL\\WinVNC3", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0221.380] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\ORL\\WinVNC3", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0221.380] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\TightVNC\\Server", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0221.380] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\TightVNC\\Server", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0221.397] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\TightVNC\\Server", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0221.398] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\TightVNC\\Server", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0221.398] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\TightVNC\\Server", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0221.398] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\TightVNC\\Server", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0221.398] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\TigerVNC\\Server", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0221.398] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\TigerVNC\\Server", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef80 | out: phkResult=0x19ef80*=0x0) returned 0x2 [0221.401] CoTaskMemAlloc (cb=0x20c) returned 0x60ed80 [0221.401] GetEnvironmentVariableW (in: lpName="ProgramFiles(x86)", lpBuffer=0x60ed80, nSize=0x104 | out: lpBuffer="") returned 0x16 [0221.402] CoTaskMemFree (pv=0x60ed80) [0221.412] CoTaskMemAlloc (cb=0x20c) returned 0x60ed80 [0221.412] GetEnvironmentVariableW (in: lpName="ProgramFiles(x86)", lpBuffer=0x60ed80, nSize=0x104 | out: lpBuffer="") returned 0x16 [0221.412] CoTaskMemFree (pv=0x60ed80) [0221.426] CoTaskMemAlloc (cb=0x20c) returned 0x60ed80 [0221.426] GetEnvironmentVariableW (in: lpName="ProgramFiles", lpBuffer=0x60ed80, nSize=0x104 | out: lpBuffer="") returned 0x16 [0221.426] CoTaskMemFree (pv=0x60ed80) [0221.444] CoTaskMemAlloc (cb=0x20c) returned 0x60ed80 [0221.444] GetEnvironmentVariableW (in: lpName="ProgramFiles", lpBuffer=0x60ed80, nSize=0x104 | out: lpBuffer="") returned 0x16 [0221.445] CoTaskMemFree (pv=0x60ed80) [0221.445] CoTaskMemAlloc (cb=0x20c) returned 0x60ed80 [0221.445] GetEnvironmentVariableW (in: lpName="ProgramFiles", lpBuffer=0x60ed80, nSize=0x104 | out: lpBuffer="") returned 0x16 [0221.445] CoTaskMemFree (pv=0x60ed80) [0221.455] CoTaskMemAlloc (cb=0x20c) returned 0x60ed80 [0221.455] GetEnvironmentVariableW (in: lpName="ProgramFiles", lpBuffer=0x60ed80, nSize=0x104 | out: lpBuffer="") returned 0x16 [0221.456] CoTaskMemFree (pv=0x60ed80) [0221.456] CoTaskMemAlloc (cb=0x20c) returned 0x60ed80 [0221.456] GetEnvironmentVariableW (in: lpName="ProgramFiles(x86)", lpBuffer=0x60ed80, nSize=0x104 | out: lpBuffer="") returned 0x16 [0221.456] CoTaskMemFree (pv=0x60ed80) [0221.456] CoTaskMemAlloc (cb=0x20c) returned 0x60ed80 [0221.456] GetEnvironmentVariableW (in: lpName="ProgramFiles(x86)", lpBuffer=0x60ed80, nSize=0x104 | out: lpBuffer="") returned 0x16 [0221.456] CoTaskMemFree (pv=0x60ed80) [0221.456] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini", nBufferLength=0x105, lpBuffer=0x19eab4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini", lpFilePart=0x0) returned 0x36 [0221.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef14) returned 1 [0221.456] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini" (normalized: "c:\\program files (x86)\\uvnc bvba\\ultravnc\\ultravnc.ini"), fInfoLevelId=0x0, lpFileInformation=0x19ef90 | out: lpFileInformation=0x19ef90*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0221.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef10) returned 1 [0221.456] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini", nBufferLength=0x105, lpBuffer=0x19eab4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini", lpFilePart=0x0) returned 0x36 [0221.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef14) returned 1 [0221.457] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini" (normalized: "c:\\program files (x86)\\uvnc bvba\\ultravnc\\ultravnc.ini"), fInfoLevelId=0x0, lpFileInformation=0x19ef90 | out: lpFileInformation=0x19ef90*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0221.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef10) returned 1 [0221.458] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini", nBufferLength=0x105, lpBuffer=0x19eab4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini", lpFilePart=0x0) returned 0x36 [0221.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef14) returned 1 [0221.458] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini" (normalized: "c:\\program files (x86)\\uvnc bvba\\ultravnc\\ultravnc.ini"), fInfoLevelId=0x0, lpFileInformation=0x19ef90 | out: lpFileInformation=0x19ef90*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0221.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef10) returned 1 [0221.459] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini", nBufferLength=0x105, lpBuffer=0x19eab4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini", lpFilePart=0x0) returned 0x36 [0221.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef14) returned 1 [0221.459] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini" (normalized: "c:\\program files (x86)\\uvnc bvba\\ultravnc\\ultravnc.ini"), fInfoLevelId=0x0, lpFileInformation=0x19ef90 | out: lpFileInformation=0x19ef90*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0221.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef10) returned 1 [0221.459] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini", nBufferLength=0x105, lpBuffer=0x19eab4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini", lpFilePart=0x0) returned 0x2c [0221.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef14) returned 1 [0221.462] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini" (normalized: "c:\\program files (x86)\\ultravnc\\ultravnc.ini"), fInfoLevelId=0x0, lpFileInformation=0x19ef90 | out: lpFileInformation=0x19ef90*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0221.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef10) returned 1 [0221.462] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini", nBufferLength=0x105, lpBuffer=0x19eab4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini", lpFilePart=0x0) returned 0x2c [0221.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef14) returned 1 [0221.462] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini" (normalized: "c:\\program files (x86)\\ultravnc\\ultravnc.ini"), fInfoLevelId=0x0, lpFileInformation=0x19ef90 | out: lpFileInformation=0x19ef90*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0221.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef10) returned 1 [0221.462] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini", nBufferLength=0x105, lpBuffer=0x19eab4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini", lpFilePart=0x0) returned 0x2c [0221.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef14) returned 1 [0221.462] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini" (normalized: "c:\\program files (x86)\\ultravnc\\ultravnc.ini"), fInfoLevelId=0x0, lpFileInformation=0x19ef90 | out: lpFileInformation=0x19ef90*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0221.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef10) returned 1 [0221.462] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini", nBufferLength=0x105, lpBuffer=0x19eab4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini", lpFilePart=0x0) returned 0x2c [0221.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef14) returned 1 [0221.463] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\UltraVNC\\ultravnc.ini" (normalized: "c:\\program files (x86)\\ultravnc\\ultravnc.ini"), fInfoLevelId=0x0, lpFileInformation=0x19ef90 | out: lpFileInformation=0x19ef90*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0221.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef10) returned 1 [0221.586] CoTaskMemAlloc (cb=0x20c) returned 0x60ed80 [0221.586] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x60ed80 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0221.586] CoTaskMemFree (pv=0x60ed80) [0221.586] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19ea30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0221.591] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Claws-mail", nBufferLength=0x105, lpBuffer=0x19eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Claws-mail", lpFilePart=0x0) returned 0x30 [0221.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef20) returned 1 [0221.591] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Claws-mail" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\claws-mail"), fInfoLevelId=0x0, lpFileInformation=0x19ef9c | out: lpFileInformation=0x19ef9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0221.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef1c) returned 1 [0221.596] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Claws-mail\\clawsrc", nBufferLength=0x105, lpBuffer=0x19eacc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Claws-mail\\clawsrc", lpFilePart=0x0) returned 0x38 [0221.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0221.597] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Claws-mail\\clawsrc" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\claws-mail\\clawsrc"), fInfoLevelId=0x0, lpFileInformation=0x19efa8 | out: lpFileInformation=0x19efa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0221.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef28) returned 1 [0221.611] CoTaskMemAlloc (cb=0x20c) returned 0x60ed80 [0221.611] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x60ed80 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0221.611] CoTaskMemFree (pv=0x60ed80) [0221.611] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0221.614] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\falkon\\profiles\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\falkon\\profiles\\profiles.ini", lpFilePart=0x0) returned 0x40 [0221.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef10) returned 1 [0221.614] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\falkon\\profiles\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\falkon\\profiles\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0221.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d5e8) returned 1 [0221.696] CoTaskMemAlloc (cb=0x20c) returned 0x60ed80 [0221.696] SHGetFolderPathW (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x60ed80 | out: pszPath="C:\\ProgramData") returned 0x0 [0221.697] CoTaskMemFree (pv=0x60ed80) [0221.697] GetFullPathNameW (in: lpFileName="C:\\ProgramData", nBufferLength=0x105, lpBuffer=0x19ea70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData", lpFilePart=0x0) returned 0xe [0221.698] CoTaskMemAlloc (cb=0x20c) returned 0x60ed80 [0221.698] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x60ed80 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0221.698] CoTaskMemFree (pv=0x60ed80) [0221.698] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19ea70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0221.698] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\FlashFXP\\", nBufferLength=0x105, lpBuffer=0x19eb04, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\FlashFXP\\", lpFilePart=0x0) returned 0x18 [0221.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef60) returned 1 [0221.698] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\FlashFXP\\" (normalized: "c:\\programdata\\flashfxp"), fInfoLevelId=0x0, lpFileInformation=0x19efdc | out: lpFileInformation=0x19efdc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0221.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef5c) returned 1 [0221.699] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FlashFXP\\", nBufferLength=0x105, lpBuffer=0x19eb04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FlashFXP\\", lpFilePart=0x0) returned 0x2f [0221.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef60) returned 1 [0221.699] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FlashFXP\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\flashfxp"), fInfoLevelId=0x0, lpFileInformation=0x19efdc | out: lpFileInformation=0x19efdc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0221.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef5c) returned 1 [0221.763] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Aerofox\\FoxmailPreview", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eef0 | out: phkResult=0x19eef0*=0x0) returned 0x2 [0221.766] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Aerofox\\Foxmail\\V3.1", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eef0 | out: phkResult=0x19eef0*=0x0) returned 0x2 [0221.768] GetFullPathNameW (in: lpFileName="\\Storage\\", nBufferLength=0x105, lpBuffer=0x19ea5c, lpFilePart=0x0 | out: lpBuffer="C:\\Storage\\", lpFilePart=0x0) returned 0xb [0221.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eeb8) returned 1 [0221.768] GetFileAttributesExW (in: lpFileName="C:\\Storage\\" (normalized: "c:\\storage"), fInfoLevelId=0x0, lpFileInformation=0x19ef34 | out: lpFileInformation=0x19ef34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0221.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eeb4) returned 1 [0221.770] GetFullPathNameW (in: lpFileName="\\mail\\", nBufferLength=0x105, lpBuffer=0x19ea5c, lpFilePart=0x0 | out: lpBuffer="C:\\mail\\", lpFilePart=0x0) returned 0x8 [0221.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eeb8) returned 1 [0221.770] GetFileAttributesExW (in: lpFileName="C:\\mail\\" (normalized: "c:\\mail"), fInfoLevelId=0x0, lpFileInformation=0x19ef34 | out: lpFileInformation=0x19ef34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0221.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eeb4) returned 1 [0221.770] CoTaskMemAlloc (cb=0x20c) returned 0x60ed80 [0221.770] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x60ed80 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0221.770] CoTaskMemFree (pv=0x60ed80) [0221.770] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0221.772] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\VirtualStore\\Program Files\\Foxmail\\mail\\", nBufferLength=0x105, lpBuffer=0x19ea5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\VirtualStore\\Program Files\\Foxmail\\mail\\", lpFilePart=0x0) returned 0x4c [0221.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eeb8) returned 1 [0221.772] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\VirtualStore\\Program Files\\Foxmail\\mail\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\virtualstore\\program files\\foxmail\\mail"), fInfoLevelId=0x0, lpFileInformation=0x19ef34 | out: lpFileInformation=0x19ef34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0221.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eeb4) returned 1 [0221.772] CoTaskMemAlloc (cb=0x20c) returned 0x60ed80 [0221.772] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x60ed80 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0221.772] CoTaskMemFree (pv=0x60ed80) [0221.772] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0221.774] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\VirtualStore\\Program Files (x86)\\Foxmail\\mail\\", nBufferLength=0x105, lpBuffer=0x19ea5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\VirtualStore\\Program Files (x86)\\Foxmail\\mail\\", lpFilePart=0x0) returned 0x52 [0221.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eeb8) returned 1 [0221.774] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\VirtualStore\\Program Files (x86)\\Foxmail\\mail\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\virtualstore\\program files (x86)\\foxmail\\mail"), fInfoLevelId=0x0, lpFileInformation=0x19ef34 | out: lpFileInformation=0x19ef34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0221.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eeb4) returned 1 [0221.840] CoTaskMemAlloc (cb=0x20c) returned 0x60ed80 [0221.840] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x60ed80 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0221.840] CoTaskMemFree (pv=0x60ed80) [0221.840] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19e924, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0221.842] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data", nBufferLength=0x105, lpBuffer=0x19e99c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data", lpFilePart=0x0) returned 0x3c [0221.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edf8) returned 1 [0221.843] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19ee74 | out: lpFileInformation=0x19ee74*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0221.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf4) returned 1 [0222.255] VaultEnumerateVaults () returned 0x0 [0222.286] VaultOpenVault () returned 0x0 [0222.291] VaultEnumerateItems () returned 0x0 [0222.292] VaultOpenVault () returned 0x0 [0222.295] VaultEnumerateItems () returned 0x0 [0222.363] CoTaskMemAlloc (cb=0x20c) returned 0x60ed80 [0222.363] GetEnvironmentVariableW (in: lpName="Programfiles(x86)", lpBuffer=0x60ed80, nSize=0x104 | out: lpBuffer="") returned 0x16 [0222.363] CoTaskMemFree (pv=0x60ed80) [0222.365] CoTaskMemAlloc (cb=0x20c) returned 0x60ed80 [0222.365] GetEnvironmentVariableW (in: lpName="programfiles(x86)", lpBuffer=0x60ed80, nSize=0x104 | out: lpBuffer="") returned 0x16 [0222.366] CoTaskMemFree (pv=0x60ed80) [0222.368] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\jDownloader\\config\\database.script", nBufferLength=0x105, lpBuffer=0x19eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\jDownloader\\config\\database.script", lpFilePart=0x0) returned 0x39 [0222.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efc4) returned 1 [0222.368] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\jDownloader\\config\\database.script" (normalized: "c:\\program files (x86)\\jdownloader\\config\\database.script"), fInfoLevelId=0x0, lpFileInformation=0x19f040 | out: lpFileInformation=0x19f040*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0222.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efc0) returned 1 [0222.408] CoTaskMemAlloc (cb=0x20c) returned 0x60ed80 [0222.408] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x60ed80 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0222.408] CoTaskMemFree (pv=0x60ed80) [0222.408] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19eb00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0222.412] CoTaskMemAlloc (cb=0x20c) returned 0x60ed80 [0222.412] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x60ed80 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0222.413] CoTaskMemFree (pv=0x60ed80) [0222.413] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19eb00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0222.416] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\eM Client", nBufferLength=0x105, lpBuffer=0x19eb94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\eM Client", lpFilePart=0x0) returned 0x2f [0222.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eff0) returned 1 [0222.416] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\eM Client" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\em client"), fInfoLevelId=0x0, lpFileInformation=0x19f06c | out: lpFileInformation=0x19f06c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0222.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efec) returned 1 [0222.422] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\profiles.ini", lpFilePart=0x0) returned 0x3e [0222.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0222.422] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\thunderbird\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0222.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0222.430] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\profiles.ini", lpFilePart=0x0) returned 0x3e [0222.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0222.430] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\thunderbird\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0222.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0222.476] CoTaskMemAlloc (cb=0x20c) returned 0x60ed80 [0222.476] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x60ed80 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0222.476] CoTaskMemFree (pv=0x60ed80) [0222.477] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0222.478] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Trillian\\users\\global\\accounts.dat", nBufferLength=0x105, lpBuffer=0x19eb8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Trillian\\users\\global\\accounts.dat", lpFilePart=0x0) returned 0x48 [0222.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efec) returned 1 [0222.478] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Trillian\\users\\global\\accounts.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\trillian\\users\\global\\accounts.dat"), fInfoLevelId=0x0, lpFileInformation=0x19f068 | out: lpFileInformation=0x19f068*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0222.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efe8) returned 1 [0222.490] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\RimArts\\B2\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f020 | out: phkResult=0x19f020*=0x0) returned 0x2 [0222.491] GetFullPathNameW (in: lpFileName="Folder.lst", nBufferLength=0x105, lpBuffer=0x19eb8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Folder.lst", lpFilePart=0x0) returned 0x28 [0222.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efec) returned 1 [0222.491] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Folder.lst" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\folder.lst"), fInfoLevelId=0x0, lpFileInformation=0x19f068 | out: lpFileInformation=0x19f068*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0222.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efe8) returned 1 [0222.506] CoTaskMemAlloc (cb=0x20c) returned 0x60ed80 [0222.506] GetEnvironmentVariableW (in: lpName="appdata", lpBuffer=0x60ed80, nSize=0x104 | out: lpBuffer="") returned 0x25 [0222.506] CoTaskMemFree (pv=0x60ed80) [0222.507] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Ipswitch\\WS_FTP\\Sites\\ws_ftp.ini", nBufferLength=0x105, lpBuffer=0x19eb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Ipswitch\\WS_FTP\\Sites\\ws_ftp.ini", lpFilePart=0x0) returned 0x46 [0222.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efb4) returned 1 [0222.507] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Ipswitch\\WS_FTP\\Sites\\ws_ftp.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\ipswitch\\ws_ftp\\sites\\ws_ftp.ini"), fInfoLevelId=0x0, lpFileInformation=0x19f030 | out: lpFileInformation=0x19f030*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0222.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efb0) returned 1 [0222.520] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x19effc | out: phkResult=0x19effc*=0x0) returned 0x2 [0222.521] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x19effc | out: phkResult=0x19effc*=0x0) returned 0x2 [0222.522] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x19effc | out: phkResult=0x19effc*=0x0) returned 0x2 [0222.524] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x19effc | out: phkResult=0x19effc*=0x5c0) returned 0x0 [0222.525] RegQueryInfoKeyW (in: hKey=0x5c0, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x19f024, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x19f020, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x19f024*=0x3, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x19f020*=0x6, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0222.526] RegEnumKeyExW (in: hKey=0x5c0, dwIndex=0x0, lpName=0x21c8c08, lpcchName=0x19f040, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000001", lpcchName=0x19f040, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0222.526] RegEnumKeyExW (in: hKey=0x5c0, dwIndex=0x1, lpName=0x21c8c08, lpcchName=0x19f040, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000002", lpcchName=0x19f040, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0222.526] RegEnumKeyExW (in: hKey=0x5c0, dwIndex=0x2, lpName=0x21c8c08, lpcchName=0x19f040, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000003", lpcchName=0x19f040, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0222.527] RegOpenKeyExW (in: hKey=0x5c0, lpSubKey="00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x19effc | out: phkResult=0x19effc*=0x5c4) returned 0x0 [0222.530] RegQueryValueExW (in: hKey=0x5c4, lpValueName="Email", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0222.532] RegQueryValueExW (in: hKey=0x5c4, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0222.534] RegQueryValueExW (in: hKey=0x5c4, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0222.536] RegQueryValueExW (in: hKey=0x5c4, lpValueName="HTTP Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0222.539] RegQueryValueExW (in: hKey=0x5c4, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0222.539] RegCloseKey (hKey=0x5c4) returned 0x0 [0222.539] RegOpenKeyExW (in: hKey=0x5c0, lpSubKey="00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x19effc | out: phkResult=0x19effc*=0x5c4) returned 0x0 [0222.539] RegQueryValueExW (in: hKey=0x5c4, lpValueName="Email", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x1, lpData=0x0, lpcbData=0x19f018*=0x1e) returned 0x0 [0222.539] RegQueryValueExW (in: hKey=0x5c4, lpValueName="Email", lpReserved=0x0, lpType=0x19f01c, lpData=0x21c91fc, lpcbData=0x19f018*=0x1e | out: lpType=0x19f01c*=0x1, lpData="achoo@gdllo.de", lpcbData=0x19f018*=0x1e) returned 0x0 [0222.539] RegQueryValueExW (in: hKey=0x5c4, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0222.539] RegQueryValueExW (in: hKey=0x5c4, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x3, lpData=0x0, lpcbData=0x19f018*=0x121) returned 0x0 [0222.539] RegQueryValueExW (in: hKey=0x5c4, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x21c9254, lpcbData=0x19f018*=0x121 | out: lpType=0x19f01c*=0x3, lpData=0x21c9254*, lpcbData=0x19f018*=0x121) returned 0x0 [0222.539] RegQueryValueExW (in: hKey=0x5c4, lpValueName="HTTP Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0222.539] RegQueryValueExW (in: hKey=0x5c4, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0222.539] RegQueryValueExW (in: hKey=0x5c4, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0222.540] RegQueryValueExW (in: hKey=0x5c4, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x3, lpData=0x0, lpcbData=0x19f018*=0x121) returned 0x0 [0222.540] RegQueryValueExW (in: hKey=0x5c4, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x21c93b8, lpcbData=0x19f018*=0x121 | out: lpType=0x19f01c*=0x3, lpData=0x21c93b8*, lpcbData=0x19f018*=0x121) returned 0x0 [0222.540] RegQueryValueExW (in: hKey=0x5c4, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x3, lpData=0x0, lpcbData=0x19f018*=0x121) returned 0x0 [0222.540] RegQueryValueExW (in: hKey=0x5c4, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x21c94e8, lpcbData=0x19f018*=0x121 | out: lpType=0x19f01c*=0x3, lpData=0x21c94e8*, lpcbData=0x19f018*=0x121) returned 0x0 [0223.332] CryptUnprotectData (in: pDataIn=0x19f004, ppszDataDescr=0x0, pOptionalEntropy=0x19effc, pvReserved=0x0, pPromptStruct=0x0, dwFlags=0x1, pDataOut=0x19f00c | out: ppszDataDescr=0x0, pDataOut=0x19f00c) returned 1 [0223.359] LocalFree (hMem=0x59ac28) returned 0x0 [0223.360] RegQueryValueExW (in: hKey=0x5c4, lpValueName="HTTP Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0223.360] RegQueryValueExW (in: hKey=0x5c4, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0223.360] RegQueryValueExW (in: hKey=0x5c4, lpValueName="Email", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x1, lpData=0x0, lpcbData=0x19f018*=0x1e) returned 0x0 [0223.360] RegQueryValueExW (in: hKey=0x5c4, lpValueName="Email", lpReserved=0x0, lpType=0x19f01c, lpData=0x21c9818, lpcbData=0x19f018*=0x1e | out: lpType=0x19f01c*=0x1, lpData="achoo@gdllo.de", lpcbData=0x19f018*=0x1e) returned 0x0 [0223.362] RegQueryValueExW (in: hKey=0x5c4, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x1, lpData=0x0, lpcbData=0x19f018*=0x1c) returned 0x0 [0223.362] RegQueryValueExW (in: hKey=0x5c4, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x19f01c, lpData=0x21c9894, lpcbData=0x19f018*=0x1c | out: lpType=0x19f01c*=0x1, lpData="smtp.gdllo.de", lpcbData=0x19f018*=0x1c) returned 0x0 [0223.362] RegQueryValueExW (in: hKey=0x5c4, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x1, lpData=0x0, lpcbData=0x19f018*=0x1c) returned 0x0 [0223.363] RegQueryValueExW (in: hKey=0x5c4, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x19f01c, lpData=0x21c98e4, lpcbData=0x19f018*=0x1c | out: lpType=0x19f01c*=0x1, lpData="smtp.gdllo.de", lpcbData=0x19f018*=0x1c) returned 0x0 [0223.371] RegCloseKey (hKey=0x5c4) returned 0x0 [0223.372] RegOpenKeyExW (in: hKey=0x5c0, lpSubKey="00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x19effc | out: phkResult=0x19effc*=0x5c4) returned 0x0 [0223.372] RegQueryValueExW (in: hKey=0x5c4, lpValueName="Email", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0223.372] RegQueryValueExW (in: hKey=0x5c4, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0223.372] RegQueryValueExW (in: hKey=0x5c4, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0223.372] RegQueryValueExW (in: hKey=0x5c4, lpValueName="HTTP Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0223.372] RegQueryValueExW (in: hKey=0x5c4, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x19f01c, lpData=0x0, lpcbData=0x19f018*=0x0 | out: lpType=0x19f01c*=0x0, lpData=0x0, lpcbData=0x19f018*=0x0) returned 0x2 [0223.372] RegCloseKey (hKey=0x5c4) returned 0x0 [0223.383] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\profiles.ini", lpFilePart=0x0) returned 0x48 [0223.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0223.383] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\8pecxstudios\\cyberfox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0223.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0223.386] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\profiles.ini", lpFilePart=0x0) returned 0x48 [0223.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0223.386] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\8pecxstudios\\cyberfox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0223.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0223.482] CoTaskMemAlloc (cb=0x20c) returned 0x60b878 [0223.483] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x60b878 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0223.483] CoTaskMemFree (pv=0x60b878) [0223.483] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19eaf8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0223.484] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NordVPN", nBufferLength=0x105, lpBuffer=0x19eb8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NordVPN", lpFilePart=0x0) returned 0x2b [0223.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f028) returned 1 [0223.485] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NordVPN" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\nordvpn"), fInfoLevelId=0x0, lpFileInformation=0x21ccb18 | out: lpFileInformation=0x21ccb18*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0223.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f024) returned 1 [0223.488] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0223.521] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f05c | out: phkResult=0x19f05c*=0x0) returned 0x2 [0223.525] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini", lpFilePart=0x0) returned 0x44 [0223.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0223.525] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mozilla\\seamonkey\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0223.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0223.529] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini", lpFilePart=0x0) returned 0x44 [0223.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0223.529] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mozilla\\seamonkey\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0223.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0223.558] CoTaskMemAlloc (cb=0x20c) returned 0x60b878 [0223.558] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x60b878, nSize=0x104 | out: lpBuffer="") returned 0x2 [0223.558] CoTaskMemFree (pv=0x60b878) [0223.561] GetFullPathNameW (in: lpFileName="C:\\FTP Navigator\\Ftplist.txt", nBufferLength=0x105, lpBuffer=0x19ea3c, lpFilePart=0x0 | out: lpBuffer="C:\\FTP Navigator\\Ftplist.txt", lpFilePart=0x0) returned 0x1c [0223.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef30) returned 1 [0223.561] CreateFileW (lpFileName="C:\\FTP Navigator\\Ftplist.txt" (normalized: "c:\\ftp navigator\\ftplist.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0223.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0223.602] CoTaskMemAlloc (cb=0x20c) returned 0x60b878 [0223.602] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0x60b878, nSize=0x104 | out: lpBuffer="") returned 0x25 [0223.602] CoTaskMemFree (pv=0x60b878) [0223.605] CoTaskMemAlloc (cb=0x20c) returned 0x60b878 [0223.605] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0x60b878, nSize=0x104 | out: lpBuffer="") returned 0x25 [0223.605] CoTaskMemFree (pv=0x60b878) [0223.653] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\", nBufferLength=0x105, lpBuffer=0x19ead4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\", lpFilePart=0x0) returned 0x52 [0223.653] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\*.xml", nBufferLength=0x105, lpBuffer=0x19eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\*.xml", lpFilePart=0x0) returned 0x57 [0223.653] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\", nBufferLength=0x105, lpBuffer=0x19eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\", lpFilePart=0x0) returned 0x52 [0223.653] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect", nBufferLength=0x105, lpBuffer=0x19eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect", lpFilePart=0x0) returned 0x51 [0223.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef98) returned 1 [0223.654] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect", nBufferLength=0x105, lpBuffer=0x19eaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect", lpFilePart=0x0) returned 0x51 [0223.654] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\", nBufferLength=0x105, lpBuffer=0x19ea74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\", lpFilePart=0x0) returned 0x52 [0223.654] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\*.xml" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\smartftp\\client 2.0\\favorites\\quick connect\\*.xml"), lpFindFileData=0x19ecc0 | out: lpFindFileData=0x19ecc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0223.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef5c) returned 1 [0223.716] SetErrorInfo (dwReserved=0x0, perrinfo=0x51f42c) returned 0x0 [0223.717] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\", nBufferLength=0x105, lpBuffer=0x19eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\SmartFTP\\Client 2.0\\Favorites\\Quick Connect\\", lpFilePart=0x0) returned 0x52 [0223.806] CoTaskMemAlloc (cb=0x20c) returned 0x60b878 [0223.806] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0x60b878, nSize=0x104 | out: lpBuffer="") returned 0x25 [0223.806] CoTaskMemFree (pv=0x60b878) [0223.808] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FileZilla\\recentservers.xml", nBufferLength=0x105, lpBuffer=0x19ea48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FileZilla\\recentservers.xml", lpFilePart=0x0) returned 0x41 [0223.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef3c) returned 1 [0223.808] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FileZilla\\recentservers.xml" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\filezilla\\recentservers.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0223.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d618) returned 1 [0223.816] CoTaskMemAlloc (cb=0x20c) returned 0x60b878 [0223.816] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x60b878 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0223.816] CoTaskMemFree (pv=0x60b878) [0223.816] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19eb1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0223.821] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\", nBufferLength=0x105, lpBuffer=0x19eb44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\", lpFilePart=0x0) returned 0x3c [0223.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa0) returned 1 [0223.822] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f01c | out: lpFileInformation=0x19f01c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0223.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef9c) returned 1 [0223.831] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\profiles.ini", lpFilePart=0x0) returned 0x41 [0223.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0223.831] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mozilla\\icecat\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0223.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0223.890] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\profiles.ini", lpFilePart=0x0) returned 0x41 [0223.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0223.891] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mozilla\\icecat\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0223.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0223.899] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\profiles.ini", lpFilePart=0x0) returned 0x3b [0223.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0223.899] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\k-meleon\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0223.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0223.909] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19ea38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\profiles.ini", lpFilePart=0x0) returned 0x3b [0223.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef2c) returned 1 [0223.909] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\k-meleon\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0223.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d608) returned 1 [0224.008] CoTaskMemAlloc (cb=0x20c) returned 0x60b878 [0224.008] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x60b878 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0224.008] CoTaskMemFree (pv=0x60b878) [0224.008] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19eaf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0224.010] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data", nBufferLength=0x105, lpBuffer=0x19eb88, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data", lpFilePart=0x0) returned 0x3f [0224.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efe4) returned 1 [0224.011] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tencent\\qqbrowser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f060 | out: lpFileInformation=0x19f060*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0224.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efe0) returned 1 [0224.011] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\Default\\EncryptedStorage", nBufferLength=0x105, lpBuffer=0x19eb90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\Default\\EncryptedStorage", lpFilePart=0x0) returned 0x58 [0224.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eff0) returned 1 [0224.011] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\Default\\EncryptedStorage" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tencent\\qqbrowser\\user data\\default\\encryptedstorage"), fInfoLevelId=0x0, lpFileInformation=0x19f06c | out: lpFileInformation=0x19f06c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0224.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efec) returned 1 [0224.055] GetUserNameW (in: lpBuffer=0x19f1bc, pcbBuffer=0x21d9e70 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x21d9e70) returned 1 [0224.056] GetComputerNameW (in: lpBuffer=0x19f1bc, nSize=0x21da338 | out: lpBuffer="XC64ZB", nSize=0x21da338) returned 1 [0224.090] GetTimeZoneInformation (in: lpTimeZoneInformation=0x19f230 | out: lpTimeZoneInformation=0x19f230) returned 0x2 [0224.177] GetUserNameW (in: lpBuffer=0x19f1ac, pcbBuffer=0x21ddd18 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x21ddd18) returned 1 [0224.181] GetComputerNameW (in: lpBuffer=0x19f1ac, nSize=0x21de1b0 | out: lpBuffer="XC64ZB", nSize=0x21de1b0) returned 1 [0224.216] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x5c4 [0224.216] SetEvent (hEvent=0x468) returned 1 [0224.216] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f32c*=0x5c4, lpdwindex=0x19f14c | out: lpdwindex=0x19f14c) returned 0x0 [0224.217] CoGetContextToken (in: pToken=0x19e164 | out: pToken=0x19e164) returned 0x0 [0224.217] CoGetContextToken (in: pToken=0x19e14c | out: pToken=0x19e14c) returned 0x0 [0224.217] CoGetContextToken (in: pToken=0x19e0d8 | out: pToken=0x19e0d8) returned 0x0 [0224.217] IUnknown:Release (This=0x59a328) returned 0x1 [0224.217] IUnknown:Release (This=0x59a328) returned 0x0 [0224.217] CoGetContextToken (in: pToken=0x19e0d8 | out: pToken=0x19e0d8) returned 0x0 [0224.217] IUnknown:Release (This=0x5937c0) returned 0x1 [0224.217] IUnknown:Release (This=0x5937c0) returned 0x0 [0224.217] IUnknown:Release (This=0x56ce28) returned 0x3 [0224.218] CoGetContextToken (in: pToken=0x19e0d8 | out: pToken=0x19e0d8) returned 0x0 [0224.218] CoGetContextToken (in: pToken=0x19e0d8 | out: pToken=0x19e0d8) returned 0x0 [0224.218] IUnknown:Release (This=0x5b64c0) returned 0x1 [0224.218] IUnknown:Release (This=0x5b64c0) returned 0x0 [0224.224] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0224.224] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0224.224] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0224.224] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0224.224] IUnknown:Release (This=0x5b0e00) returned 0x0 [0224.224] IUnknown:Release (This=0x5b0e58) returned 0x0 [0224.224] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0224.225] CoGetContextToken (in: pToken=0x19e0d8 | out: pToken=0x19e0d8) returned 0x0 [0224.225] WbemLocator:IUnknown:Release (This=0x560a60) returned 0x2 [0224.225] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0224.225] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0224.225] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0224.225] IUnknown:Release (This=0x5b0d50) returned 0x0 [0224.225] IUnknown:Release (This=0x5b0d24) returned 0x0 [0224.225] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0224.225] IUnknown:Release (This=0x5b63f8) returned 0x1 [0224.225] IUnknown:Release (This=0x5b63f8) returned 0x0 [0224.238] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0224.238] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0224.238] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0224.238] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0224.238] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0224.238] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0224.238] CoGetContextToken (in: pToken=0x19e0d8 | out: pToken=0x19e0d8) returned 0x0 [0224.238] IUnknown:Release (This=0x5c2230) returned 0x1 [0224.238] WbemLocator:IUnknown:Release (This=0x560a60) returned 0x1 [0224.238] WbemLocator:IUnknown:Release (This=0x560a60) returned 0x0 [0224.239] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0224.239] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0224.239] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0224.239] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0224.239] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0224.240] IUnknown:Release (This=0x5c2230) returned 0x0 [0224.240] IUnknown:Release (This=0x5b0eb0) returned 0x0 [0224.240] IUnknown:Release (This=0x5b0e84) returned 0x0 [0224.242] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0224.242] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0224.242] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0224.242] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0224.242] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0224.242] CoGetContextToken (in: pToken=0x19e0d8 | out: pToken=0x19e0d8) returned 0x0 [0224.242] WbemLocator:IUnknown:Release (This=0x5b3740) returned 0x1 [0224.242] WbemLocator:IUnknown:Release (This=0x5b25b0) returned 0x0 [0224.243] CoGetContextToken (in: pToken=0x19e0d8 | out: pToken=0x19e0d8) returned 0x0 [0224.243] IUnknown:Release (This=0x5eee38) returned 0x2 [0224.243] IUnknown:Release (This=0x5eee38) returned 0x1 [0224.243] CoGetContextToken (in: pToken=0x19e0d8 | out: pToken=0x19e0d8) returned 0x0 [0224.243] WbemLocator:IUnknown:Release (This=0x5b4840) returned 0x1 [0224.243] WbemLocator:IUnknown:Release (This=0x5b26a0) returned 0x0 [0224.243] CoGetContextToken (in: pToken=0x19e0d8 | out: pToken=0x19e0d8) returned 0x0 [0224.243] IUnknown:Release (This=0x5f15a8) returned 0x1 [0224.243] IUnknown:Release (This=0x5f15a8) returned 0x0 [0224.243] CoGetContextToken (in: pToken=0x19e0d8 | out: pToken=0x19e0d8) returned 0x0 [0224.243] IUnknown:Release (This=0x4f53238) returned 0x1 [0224.243] IUnknown:Release (This=0x4f53238) returned 0x0 [0224.243] CoGetContextToken (in: pToken=0x19e0d8 | out: pToken=0x19e0d8) returned 0x0 [0224.243] IUnknown:Release (This=0x4f53638) returned 0x1 [0224.243] IUnknown:Release (This=0x4f53638) returned 0x0 [0224.243] CoGetContextToken (in: pToken=0x19e0d8 | out: pToken=0x19e0d8) returned 0x0 [0224.244] IUnknown:Release (This=0x4f53a20) returned 0x1 [0224.244] IUnknown:Release (This=0x4f53a20) returned 0x0 [0224.244] CoGetContextToken (in: pToken=0x19e0d8 | out: pToken=0x19e0d8) returned 0x0 [0224.244] IUnknown:Release (This=0x4f53e10) returned 0x1 [0224.244] IUnknown:Release (This=0x4f53e10) returned 0x0 [0224.244] CoGetContextToken (in: pToken=0x19e0d8 | out: pToken=0x19e0d8) returned 0x0 [0224.244] IUnknown:Release (This=0x5ec408) returned 0x2 [0224.244] IUnknown:Release (This=0x5ec408) returned 0x1 [0224.249] CoGetContextToken (in: pToken=0x19f1f8 | out: pToken=0x19f1f8) returned 0x0 [0224.249] CoGetContextToken (in: pToken=0x19f158 | out: pToken=0x19f158) returned 0x0 [0224.249] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e09d0, riid=0x19f228*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f224 | out: ppvObject=0x19f224*=0x5e09d0) returned 0x0 [0224.249] WbemDefPath:IUnknown:AddRef (This=0x5e09d0) returned 0x3 [0224.249] WbemDefPath:IUnknown:Release (This=0x5e09d0) returned 0x2 [0224.249] WbemDefPath:IWbemPath:SetText (This=0x5e09d0, uMode=0x4, pszPath="Win32_OperatingSystem") returned 0x0 [0224.249] WbemDefPath:IWbemPath:GetInfo (in: This=0x5e09d0, uRequestedInfo=0x0, puResponse=0x19f3d8 | out: puResponse=0x19f3d8*=0xc15) returned 0x0 [0224.249] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5e09d0, puCount=0x19f3d0 | out: puCount=0x19f3d0*=0x0) returned 0x0 [0224.250] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5c3310, puCount=0x19f3a8 | out: puCount=0x19f3a8*=0x2) returned 0x0 [0224.250] WbemDefPath:IWbemPath:GetText (in: This=0x5c3310, lFlags=4, puBuffLength=0x19f3a4*=0x0, pszText=0x0 | out: puBuffLength=0x19f3a4*=0xf, pszText=0x0) returned 0x0 [0224.250] WbemDefPath:IWbemPath:GetText (in: This=0x5c3310, lFlags=4, puBuffLength=0x19f3a4*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3a4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0224.261] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f244*=0x5d4, lpdwindex=0x19f0f4 | out: lpdwindex=0x19f0f4) returned 0x0 [0224.261] CoGetContextToken (in: pToken=0x19e10c | out: pToken=0x19e10c) returned 0x0 [0224.261] CoGetContextToken (in: pToken=0x19e0cc | out: pToken=0x19e0cc) returned 0x0 [0224.261] WbemLocator:IUnknown:Release (This=0x5b4140) returned 0x1 [0224.261] IUnknown:Release (This=0x5b6588) returned 0x0 [0224.269] CoGetContextToken (in: pToken=0x19e10c | out: pToken=0x19e10c) returned 0x0 [0224.269] CoGetContextToken (in: pToken=0x19e0cc | out: pToken=0x19e0cc) returned 0x0 [0224.269] WbemLocator:IUnknown:Release (This=0x5b5140) returned 0x1 [0224.269] IUnknown:Release (This=0x5b67e0) returned 0x0 [0224.310] CoGetContextToken (in: pToken=0x19f000 | out: pToken=0x19f000) returned 0x0 [0224.310] CoGetContextToken (in: pToken=0x19efa8 | out: pToken=0x19efa8) returned 0x0 [0224.310] IUnknown:QueryInterface (in: This=0x564140, riid=0x6bd28724*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ef88 | out: ppvObject=0x19ef88*=0x564150) returned 0x0 [0224.311] CObjectContext::ContextCallback () returned 0x0 [0224.313] IUnknown:Release (This=0x564150) returned 0x1 [0224.313] CoUnmarshalInterface (in: pStm=0x5a4088, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eff0 | out: ppv=0x19eff0*=0x5b3b40) returned 0x0 [0224.313] CoMarshalInterface (pStm=0x5a4088, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5b3b40, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0224.314] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3b40, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee94 | out: ppvObject=0x19ee94*=0x5b3b40) returned 0x0 [0224.314] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3b40, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ee50 | out: ppvObject=0x19ee50*=0x0) returned 0x80004002 [0224.315] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3b40, riid=0x6bdafb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ec6c | out: ppvObject=0x19ec6c*=0x0) returned 0x80004002 [0224.315] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3b40, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19ea44 | out: ppvObject=0x19ea44*=0x0) returned 0x80004002 [0224.316] WbemLocator:IUnknown:AddRef (This=0x5b3b40) returned 0x3 [0224.316] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3b40, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e7ac | out: ppvObject=0x19e7ac*=0x0) returned 0x80004002 [0224.316] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3b40, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e75c | out: ppvObject=0x19e75c*=0x0) returned 0x80004002 [0224.316] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3b40, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e768 | out: ppvObject=0x19e768*=0x5b3a9c) returned 0x0 [0224.316] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5b3a9c, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e770 | out: pCid=0x19e770*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0224.316] WbemLocator:IUnknown:Release (This=0x5b3a9c) returned 0x3 [0224.316] CoGetContextToken (in: pToken=0x19e7c8 | out: pToken=0x19e7c8) returned 0x0 [0224.316] CoGetObjectContext (in: riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5ed52c | out: ppv=0x5ed52c*=0x564088) returned 0x0 [0224.316] CoGetContextToken (in: pToken=0x19ebd0 | out: pToken=0x19ebd0) returned 0x0 [0224.316] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3b40, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec60 | out: ppvObject=0x19ec60*=0x5b3b24) returned 0x0 [0224.317] WbemLocator:IRpcOptions:Query (in: This=0x5b3b24, pPrx=0x5b3b40, dwProperty=2, pdwValue=0x19ec88 | out: pdwValue=0x19ec88) returned 0x0 [0224.317] WbemLocator:IUnknown:Release (This=0x5b3b24) returned 0x3 [0224.317] WbemLocator:IUnknown:Release (This=0x5b3b40) returned 0x2 [0224.317] WbemLocator:IUnknown:Release (This=0x5b3b40) returned 0x1 [0224.317] CoGetContextToken (in: pToken=0x19ef40 | out: pToken=0x19ef40) returned 0x0 [0224.317] WbemLocator:IUnknown:AddRef (This=0x5b3b40) returned 0x2 [0224.317] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3b40, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1fc | out: ppvObject=0x19f1fc*=0x5b3b1c) returned 0x0 [0224.317] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5b3b1c, pProxy=0x5b3b40, pAuthnSvc=0x19f24c, pAuthzSvc=0x19f248, pServerPrincName=0x19f240, pAuthnLevel=0x19f244, pImpLevel=0x19f234, pAuthInfo=0x19f238, pCapabilites=0x19f23c | out: pAuthnSvc=0x19f24c*=0xa, pAuthzSvc=0x19f248*=0x0, pServerPrincName=0x19f240, pAuthnLevel=0x19f244*=0x6, pImpLevel=0x19f234*=0x2, pAuthInfo=0x19f238, pCapabilites=0x19f23c*=0x1) returned 0x0 [0224.317] WbemLocator:IUnknown:Release (This=0x5b3b1c) returned 0x2 [0224.317] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3b40, riid=0x6c5910f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1f0 | out: ppvObject=0x19f1f0*=0x5b3b40) returned 0x0 [0224.317] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3b40, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1ec | out: ppvObject=0x19f1ec*=0x5b3b1c) returned 0x0 [0224.317] WbemLocator:IClientSecurity:SetBlanket (This=0x5b3b1c, pProxy=0x5b3b40, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0224.318] WbemLocator:IUnknown:Release (This=0x5b3b1c) returned 0x3 [0224.318] WbemLocator:IUnknown:Release (This=0x5b3b40) returned 0x2 [0224.318] CoTaskMemFree (pv=0x5a35b8) [0224.318] WbemLocator:IUnknown:Release (This=0x5b3b40) returned 0x1 [0224.318] SysStringLen (param_1=0x0) returned 0x0 [0224.318] CoGetContextToken (in: pToken=0x19f1b8 | out: pToken=0x19f1b8) returned 0x0 [0224.318] CoGetContextToken (in: pToken=0x19f118 | out: pToken=0x19f118) returned 0x0 [0224.318] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3b40, riid=0x19f1e8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19f1e4 | out: ppvObject=0x19f1e4*=0x5b2290) returned 0x0 [0224.319] WbemLocator:IUnknown:AddRef (This=0x5b2290) returned 0x3 [0224.319] WbemLocator:IUnknown:Release (This=0x5b2290) returned 0x2 [0224.319] CoGetContextToken (in: pToken=0x19f178 | out: pToken=0x19f178) returned 0x0 [0224.319] WbemLocator:IUnknown:AddRef (This=0x5b2290) returned 0x3 [0224.320] WbemLocator:IUnknown:QueryInterface (in: This=0x5b2290, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1fc | out: ppvObject=0x19f1fc*=0x5b3b1c) returned 0x0 [0224.321] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5b3b1c, pProxy=0x5b2290, pAuthnSvc=0x19f24c, pAuthzSvc=0x19f248, pServerPrincName=0x19f240, pAuthnLevel=0x19f244, pImpLevel=0x19f234, pAuthInfo=0x19f238, pCapabilites=0x19f23c | out: pAuthnSvc=0x19f24c*=0xa, pAuthzSvc=0x19f248*=0x0, pServerPrincName=0x19f240, pAuthnLevel=0x19f244*=0x6, pImpLevel=0x19f234*=0x2, pAuthInfo=0x19f238, pCapabilites=0x19f23c*=0x1) returned 0x0 [0224.322] WbemLocator:IUnknown:Release (This=0x5b3b1c) returned 0x3 [0224.322] WbemLocator:IUnknown:QueryInterface (in: This=0x5b2290, riid=0x6c5910f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1f0 | out: ppvObject=0x19f1f0*=0x5b3b40) returned 0x0 [0224.322] WbemLocator:IUnknown:QueryInterface (in: This=0x5b2290, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1ec | out: ppvObject=0x19f1ec*=0x5b3b1c) returned 0x0 [0224.322] WbemLocator:IClientSecurity:SetBlanket (This=0x5b3b1c, pProxy=0x5b2290, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0224.322] WbemLocator:IUnknown:Release (This=0x5b3b1c) returned 0x4 [0224.322] WbemLocator:IUnknown:Release (This=0x5b3b40) returned 0x3 [0224.322] CoTaskMemFree (pv=0x5a2ec8) [0224.322] WbemLocator:IUnknown:Release (This=0x5b2290) returned 0x2 [0224.322] SysStringLen (param_1=0x0) returned 0x0 [0224.322] CoGetContextToken (in: pToken=0x19f0f0 | out: pToken=0x19f0f0) returned 0x0 [0224.322] WbemLocator:IUnknown:AddRef (This=0x5b2290) returned 0x3 [0224.322] IWbemServices:ExecQuery (in: This=0x5b2290, strQueryLanguage="WQL", strQuery="select * from Win32_OperatingSystem", lFlags=16, pCtx=0x0, ppEnum=0x19f308 | out: ppEnum=0x19f308*=0x5b6970) returned 0x0 [0224.388] IUnknown:QueryInterface (in: This=0x5b6970, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f160 | out: ppvObject=0x19f160*=0x5b6974) returned 0x0 [0224.388] IClientSecurity:QueryBlanket (in: This=0x5b6974, pProxy=0x5b6970, pAuthnSvc=0x19f1b0, pAuthzSvc=0x19f1ac, pServerPrincName=0x19f1a4, pAuthnLevel=0x19f1a8, pImpLevel=0x19f198, pAuthInfo=0x19f19c, pCapabilites=0x19f1a0 | out: pAuthnSvc=0x19f1b0*=0xa, pAuthzSvc=0x19f1ac*=0x0, pServerPrincName=0x19f1a4, pAuthnLevel=0x19f1a8*=0x6, pImpLevel=0x19f198*=0x2, pAuthInfo=0x19f19c, pCapabilites=0x19f1a0*=0x1) returned 0x0 [0224.388] IUnknown:Release (This=0x5b6974) returned 0x1 [0224.388] IUnknown:QueryInterface (in: This=0x5b6970, riid=0x6c5910f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f154 | out: ppvObject=0x19f154*=0x5b3340) returned 0x0 [0224.388] IUnknown:QueryInterface (in: This=0x5b6970, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f150 | out: ppvObject=0x19f150*=0x5b6974) returned 0x0 [0224.389] IClientSecurity:SetBlanket (This=0x5b6974, pProxy=0x5b6970, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0224.390] IUnknown:Release (This=0x5b6974) returned 0x2 [0224.391] WbemLocator:IUnknown:Release (This=0x5b3340) returned 0x1 [0224.391] CoTaskMemFree (pv=0x5a32b8) [0224.391] IUnknown:QueryInterface (in: This=0x5b6970, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed4c | out: ppvObject=0x19ed4c*=0x5b3340) returned 0x0 [0224.391] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3340, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ed08 | out: ppvObject=0x19ed08*=0x0) returned 0x80004002 [0224.392] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3340, riid=0x6bdafb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19eb24 | out: ppvObject=0x19eb24*=0x0) returned 0x80004002 [0224.392] IUnknown:QueryInterface (in: This=0x5b6970, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e8fc | out: ppvObject=0x19e8fc*=0x0) returned 0x80004002 [0224.393] WbemLocator:IUnknown:AddRef (This=0x5b3340) returned 0x3 [0224.393] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3340, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e664 | out: ppvObject=0x19e664*=0x0) returned 0x80004002 [0224.393] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3340, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e614 | out: ppvObject=0x19e614*=0x0) returned 0x80004002 [0224.393] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3340, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e620 | out: ppvObject=0x19e620*=0x5b329c) returned 0x0 [0224.393] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5b329c, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e628 | out: pCid=0x19e628*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0224.393] WbemLocator:IUnknown:Release (This=0x5b329c) returned 0x3 [0224.393] CoGetContextToken (in: pToken=0x19e680 | out: pToken=0x19e680) returned 0x0 [0224.393] CoGetContextToken (in: pToken=0x19ea88 | out: pToken=0x19ea88) returned 0x0 [0224.393] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3340, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eb18 | out: ppvObject=0x19eb18*=0x5b3324) returned 0x0 [0224.394] WbemLocator:IRpcOptions:Query (in: This=0x5b3324, pPrx=0x5b3340, dwProperty=2, pdwValue=0x19eb40 | out: pdwValue=0x19eb40) returned 0x80004002 [0224.394] WbemLocator:IUnknown:Release (This=0x5b3324) returned 0x3 [0224.394] WbemLocator:IUnknown:Release (This=0x5b3340) returned 0x2 [0224.394] CoGetContextToken (in: pToken=0x19f060 | out: pToken=0x19f060) returned 0x0 [0224.394] CoGetContextToken (in: pToken=0x19efc0 | out: pToken=0x19efc0) returned 0x0 [0224.394] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3340, riid=0x19f090*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f08c | out: ppvObject=0x19f08c*=0x5b6970) returned 0x0 [0224.394] IUnknown:AddRef (This=0x5b6970) returned 0x4 [0224.394] IUnknown:Release (This=0x5b6970) returned 0x3 [0224.394] IUnknown:Release (This=0x5b6970) returned 0x2 [0224.394] WbemLocator:IUnknown:Release (This=0x5b2290) returned 0x2 [0224.394] SysStringLen (param_1=0x0) returned 0x0 [0224.394] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5c3310, puCount=0x19f354 | out: puCount=0x19f354*=0x2) returned 0x0 [0224.394] WbemDefPath:IWbemPath:GetText (in: This=0x5c3310, lFlags=4, puBuffLength=0x19f350*=0x0, pszText=0x0 | out: puBuffLength=0x19f350*=0xf, pszText=0x0) returned 0x0 [0224.394] WbemDefPath:IWbemPath:GetText (in: This=0x5c3310, lFlags=4, puBuffLength=0x19f350*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f350*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0224.394] CoGetContextToken (in: pToken=0x19f190 | out: pToken=0x19f190) returned 0x0 [0224.394] IUnknown:AddRef (This=0x5b6970) returned 0x3 [0224.395] IEnumWbemClassObject:Clone (in: This=0x5b6970, ppEnum=0x19f350 | out: ppEnum=0x19f350*=0x5b7208) returned 0x0 [0224.396] IUnknown:QueryInterface (in: This=0x5b7208, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f214 | out: ppvObject=0x19f214*=0x5b720c) returned 0x0 [0224.396] IClientSecurity:QueryBlanket (in: This=0x5b720c, pProxy=0x5b7208, pAuthnSvc=0x19f264, pAuthzSvc=0x19f260, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c, pImpLevel=0x19f24c, pAuthInfo=0x19f250, pCapabilites=0x19f254 | out: pAuthnSvc=0x19f264*=0xa, pAuthzSvc=0x19f260*=0x0, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c*=0x6, pImpLevel=0x19f24c*=0x2, pAuthInfo=0x19f250, pCapabilites=0x19f254*=0x1) returned 0x0 [0224.396] IUnknown:Release (This=0x5b720c) returned 0x1 [0224.396] IUnknown:QueryInterface (in: This=0x5b7208, riid=0x6c5910f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f208 | out: ppvObject=0x19f208*=0x5b3740) returned 0x0 [0224.396] IUnknown:QueryInterface (in: This=0x5b7208, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x5b720c) returned 0x0 [0224.397] IClientSecurity:SetBlanket (This=0x5b720c, pProxy=0x5b7208, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0224.411] IUnknown:Release (This=0x5b720c) returned 0x2 [0224.411] WbemLocator:IUnknown:Release (This=0x5b3740) returned 0x1 [0224.411] CoTaskMemFree (pv=0x5a2ef8) [0224.411] IUnknown:QueryInterface (in: This=0x5b7208, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19edf0 | out: ppvObject=0x19edf0*=0x5b3740) returned 0x0 [0224.412] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3740, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19edac | out: ppvObject=0x19edac*=0x0) returned 0x80004002 [0224.413] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3740, riid=0x6bdafb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ebcc | out: ppvObject=0x19ebcc*=0x0) returned 0x80004002 [0224.414] IUnknown:QueryInterface (in: This=0x5b7208, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e9a4 | out: ppvObject=0x19e9a4*=0x0) returned 0x80004002 [0224.415] WbemLocator:IUnknown:AddRef (This=0x5b3740) returned 0x3 [0224.415] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3740, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e70c | out: ppvObject=0x19e70c*=0x0) returned 0x80004002 [0224.415] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3740, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e6bc | out: ppvObject=0x19e6bc*=0x0) returned 0x80004002 [0224.415] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3740, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e6c8 | out: ppvObject=0x19e6c8*=0x5b369c) returned 0x0 [0224.415] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5b369c, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e6d0 | out: pCid=0x19e6d0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0224.415] WbemLocator:IUnknown:Release (This=0x5b369c) returned 0x3 [0224.415] CoGetContextToken (in: pToken=0x19e728 | out: pToken=0x19e728) returned 0x0 [0224.415] CoGetContextToken (in: pToken=0x19eb30 | out: pToken=0x19eb30) returned 0x0 [0224.415] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3740, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ebc0 | out: ppvObject=0x19ebc0*=0x5b3724) returned 0x0 [0224.416] WbemLocator:IRpcOptions:Query (in: This=0x5b3724, pPrx=0x5b3740, dwProperty=2, pdwValue=0x19ebe8 | out: pdwValue=0x19ebe8) returned 0x80004002 [0224.416] WbemLocator:IUnknown:Release (This=0x5b3724) returned 0x3 [0224.416] WbemLocator:IUnknown:Release (This=0x5b3740) returned 0x2 [0224.416] CoGetContextToken (in: pToken=0x19f100 | out: pToken=0x19f100) returned 0x0 [0224.416] CoGetContextToken (in: pToken=0x19f060 | out: pToken=0x19f060) returned 0x0 [0224.416] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3740, riid=0x19f130*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f12c | out: ppvObject=0x19f12c*=0x5b7208) returned 0x0 [0224.416] IUnknown:AddRef (This=0x5b7208) returned 0x4 [0224.416] IUnknown:Release (This=0x5b7208) returned 0x3 [0224.416] IUnknown:Release (This=0x5b7208) returned 0x2 [0224.416] IUnknown:Release (This=0x5b6970) returned 0x2 [0224.416] SysStringLen (param_1=0x0) returned 0x0 [0224.416] IEnumWbemClassObject:Reset (This=0x5b7208) returned 0x0 [0224.417] CoTaskMemAlloc (cb=0x4) returned 0x5c1e88 [0224.417] IEnumWbemClassObject:Next (in: This=0x5b7208, lTimeout=-1, uCount=0x1, apObjects=0x5c1e88, puReturned=0x21df7a4 | out: apObjects=0x5c1e88*=0x5ec408, puReturned=0x21df7a4*=0x1) returned 0x0 [0224.423] IUnknown:QueryInterface (in: This=0x5ec408, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e9b0 | out: ppvObject=0x19e9b0*=0x5ec408) returned 0x0 [0224.423] IUnknown:QueryInterface (in: This=0x5ec408, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e96c | out: ppvObject=0x19e96c*=0x0) returned 0x80004002 [0224.423] IUnknown:QueryInterface (in: This=0x5ec408, riid=0x6bdafb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e78c | out: ppvObject=0x19e78c*=0x0) returned 0x80004002 [0224.423] IUnknown:QueryInterface (in: This=0x5ec408, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e564 | out: ppvObject=0x19e564*=0x0) returned 0x80004002 [0224.424] IUnknown:AddRef (This=0x5ec408) returned 0x3 [0224.424] IUnknown:QueryInterface (in: This=0x5ec408, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2cc | out: ppvObject=0x19e2cc*=0x0) returned 0x80004002 [0224.424] IUnknown:QueryInterface (in: This=0x5ec408, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e27c | out: ppvObject=0x19e27c*=0x0) returned 0x80004002 [0224.424] IUnknown:QueryInterface (in: This=0x5ec408, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e288 | out: ppvObject=0x19e288*=0x5ec40c) returned 0x0 [0224.424] IMarshal:GetUnmarshalClass (in: This=0x5ec40c, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e290 | out: pCid=0x19e290*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0224.424] IUnknown:Release (This=0x5ec40c) returned 0x3 [0224.424] CoGetContextToken (in: pToken=0x19e2e8 | out: pToken=0x19e2e8) returned 0x0 [0224.424] CoGetContextToken (in: pToken=0x19e6f0 | out: pToken=0x19e6f0) returned 0x0 [0224.424] IUnknown:QueryInterface (in: This=0x5ec408, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e780 | out: ppvObject=0x19e780*=0x0) returned 0x80004002 [0224.424] IUnknown:Release (This=0x5ec408) returned 0x2 [0224.424] CoGetContextToken (in: pToken=0x19ecc0 | out: pToken=0x19ecc0) returned 0x0 [0224.424] CoGetContextToken (in: pToken=0x19ec20 | out: pToken=0x19ec20) returned 0x0 [0224.424] IUnknown:QueryInterface (in: This=0x5ec408, riid=0x19ecf0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ecec | out: ppvObject=0x19ecec*=0x5ec408) returned 0x0 [0224.424] IUnknown:AddRef (This=0x5ec408) returned 0x4 [0224.424] IUnknown:Release (This=0x5ec408) returned 0x3 [0224.424] IUnknown:Release (This=0x5ec408) returned 0x2 [0224.424] CoTaskMemFree (pv=0x5c1e88) [0224.424] CoGetContextToken (in: pToken=0x19f030 | out: pToken=0x19f030) returned 0x0 [0224.424] IUnknown:AddRef (This=0x5ec408) returned 0x3 [0224.424] CoTaskMemAlloc (cb=0x4) returned 0x5c1e88 [0224.425] IEnumWbemClassObject:Next (in: This=0x5b7208, lTimeout=-1, uCount=0x1, apObjects=0x5c1e88, puReturned=0x21df7a4 | out: apObjects=0x5c1e88*=0x0, puReturned=0x21df7a4*=0x0) returned 0x1 [0224.431] CoTaskMemFree (pv=0x5c1e88) [0224.431] CoGetContextToken (in: pToken=0x19f1a0 | out: pToken=0x19f1a0) returned 0x0 [0224.431] IUnknown:AddRef (This=0x5b6970) returned 0x3 [0224.431] IEnumWbemClassObject:Clone (in: This=0x5b6970, ppEnum=0x19f360 | out: ppEnum=0x19f360*=0x5b6bc8) returned 0x0 [0224.433] IUnknown:QueryInterface (in: This=0x5b6bc8, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f224 | out: ppvObject=0x19f224*=0x5b6bcc) returned 0x0 [0224.433] IClientSecurity:QueryBlanket (in: This=0x5b6bcc, pProxy=0x5b6bc8, pAuthnSvc=0x19f274, pAuthzSvc=0x19f270, pServerPrincName=0x19f268, pAuthnLevel=0x19f26c, pImpLevel=0x19f25c, pAuthInfo=0x19f260, pCapabilites=0x19f264 | out: pAuthnSvc=0x19f274*=0xa, pAuthzSvc=0x19f270*=0x0, pServerPrincName=0x19f268, pAuthnLevel=0x19f26c*=0x6, pImpLevel=0x19f25c*=0x2, pAuthInfo=0x19f260, pCapabilites=0x19f264*=0x1) returned 0x0 [0224.433] IUnknown:Release (This=0x5b6bcc) returned 0x1 [0224.433] IUnknown:QueryInterface (in: This=0x5b6bc8, riid=0x6c5910f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f218 | out: ppvObject=0x19f218*=0x5b3f40) returned 0x0 [0224.433] IUnknown:QueryInterface (in: This=0x5b6bc8, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f214 | out: ppvObject=0x19f214*=0x5b6bcc) returned 0x0 [0224.433] IClientSecurity:SetBlanket (This=0x5b6bcc, pProxy=0x5b6bc8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0224.436] IUnknown:Release (This=0x5b6bcc) returned 0x2 [0224.436] WbemLocator:IUnknown:Release (This=0x5b3f40) returned 0x1 [0224.436] CoTaskMemFree (pv=0x5a3468) [0224.436] IUnknown:QueryInterface (in: This=0x5b6bc8, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee00 | out: ppvObject=0x19ee00*=0x5b3f40) returned 0x0 [0224.436] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3f40, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19edbc | out: ppvObject=0x19edbc*=0x0) returned 0x80004002 [0224.437] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3f40, riid=0x6bdafb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ebdc | out: ppvObject=0x19ebdc*=0x0) returned 0x80004002 [0224.438] IUnknown:QueryInterface (in: This=0x5b6bc8, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e9b4 | out: ppvObject=0x19e9b4*=0x0) returned 0x80004002 [0224.439] WbemLocator:IUnknown:AddRef (This=0x5b3f40) returned 0x3 [0224.439] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3f40, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e71c | out: ppvObject=0x19e71c*=0x0) returned 0x80004002 [0224.439] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3f40, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e6cc | out: ppvObject=0x19e6cc*=0x0) returned 0x80004002 [0224.439] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3f40, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e6d8 | out: ppvObject=0x19e6d8*=0x5b3e9c) returned 0x0 [0224.439] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5b3e9c, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e6e0 | out: pCid=0x19e6e0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0224.439] WbemLocator:IUnknown:Release (This=0x5b3e9c) returned 0x3 [0224.439] CoGetContextToken (in: pToken=0x19e738 | out: pToken=0x19e738) returned 0x0 [0224.439] CoGetContextToken (in: pToken=0x19eb40 | out: pToken=0x19eb40) returned 0x0 [0224.439] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3f40, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ebd0 | out: ppvObject=0x19ebd0*=0x5b3f24) returned 0x0 [0224.439] WbemLocator:IRpcOptions:Query (in: This=0x5b3f24, pPrx=0x5b3f40, dwProperty=2, pdwValue=0x19ebf8 | out: pdwValue=0x19ebf8) returned 0x80004002 [0224.439] WbemLocator:IUnknown:Release (This=0x5b3f24) returned 0x3 [0224.439] WbemLocator:IUnknown:Release (This=0x5b3f40) returned 0x2 [0224.440] CoGetContextToken (in: pToken=0x19f110 | out: pToken=0x19f110) returned 0x0 [0224.440] CoGetContextToken (in: pToken=0x19f070 | out: pToken=0x19f070) returned 0x0 [0224.440] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3f40, riid=0x19f140*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f13c | out: ppvObject=0x19f13c*=0x5b6bc8) returned 0x0 [0224.440] IUnknown:AddRef (This=0x5b6bc8) returned 0x4 [0224.440] IUnknown:Release (This=0x5b6bc8) returned 0x3 [0224.440] IUnknown:Release (This=0x5b6bc8) returned 0x2 [0224.440] IUnknown:Release (This=0x5b6970) returned 0x2 [0224.440] SysStringLen (param_1=0x0) returned 0x0 [0224.440] IEnumWbemClassObject:Reset (This=0x5b6bc8) returned 0x0 [0224.441] CoTaskMemAlloc (cb=0x4) returned 0x5c1bc8 [0224.441] IEnumWbemClassObject:Next (in: This=0x5b6bc8, lTimeout=-1, uCount=0x1, apObjects=0x5c1bc8, puReturned=0x21df888 | out: apObjects=0x5c1bc8*=0x5f1088, puReturned=0x21df888*=0x1) returned 0x0 [0224.485] IUnknown:QueryInterface (in: This=0x5f1088, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e9c0 | out: ppvObject=0x19e9c0*=0x5f1088) returned 0x0 [0224.485] IUnknown:QueryInterface (in: This=0x5f1088, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e97c | out: ppvObject=0x19e97c*=0x0) returned 0x80004002 [0224.485] IUnknown:QueryInterface (in: This=0x5f1088, riid=0x6bdafb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e79c | out: ppvObject=0x19e79c*=0x0) returned 0x80004002 [0224.485] IUnknown:QueryInterface (in: This=0x5f1088, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e574 | out: ppvObject=0x19e574*=0x0) returned 0x80004002 [0224.485] IUnknown:AddRef (This=0x5f1088) returned 0x3 [0224.485] IUnknown:QueryInterface (in: This=0x5f1088, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2dc | out: ppvObject=0x19e2dc*=0x0) returned 0x80004002 [0224.485] IUnknown:QueryInterface (in: This=0x5f1088, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e28c | out: ppvObject=0x19e28c*=0x0) returned 0x80004002 [0224.485] IUnknown:QueryInterface (in: This=0x5f1088, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e298 | out: ppvObject=0x19e298*=0x5f108c) returned 0x0 [0224.485] IMarshal:GetUnmarshalClass (in: This=0x5f108c, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e2a0 | out: pCid=0x19e2a0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0224.485] IUnknown:Release (This=0x5f108c) returned 0x3 [0224.485] CoGetContextToken (in: pToken=0x19e2f8 | out: pToken=0x19e2f8) returned 0x0 [0224.485] CoGetContextToken (in: pToken=0x19e700 | out: pToken=0x19e700) returned 0x0 [0224.485] IUnknown:QueryInterface (in: This=0x5f1088, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e790 | out: ppvObject=0x19e790*=0x0) returned 0x80004002 [0224.486] IUnknown:Release (This=0x5f1088) returned 0x2 [0224.486] CoGetContextToken (in: pToken=0x19ecd0 | out: pToken=0x19ecd0) returned 0x0 [0224.486] CoGetContextToken (in: pToken=0x19ec30 | out: pToken=0x19ec30) returned 0x0 [0224.486] IUnknown:QueryInterface (in: This=0x5f1088, riid=0x19ed00*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ecfc | out: ppvObject=0x19ecfc*=0x5f1088) returned 0x0 [0224.486] IUnknown:AddRef (This=0x5f1088) returned 0x4 [0224.486] IUnknown:Release (This=0x5f1088) returned 0x3 [0224.486] IUnknown:Release (This=0x5f1088) returned 0x2 [0224.486] CoTaskMemFree (pv=0x5c1bc8) [0224.486] CoGetContextToken (in: pToken=0x19f040 | out: pToken=0x19f040) returned 0x0 [0224.486] IUnknown:AddRef (This=0x5f1088) returned 0x3 [0224.486] IWbemClassObject:Get (in: This=0x5f1088, wszName="__GENUS", lFlags=0, pVal=0x19f350*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f3d0*=0, plFlavor=0x19f3cc*=0 | out: pVal=0x19f350*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f3d0*=3, plFlavor=0x19f3cc*=64) returned 0x0 [0224.486] IWbemClassObject:Get (in: This=0x5f1088, wszName="__PATH", lFlags=0, pVal=0x19f334*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f3b8*=0, plFlavor=0x19f3b4*=0 | out: pVal=0x19f334*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"", varVal2=0x0), pType=0x19f3b8*=8, plFlavor=0x19f3b4*=64) returned 0x0 [0224.487] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0224.487] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0224.487] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x5d8 [0224.487] SetEvent (hEvent=0x468) returned 1 [0224.487] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f30c*=0x5d8, lpdwindex=0x19f12c | out: lpdwindex=0x19f12c) returned 0x0 [0224.493] CoGetContextToken (in: pToken=0x19f1d8 | out: pToken=0x19f1d8) returned 0x0 [0224.493] CoGetContextToken (in: pToken=0x19f138 | out: pToken=0x19f138) returned 0x0 [0224.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0490, riid=0x19f208*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x5e0490) returned 0x0 [0224.493] WbemDefPath:IUnknown:AddRef (This=0x5e0490) returned 0x3 [0224.493] WbemDefPath:IUnknown:Release (This=0x5e0490) returned 0x2 [0224.493] WbemDefPath:IWbemPath:SetText (This=0x5e0490, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x0 [0224.493] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5c3310, puCount=0x19f38c | out: puCount=0x19f38c*=0x2) returned 0x0 [0224.493] WbemDefPath:IWbemPath:GetText (in: This=0x5c3310, lFlags=4, puBuffLength=0x19f388*=0x0, pszText=0x0 | out: puBuffLength=0x19f388*=0xf, pszText=0x0) returned 0x0 [0224.493] WbemDefPath:IWbemPath:GetText (in: This=0x5c3310, lFlags=4, puBuffLength=0x19f388*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f388*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0224.494] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5c3310, puCount=0x19f380 | out: puCount=0x19f380*=0x2) returned 0x0 [0224.494] WbemDefPath:IWbemPath:GetText (in: This=0x5c3310, lFlags=4, puBuffLength=0x19f37c*=0x0, pszText=0x0 | out: puBuffLength=0x19f37c*=0xf, pszText=0x0) returned 0x0 [0224.494] WbemDefPath:IWbemPath:GetText (in: This=0x5c3310, lFlags=4, puBuffLength=0x19f37c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f37c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0224.494] IWbemClassObject:Get (in: This=0x5f1088, wszName="Name", lFlags=0, pVal=0x19f37c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21e00e4*=0, plFlavor=0x21e00e8*=0 | out: pVal=0x19f37c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1", varVal2=0x0), pType=0x21e00e4*=8, plFlavor=0x21e00e8*=0) returned 0x0 [0224.494] SysStringByteLen (bstr="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x80 [0224.494] SysStringByteLen (bstr="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x80 [0224.494] IWbemClassObject:Get (in: This=0x5f1088, wszName="Name", lFlags=0, pVal=0x19f384*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21e00e4*=8, plFlavor=0x21e00e8*=0 | out: pVal=0x19f384*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1", varVal2=0x0), pType=0x21e00e4*=8, plFlavor=0x21e00e8*=0) returned 0x0 [0224.494] SysStringByteLen (bstr="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x80 [0224.494] SysStringByteLen (bstr="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x80 [0224.532] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5c3310, puCount=0x19f398 | out: puCount=0x19f398*=0x2) returned 0x0 [0224.532] WbemDefPath:IWbemPath:GetText (in: This=0x5c3310, lFlags=4, puBuffLength=0x19f394*=0x0, pszText=0x0 | out: puBuffLength=0x19f394*=0xf, pszText=0x0) returned 0x0 [0224.532] WbemDefPath:IWbemPath:GetText (in: This=0x5c3310, lFlags=4, puBuffLength=0x19f394*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f394*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0224.545] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f244*=0x4f8, lpdwindex=0x19f0f4 | out: lpdwindex=0x19f0f4) returned 0x0 [0224.574] CoGetContextToken (in: pToken=0x19f000 | out: pToken=0x19f000) returned 0x0 [0224.574] CoGetContextToken (in: pToken=0x19efa8 | out: pToken=0x19efa8) returned 0x0 [0224.574] IUnknown:QueryInterface (in: This=0x564140, riid=0x6bd28724*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ef88 | out: ppvObject=0x19ef88*=0x564150) returned 0x0 [0224.575] CObjectContext::ContextCallback () returned 0x0 [0224.576] IUnknown:Release (This=0x564150) returned 0x1 [0224.577] CoUnmarshalInterface (in: pStm=0x5a41e8, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eff0 | out: ppv=0x19eff0*=0x5b4040) returned 0x0 [0224.577] CoMarshalInterface (pStm=0x5a41e8, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5b4040, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0224.578] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4040, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee94 | out: ppvObject=0x19ee94*=0x5b4040) returned 0x0 [0224.578] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4040, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ee50 | out: ppvObject=0x19ee50*=0x0) returned 0x80004002 [0224.579] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4040, riid=0x6bdafb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ec6c | out: ppvObject=0x19ec6c*=0x0) returned 0x80004002 [0224.579] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4040, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19ea44 | out: ppvObject=0x19ea44*=0x0) returned 0x80004002 [0224.580] WbemLocator:IUnknown:AddRef (This=0x5b4040) returned 0x3 [0224.580] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4040, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e7ac | out: ppvObject=0x19e7ac*=0x0) returned 0x80004002 [0224.580] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4040, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e75c | out: ppvObject=0x19e75c*=0x0) returned 0x80004002 [0224.580] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4040, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e768 | out: ppvObject=0x19e768*=0x5b3f9c) returned 0x0 [0224.580] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5b3f9c, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e770 | out: pCid=0x19e770*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0224.580] WbemLocator:IUnknown:Release (This=0x5b3f9c) returned 0x3 [0224.580] CoGetContextToken (in: pToken=0x19e7c8 | out: pToken=0x19e7c8) returned 0x0 [0224.580] CoGetContextToken (in: pToken=0x19ebd0 | out: pToken=0x19ebd0) returned 0x0 [0224.580] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4040, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec60 | out: ppvObject=0x19ec60*=0x5b4024) returned 0x0 [0224.580] WbemLocator:IRpcOptions:Query (in: This=0x5b4024, pPrx=0x5b4040, dwProperty=2, pdwValue=0x19ec88 | out: pdwValue=0x19ec88) returned 0x0 [0224.580] WbemLocator:IUnknown:Release (This=0x5b4024) returned 0x3 [0224.580] WbemLocator:IUnknown:Release (This=0x5b4040) returned 0x2 [0224.580] WbemLocator:IUnknown:Release (This=0x5b4040) returned 0x1 [0224.581] CoGetContextToken (in: pToken=0x19ef40 | out: pToken=0x19ef40) returned 0x0 [0224.581] WbemLocator:IUnknown:AddRef (This=0x5b4040) returned 0x2 [0224.581] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4040, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1fc | out: ppvObject=0x19f1fc*=0x5b401c) returned 0x0 [0224.581] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5b401c, pProxy=0x5b4040, pAuthnSvc=0x19f24c, pAuthzSvc=0x19f248, pServerPrincName=0x19f240, pAuthnLevel=0x19f244, pImpLevel=0x19f234, pAuthInfo=0x19f238, pCapabilites=0x19f23c | out: pAuthnSvc=0x19f24c*=0xa, pAuthzSvc=0x19f248*=0x0, pServerPrincName=0x19f240, pAuthnLevel=0x19f244*=0x6, pImpLevel=0x19f234*=0x2, pAuthInfo=0x19f238, pCapabilites=0x19f23c*=0x1) returned 0x0 [0224.581] WbemLocator:IUnknown:Release (This=0x5b401c) returned 0x2 [0224.581] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4040, riid=0x6c5910f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1f0 | out: ppvObject=0x19f1f0*=0x5b4040) returned 0x0 [0224.581] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4040, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1ec | out: ppvObject=0x19f1ec*=0x5b401c) returned 0x0 [0224.581] WbemLocator:IClientSecurity:SetBlanket (This=0x5b401c, pProxy=0x5b4040, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0224.581] WbemLocator:IUnknown:Release (This=0x5b401c) returned 0x3 [0224.581] WbemLocator:IUnknown:Release (This=0x5b4040) returned 0x2 [0224.581] CoTaskMemFree (pv=0x5a31c8) [0224.582] WbemLocator:IUnknown:Release (This=0x5b4040) returned 0x1 [0224.582] SysStringLen (param_1=0x0) returned 0x0 [0224.582] CoGetContextToken (in: pToken=0x19f1b8 | out: pToken=0x19f1b8) returned 0x0 [0224.582] CoGetContextToken (in: pToken=0x19f118 | out: pToken=0x19f118) returned 0x0 [0224.582] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4040, riid=0x19f1e8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19f1e4 | out: ppvObject=0x19f1e4*=0x5b28d0) returned 0x0 [0224.584] WbemLocator:IUnknown:AddRef (This=0x5b28d0) returned 0x3 [0224.584] WbemLocator:IUnknown:Release (This=0x5b28d0) returned 0x2 [0224.584] CoGetContextToken (in: pToken=0x19f178 | out: pToken=0x19f178) returned 0x0 [0224.584] WbemLocator:IUnknown:AddRef (This=0x5b28d0) returned 0x3 [0224.584] WbemLocator:IUnknown:QueryInterface (in: This=0x5b28d0, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1fc | out: ppvObject=0x19f1fc*=0x5b401c) returned 0x0 [0224.584] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5b401c, pProxy=0x5b28d0, pAuthnSvc=0x19f24c, pAuthzSvc=0x19f248, pServerPrincName=0x19f240, pAuthnLevel=0x19f244, pImpLevel=0x19f234, pAuthInfo=0x19f238, pCapabilites=0x19f23c | out: pAuthnSvc=0x19f24c*=0xa, pAuthzSvc=0x19f248*=0x0, pServerPrincName=0x19f240, pAuthnLevel=0x19f244*=0x6, pImpLevel=0x19f234*=0x2, pAuthInfo=0x19f238, pCapabilites=0x19f23c*=0x1) returned 0x0 [0224.584] WbemLocator:IUnknown:Release (This=0x5b401c) returned 0x3 [0224.584] WbemLocator:IUnknown:QueryInterface (in: This=0x5b28d0, riid=0x6c5910f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1f0 | out: ppvObject=0x19f1f0*=0x5b4040) returned 0x0 [0224.584] WbemLocator:IUnknown:QueryInterface (in: This=0x5b28d0, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1ec | out: ppvObject=0x19f1ec*=0x5b401c) returned 0x0 [0224.585] WbemLocator:IClientSecurity:SetBlanket (This=0x5b401c, pProxy=0x5b28d0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0224.585] WbemLocator:IUnknown:Release (This=0x5b401c) returned 0x4 [0224.585] WbemLocator:IUnknown:Release (This=0x5b4040) returned 0x3 [0224.585] CoTaskMemFree (pv=0x5a2f58) [0224.585] WbemLocator:IUnknown:Release (This=0x5b28d0) returned 0x2 [0224.585] SysStringLen (param_1=0x0) returned 0x0 [0224.585] CoGetContextToken (in: pToken=0x19f0f8 | out: pToken=0x19f0f8) returned 0x0 [0224.586] WbemLocator:IUnknown:AddRef (This=0x5b28d0) returned 0x3 [0224.586] IWbemServices:ExecQuery (in: This=0x5b28d0, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_Processor", lFlags=16, pCtx=0x0, ppEnum=0x19f308 | out: ppEnum=0x19f308*=0x5b7140) returned 0x0 [0224.648] IUnknown:QueryInterface (in: This=0x5b7140, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f16c | out: ppvObject=0x19f16c*=0x5b7144) returned 0x0 [0224.648] IClientSecurity:QueryBlanket (in: This=0x5b7144, pProxy=0x5b7140, pAuthnSvc=0x19f1bc, pAuthzSvc=0x19f1b8, pServerPrincName=0x19f1b0, pAuthnLevel=0x19f1b4, pImpLevel=0x19f1a4, pAuthInfo=0x19f1a8, pCapabilites=0x19f1ac | out: pAuthnSvc=0x19f1bc*=0xa, pAuthzSvc=0x19f1b8*=0x0, pServerPrincName=0x19f1b0, pAuthnLevel=0x19f1b4*=0x6, pImpLevel=0x19f1a4*=0x2, pAuthInfo=0x19f1a8, pCapabilites=0x19f1ac*=0x1) returned 0x0 [0224.648] IUnknown:Release (This=0x5b7144) returned 0x1 [0224.648] IUnknown:QueryInterface (in: This=0x5b7140, riid=0x6c5910f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f160 | out: ppvObject=0x19f160*=0x5b3940) returned 0x0 [0224.649] IUnknown:QueryInterface (in: This=0x5b7140, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f15c | out: ppvObject=0x19f15c*=0x5b7144) returned 0x0 [0224.649] IClientSecurity:SetBlanket (This=0x5b7144, pProxy=0x5b7140, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0224.651] IUnknown:Release (This=0x5b7144) returned 0x2 [0224.651] WbemLocator:IUnknown:Release (This=0x5b3940) returned 0x1 [0224.651] CoTaskMemFree (pv=0x5a3378) [0224.651] IUnknown:QueryInterface (in: This=0x5b7140, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed58 | out: ppvObject=0x19ed58*=0x5b3940) returned 0x0 [0224.651] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3940, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ed14 | out: ppvObject=0x19ed14*=0x0) returned 0x80004002 [0224.652] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3940, riid=0x6bdafb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19eb34 | out: ppvObject=0x19eb34*=0x0) returned 0x80004002 [0224.652] IUnknown:QueryInterface (in: This=0x5b7140, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e90c | out: ppvObject=0x19e90c*=0x0) returned 0x80004002 [0224.653] WbemLocator:IUnknown:AddRef (This=0x5b3940) returned 0x3 [0224.653] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3940, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e674 | out: ppvObject=0x19e674*=0x0) returned 0x80004002 [0224.653] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3940, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e624 | out: ppvObject=0x19e624*=0x0) returned 0x80004002 [0224.653] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3940, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e630 | out: ppvObject=0x19e630*=0x5b389c) returned 0x0 [0224.653] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5b389c, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e638 | out: pCid=0x19e638*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0224.653] WbemLocator:IUnknown:Release (This=0x5b389c) returned 0x3 [0224.653] CoGetContextToken (in: pToken=0x19e690 | out: pToken=0x19e690) returned 0x0 [0224.653] CoGetContextToken (in: pToken=0x19ea98 | out: pToken=0x19ea98) returned 0x0 [0224.653] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3940, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eb28 | out: ppvObject=0x19eb28*=0x5b3924) returned 0x0 [0224.653] WbemLocator:IRpcOptions:Query (in: This=0x5b3924, pPrx=0x5b3940, dwProperty=2, pdwValue=0x19eb50 | out: pdwValue=0x19eb50) returned 0x80004002 [0224.653] WbemLocator:IUnknown:Release (This=0x5b3924) returned 0x3 [0224.653] WbemLocator:IUnknown:Release (This=0x5b3940) returned 0x2 [0224.653] CoGetContextToken (in: pToken=0x19f068 | out: pToken=0x19f068) returned 0x0 [0224.653] CoGetContextToken (in: pToken=0x19efc8 | out: pToken=0x19efc8) returned 0x0 [0224.653] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3940, riid=0x19f098*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f094 | out: ppvObject=0x19f094*=0x5b7140) returned 0x0 [0224.654] IUnknown:AddRef (This=0x5b7140) returned 0x4 [0224.654] IUnknown:Release (This=0x5b7140) returned 0x3 [0224.654] IUnknown:Release (This=0x5b7140) returned 0x2 [0224.654] WbemLocator:IUnknown:Release (This=0x5b28d0) returned 0x2 [0224.654] SysStringLen (param_1=0x0) returned 0x0 [0224.654] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5c3310, puCount=0x19f354 | out: puCount=0x19f354*=0x2) returned 0x0 [0224.654] WbemDefPath:IWbemPath:GetText (in: This=0x5c3310, lFlags=4, puBuffLength=0x19f350*=0x0, pszText=0x0 | out: puBuffLength=0x19f350*=0xf, pszText=0x0) returned 0x0 [0224.654] WbemDefPath:IWbemPath:GetText (in: This=0x5c3310, lFlags=4, puBuffLength=0x19f350*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f350*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0224.654] CoGetContextToken (in: pToken=0x19f1a0 | out: pToken=0x19f1a0) returned 0x0 [0224.654] IUnknown:AddRef (This=0x5b7140) returned 0x3 [0224.654] IEnumWbemClassObject:Clone (in: This=0x5b7140, ppEnum=0x19f360 | out: ppEnum=0x19f360*=0x5b6a38) returned 0x0 [0224.655] IUnknown:QueryInterface (in: This=0x5b6a38, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f224 | out: ppvObject=0x19f224*=0x5b6a3c) returned 0x0 [0224.656] IClientSecurity:QueryBlanket (in: This=0x5b6a3c, pProxy=0x5b6a38, pAuthnSvc=0x19f274, pAuthzSvc=0x19f270, pServerPrincName=0x19f268, pAuthnLevel=0x19f26c, pImpLevel=0x19f25c, pAuthInfo=0x19f260, pCapabilites=0x19f264 | out: pAuthnSvc=0x19f274*=0xa, pAuthzSvc=0x19f270*=0x0, pServerPrincName=0x19f268, pAuthnLevel=0x19f26c*=0x6, pImpLevel=0x19f25c*=0x2, pAuthInfo=0x19f260, pCapabilites=0x19f264*=0x1) returned 0x0 [0224.656] IUnknown:Release (This=0x5b6a3c) returned 0x1 [0224.656] IUnknown:QueryInterface (in: This=0x5b6a38, riid=0x6c5910f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f218 | out: ppvObject=0x19f218*=0x5b4640) returned 0x0 [0224.656] IUnknown:QueryInterface (in: This=0x5b6a38, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f214 | out: ppvObject=0x19f214*=0x5b6a3c) returned 0x0 [0224.656] IClientSecurity:SetBlanket (This=0x5b6a3c, pProxy=0x5b6a38, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0224.658] IUnknown:Release (This=0x5b6a3c) returned 0x2 [0224.658] WbemLocator:IUnknown:Release (This=0x5b4640) returned 0x1 [0224.658] CoTaskMemFree (pv=0x5a3078) [0224.658] IUnknown:QueryInterface (in: This=0x5b6a38, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee00 | out: ppvObject=0x19ee00*=0x5b4640) returned 0x0 [0224.659] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4640, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19edbc | out: ppvObject=0x19edbc*=0x0) returned 0x80004002 [0224.659] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4640, riid=0x6bdafb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ebdc | out: ppvObject=0x19ebdc*=0x0) returned 0x80004002 [0224.660] IUnknown:QueryInterface (in: This=0x5b6a38, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e9b4 | out: ppvObject=0x19e9b4*=0x0) returned 0x80004002 [0224.660] WbemLocator:IUnknown:AddRef (This=0x5b4640) returned 0x3 [0224.660] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4640, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e71c | out: ppvObject=0x19e71c*=0x0) returned 0x80004002 [0224.660] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4640, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e6cc | out: ppvObject=0x19e6cc*=0x0) returned 0x80004002 [0224.660] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4640, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e6d8 | out: ppvObject=0x19e6d8*=0x5b459c) returned 0x0 [0224.660] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5b459c, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e6e0 | out: pCid=0x19e6e0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0224.660] WbemLocator:IUnknown:Release (This=0x5b459c) returned 0x3 [0224.660] CoGetContextToken (in: pToken=0x19e738 | out: pToken=0x19e738) returned 0x0 [0224.661] CoGetContextToken (in: pToken=0x19eb40 | out: pToken=0x19eb40) returned 0x0 [0224.661] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4640, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ebd0 | out: ppvObject=0x19ebd0*=0x5b4624) returned 0x0 [0224.661] WbemLocator:IRpcOptions:Query (in: This=0x5b4624, pPrx=0x5b4640, dwProperty=2, pdwValue=0x19ebf8 | out: pdwValue=0x19ebf8) returned 0x80004002 [0224.661] WbemLocator:IUnknown:Release (This=0x5b4624) returned 0x3 [0224.661] WbemLocator:IUnknown:Release (This=0x5b4640) returned 0x2 [0224.661] CoGetContextToken (in: pToken=0x19f110 | out: pToken=0x19f110) returned 0x0 [0224.661] CoGetContextToken (in: pToken=0x19f070 | out: pToken=0x19f070) returned 0x0 [0224.661] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4640, riid=0x19f140*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f13c | out: ppvObject=0x19f13c*=0x5b6a38) returned 0x0 [0224.661] IUnknown:AddRef (This=0x5b6a38) returned 0x4 [0224.661] IUnknown:Release (This=0x5b6a38) returned 0x3 [0224.661] IUnknown:Release (This=0x5b6a38) returned 0x2 [0224.661] IUnknown:Release (This=0x5b7140) returned 0x2 [0224.661] SysStringLen (param_1=0x0) returned 0x0 [0224.661] IEnumWbemClassObject:Reset (This=0x5b6a38) returned 0x0 [0224.662] CoTaskMemAlloc (cb=0x4) returned 0x58eb60 [0224.662] IEnumWbemClassObject:Next (in: This=0x5b6a38, lTimeout=-1, uCount=0x1, apObjects=0x58eb60, puReturned=0x21e0dfc | out: apObjects=0x58eb60*=0x5edb18, puReturned=0x21e0dfc*=0x1) returned 0x0 [0225.831] IUnknown:QueryInterface (in: This=0x5edb18, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e9c0 | out: ppvObject=0x19e9c0*=0x5edb18) returned 0x0 [0225.831] IUnknown:QueryInterface (in: This=0x5edb18, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e97c | out: ppvObject=0x19e97c*=0x0) returned 0x80004002 [0225.831] IUnknown:QueryInterface (in: This=0x5edb18, riid=0x6bdafb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e79c | out: ppvObject=0x19e79c*=0x0) returned 0x80004002 [0225.832] IUnknown:QueryInterface (in: This=0x5edb18, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e574 | out: ppvObject=0x19e574*=0x0) returned 0x80004002 [0225.832] IUnknown:AddRef (This=0x5edb18) returned 0x3 [0225.832] IUnknown:QueryInterface (in: This=0x5edb18, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2dc | out: ppvObject=0x19e2dc*=0x0) returned 0x80004002 [0225.832] IUnknown:QueryInterface (in: This=0x5edb18, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e28c | out: ppvObject=0x19e28c*=0x0) returned 0x80004002 [0225.832] IUnknown:QueryInterface (in: This=0x5edb18, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e298 | out: ppvObject=0x19e298*=0x5edb1c) returned 0x0 [0225.832] IMarshal:GetUnmarshalClass (in: This=0x5edb1c, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e2a0 | out: pCid=0x19e2a0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0225.832] IUnknown:Release (This=0x5edb1c) returned 0x3 [0225.832] CoGetContextToken (in: pToken=0x19e2f8 | out: pToken=0x19e2f8) returned 0x0 [0225.832] CoGetContextToken (in: pToken=0x19e700 | out: pToken=0x19e700) returned 0x0 [0225.832] IUnknown:QueryInterface (in: This=0x5edb18, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e790 | out: ppvObject=0x19e790*=0x0) returned 0x80004002 [0225.832] IUnknown:Release (This=0x5edb18) returned 0x2 [0225.832] CoGetContextToken (in: pToken=0x19ecd0 | out: pToken=0x19ecd0) returned 0x0 [0225.832] CoGetContextToken (in: pToken=0x19ec30 | out: pToken=0x19ec30) returned 0x0 [0225.832] IUnknown:QueryInterface (in: This=0x5edb18, riid=0x19ed00*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ecfc | out: ppvObject=0x19ecfc*=0x5edb18) returned 0x0 [0225.832] IUnknown:AddRef (This=0x5edb18) returned 0x4 [0225.832] IUnknown:Release (This=0x5edb18) returned 0x3 [0225.832] IUnknown:Release (This=0x5edb18) returned 0x2 [0225.833] CoTaskMemFree (pv=0x58eb60) [0225.833] CoGetContextToken (in: pToken=0x19f040 | out: pToken=0x19f040) returned 0x0 [0225.833] IUnknown:AddRef (This=0x5edb18) returned 0x3 [0225.833] IWbemClassObject:Get (in: This=0x5edb18, wszName="__GENUS", lFlags=0, pVal=0x19f350*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f3d0*=0, plFlavor=0x19f3cc*=0 | out: pVal=0x19f350*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f3d0*=3, plFlavor=0x19f3cc*=64) returned 0x0 [0225.833] IWbemClassObject:Get (in: This=0x5edb18, wszName="__PATH", lFlags=0, pVal=0x19f334*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f3b8*=0, plFlavor=0x19f3b4*=0 | out: pVal=0x19f334*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"", varVal2=0x0), pType=0x19f3b8*=8, plFlavor=0x19f3b4*=64) returned 0x0 [0225.833] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x66 [0225.833] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x66 [0225.833] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4f4 [0225.833] SetEvent (hEvent=0x468) returned 1 [0225.834] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f30c*=0x4f4, lpdwindex=0x19f12c | out: lpdwindex=0x19f12c) returned 0x0 [0225.837] CoGetContextToken (in: pToken=0x19f1d8 | out: pToken=0x19f1d8) returned 0x0 [0225.837] CoGetContextToken (in: pToken=0x19f138 | out: pToken=0x19f138) returned 0x0 [0225.837] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e06c0, riid=0x19f208*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x5e06c0) returned 0x0 [0225.837] WbemDefPath:IUnknown:AddRef (This=0x5e06c0) returned 0x3 [0225.837] WbemDefPath:IUnknown:Release (This=0x5e06c0) returned 0x2 [0225.837] WbemDefPath:IWbemPath:SetText (This=0x5e06c0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x0 [0225.837] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5c3310, puCount=0x19f38c | out: puCount=0x19f38c*=0x2) returned 0x0 [0225.837] WbemDefPath:IWbemPath:GetText (in: This=0x5c3310, lFlags=4, puBuffLength=0x19f388*=0x0, pszText=0x0 | out: puBuffLength=0x19f388*=0xf, pszText=0x0) returned 0x0 [0225.837] WbemDefPath:IWbemPath:GetText (in: This=0x5c3310, lFlags=4, puBuffLength=0x19f388*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f388*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.841] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5c3310, puCount=0x19f35c | out: puCount=0x19f35c*=0x2) returned 0x0 [0225.841] WbemDefPath:IWbemPath:GetText (in: This=0x5c3310, lFlags=4, puBuffLength=0x19f358*=0x0, pszText=0x0 | out: puBuffLength=0x19f358*=0xf, pszText=0x0) returned 0x0 [0225.841] WbemDefPath:IWbemPath:GetText (in: This=0x5c3310, lFlags=4, puBuffLength=0x19f358*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f358*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.841] IWbemClassObject:Get (in: This=0x5edb18, wszName="Name", lFlags=0, pVal=0x19f358*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21e1664*=0, plFlavor=0x21e1668*=0 | out: pVal=0x19f358*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", varVal2=0x0), pType=0x21e1664*=8, plFlavor=0x21e1668*=0) returned 0x0 [0225.841] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0225.841] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0225.841] IWbemClassObject:Get (in: This=0x5edb18, wszName="Name", lFlags=0, pVal=0x19f360*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x21e1664*=8, plFlavor=0x21e1668*=0 | out: pVal=0x19f360*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", varVal2=0x0), pType=0x21e1664*=8, plFlavor=0x21e1668*=0) returned 0x0 [0225.842] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0225.842] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0225.842] CoTaskMemAlloc (cb=0x4) returned 0x58eb60 [0225.842] IEnumWbemClassObject:Next (in: This=0x5b6a38, lTimeout=-1, uCount=0x1, apObjects=0x58eb60, puReturned=0x21e0dfc | out: apObjects=0x58eb60*=0x0, puReturned=0x21e0dfc*=0x0) returned 0x1 [0225.845] CoTaskMemFree (pv=0x58eb60) [0225.845] CoGetContextToken (in: pToken=0x19f288 | out: pToken=0x19f288) returned 0x0 [0225.845] WbemLocator:IUnknown:Release (This=0x5b4640) returned 0x1 [0225.845] IUnknown:Release (This=0x5b6a38) returned 0x0 [0225.853] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5c3310, puCount=0x19f398 | out: puCount=0x19f398*=0x2) returned 0x0 [0225.853] WbemDefPath:IWbemPath:GetText (in: This=0x5c3310, lFlags=4, puBuffLength=0x19f394*=0x0, pszText=0x0 | out: puBuffLength=0x19f394*=0xf, pszText=0x0) returned 0x0 [0225.853] WbemDefPath:IWbemPath:GetText (in: This=0x5c3310, lFlags=4, puBuffLength=0x19f394*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f394*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.887] GlobalMemoryStatusEx (in: lpBuffer=0x21e18a0 | out: lpBuffer=0x21e18a0) returned 1 [0226.094] GetCurrentProcess () returned 0xffffffff [0226.094] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ef64 | out: TokenHandle=0x19ef64*=0x4f0) returned 1 [0226.099] GetCurrentProcess () returned 0xffffffff [0226.099] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ef78 | out: TokenHandle=0x19ef78*=0x500) returned 1 [0226.329] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x19f2dc | out: pFixedInfo=0x0, pOutBufLen=0x19f2dc) returned 0x6f [0227.361] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x5f2e70 [0227.362] GetNetworkParams (in: pFixedInfo=0x5f2e70, pOutBufLen=0x19f2dc | out: pFixedInfo=0x5f2e70, pOutBufLen=0x19f2dc) returned 0x0 [0227.380] LocalFree (hMem=0x5f2e70) returned 0x0 [0227.397] IdnToAscii (in: dwFlags=0x0, lpUnicodeCharStr="xc64ZB", cchUnicodeChar=6, lpASCIICharStr=0x0, cchASCIIChar=0 | out: lpASCIICharStr=0x0) returned 6 [0227.397] IdnToAscii (in: dwFlags=0x0, lpUnicodeCharStr="xc64ZB", cchUnicodeChar=6, lpASCIICharStr=0x21e3a8c, cchASCIIChar=6 | out: lpASCIICharStr="xc64ZB") returned 6 [0227.410] SystemFunction041 (in: Memory=0x5a3f4c, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x5a3f4c) returned 0x0 [0227.413] SysStringLen (param_1=" kOOdr$f8tSet") returned 0x10 [0227.413] SystemFunction040 (in: Memory=0x5a3e34, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x5a3e34) returned 0x0 [0227.481] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x19f2bc | out: UnbiasedTime=0x19f2bc) returned 1 [0227.481] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x19f2ac | out: UnbiasedTime=0x19f2ac) returned 1 [0227.485] GetCurrentProcess () returned 0xffffffff [0227.486] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eeb0 | out: TokenHandle=0x19eeb0*=0x518) returned 1 [0227.487] GetCurrentProcess () returned 0xffffffff [0227.487] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eec4 | out: TokenHandle=0x19eec4*=0x494) returned 1 [0227.489] SetEvent (hEvent=0x364) returned 1 [0227.512] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19f014 | out: lpWSAData=0x19f014) returned 0 [0227.522] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x600 [0227.906] setsockopt (s=0x600, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0227.906] closesocket (s=0x600) returned 0 [0227.907] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x600 [0227.908] setsockopt (s=0x600, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0227.908] closesocket (s=0x600) returned 0 [0227.911] GetCurrentProcess () returned 0xffffffff [0227.911] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19edc8 | out: TokenHandle=0x19edc8*=0x600) returned 1 [0227.915] GetCurrentProcess () returned 0xffffffff [0227.915] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eddc | out: TokenHandle=0x19eddc*=0x604) returned 1 [0227.928] CreateSemaphoreA (lpSemaphoreAttributes=0x0, lInitialCount=0, lMaximumCount=1048576, lpName=0x0) returned 0x608 [0227.929] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x60c [0227.930] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x610 [0227.931] SetEvent (hEvent=0x364) returned 1 [0227.931] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x186a0, cHandles=0x3, pHandles=0x19f140*=0x608, lpdwindex=0x19effc | out: lpdwindex=0x19effc) returned 0x0 [0227.932] ReleaseMutex (hMutex=0x610) returned 1 [0227.933] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x614 [0227.934] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x618 [0227.936] GetAddrInfoW (in: pNodeName="us2.smtp.mailhostbox.com", pServiceName=0x0, pHints=0x19f108*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x19f0b0 | out: ppResult=0x19f0b0*=0x608400*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="us2.smtp.mailhostbox.com", ai_addr=0x607580*(sa_family=2, sin_port=0x0, sin_addr="162.222.225.16"), ai_next=0x6086f8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x607568*(sa_family=2, sin_port=0x0, sin_addr="208.91.198.38"), ai_next=0x608658*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x607370*(sa_family=2, sin_port=0x0, sin_addr="162.222.225.29"), ai_next=0x608310*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x607430*(sa_family=2, sin_port=0x0, sin_addr="208.91.198.46"), ai_next=0x0))))) returned 0 [0228.504] FreeAddrInfoW (pAddrInfo=0x608400*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="us2.smtp.mailhostbox.com", ai_addr=0x607580*(sa_family=2, sin_port=0x0, sin_addr="162.222.225.16"), ai_next=0x6086f8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x607568*(sa_family=2, sin_port=0x0, sin_addr="208.91.198.38"), ai_next=0x608658*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x607370*(sa_family=2, sin_port=0x0, sin_addr="162.222.225.29"), ai_next=0x608310*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x607430*(sa_family=2, sin_port=0x0, sin_addr="208.91.198.46"), ai_next=0x0))))) [0228.714] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x61c [0228.714] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x628 [0228.715] ioctlsocket (in: s=0x61c, cmd=-2147195266, argp=0x19f0e0 | out: argp=0x19f0e0) returned 0 [0228.715] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x62c [0228.716] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x630 [0228.716] ioctlsocket (in: s=0x62c, cmd=-2147195266, argp=0x19f0e0 | out: argp=0x19f0e0) returned 0 [0228.717] WSAIoctl (in: s=0x61c, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19f0c8, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19f0c8, lpOverlapped=0x0) returned -1 [0228.718] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19edf8, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0228.720] WSAEventSelect (s=0x61c, hEventObject=0x628, lNetworkEvents=512) returned 0 [0228.720] WSAIoctl (in: s=0x62c, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19f0c8, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19f0c8, lpOverlapped=0x0) returned -1 [0228.720] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19edf8, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0228.720] WSAEventSelect (s=0x62c, hEventObject=0x630, lNetworkEvents=512) returned 0 [0228.720] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x19f0c4*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x19f0c4*=0xa80) returned 0x6f [0228.730] LocalAlloc (uFlags=0x0, uBytes=0xa80) returned 0x57bb78 [0228.730] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x57bb78, SizePointer=0x19f0c4*=0xa80 | out: AdapterAddresses=0x57bb78*(Alignment=0x700000178, Length=0x178, IfIndex=0x7, Next=0x57be28, AdapterName="{E96D977E-F067-4CE9-924D-F6E0A04729E4}", FirstUnicastAddress=0x57bd9c, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #2", FriendlyName="Ethernet 2", PhysicalAddress=([0]=0x38, [1]=0x6e, [2]=0x21, [3]=0x4a, [4]=0x9f, [5]=0x7d, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x1c5, DdnsEnabled=0x1c5, RegisterAdapterSuffix=0x1c5, Dhcpv4Enabled=0x1c5, ReceiveOnly=0x1c5, NoMulticast=0x1c5, Ipv6OtherStatefulConfig=0x1c5, NetbiosOverTcpipEnabled=0x1c5, Ipv4Enabled=0x1c5, Ipv6Enabled=0x1c5, Ipv6ManagedAddressConfigurationSupported=0x1c5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x7, ZoneIndices=([0]=0x7, [1]=0x7, [2]=0x7, [3]=0x7, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6008002000000, Dhcpv4Server.lpSockaddr=0x57bcf0*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11eb6c9dc20d55b0, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x28, [5]=0xb6, [6]=0x28, [7]=0x5e, [8]=0x0, [9]=0xf, [10]=0xf3, [11]=0xe1, [12]=0x61, [13]=0x38, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x6000ff3, FirstDnsSuffix=0x0), SizePointer=0x19f0c4*=0xa80) returned 0x0 [0228.746] LocalFree (hMem=0x57bb78) returned 0x0 [0228.748] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f0d4 | out: phkResult=0x19f0d4*=0x634) returned 0x0 [0228.748] RegQueryValueExW (in: hKey=0x634, lpValueName="HWRPortReuseOnSocketBind", lpReserved=0x0, lpType=0x19f0f0, lpData=0x0, lpcbData=0x19f0ec*=0x0 | out: lpType=0x19f0f0*=0x0, lpData=0x0, lpcbData=0x19f0ec*=0x0) returned 0x2 [0228.748] RegCloseKey (hKey=0x634) returned 0x0 [0228.749] WSAConnect (in: s=0x614, name=0x21ec0cc*(sa_family=2, sin_port=0x24b, sin_addr="162.222.225.16"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0228.971] closesocket (s=0x618) returned 0 [0228.971] setsockopt (s=0x614, level=6, optname=1, optval="\x01", optlen=4) returned 0 [0228.996] recv (in: s=0x614, buf=0x21ec1c0, len=256, flags=0 | out: buf=0x21ec1c0*) returned 48 [0229.864] send (s=0x614, buf=0x21e5604*, len=13, flags=0) returned 13 [0229.864] recv (in: s=0x614, buf=0x21ec1c0, len=256, flags=0 | out: buf=0x21ec1c0*) returned 209 [0230.090] send (s=0x614, buf=0x21e5604*, len=10, flags=0) returned 10 [0230.091] recv (in: s=0x614, buf=0x21ec1c0, len=256, flags=0 | out: buf=0x21ec1c0*) returned 30 [0230.446] EnumerateSecurityPackagesW (in: pcPackages=0x19f150, ppPackageInfo=0x19f0e4 | out: pcPackages=0x19f150, ppPackageInfo=0x19f0e4) returned 0x0 [0230.464] FreeContextBuffer (in: pvContextBuffer=0x576c00 | out: pvContextBuffer=0x576c00) returned 0x0 [0230.478] GetCurrentProcess () returned 0xffffffff [0230.478] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ef30 | out: TokenHandle=0x19ef30*=0x634) returned 1 [0230.480] AcquireCredentialsHandleW (in: pPrincipal=0x0, pPackage=0x21ed904, fCredentialUse=0x2, pvLogonId=0x0, pAuthData=0x19ef84, pGetKeyFn=0x0, pvGetKeyArgument=0x0, phCredential=0x21eedfc, ptsExpiry=0x19ef08 | out: phCredential=0x21eedfc, ptsExpiry=0x19ef08) returned 0x0 [0230.944] InitializeSecurityContextW (in: phCredential=0x19ef48, phContext=0x0, pTargetName=0x21e3bdc, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x0, Reserved2=0x0, phNewContext=0x21ef000, pOutput=0x21eef98, pfContextAttr=0x21ed8d8, ptsExpiry=0x19ef40 | out: phNewContext=0x21ef000, pOutput=0x21eef98, pfContextAttr=0x21ed8d8, ptsExpiry=0x19ef40) returned 0x90312 [0230.946] FreeContextBuffer (in: pvContextBuffer=0x5eca38 | out: pvContextBuffer=0x5eca38) returned 0x0 [0230.959] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74580000 [0230.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="GetCurrentPackageId", cchWideChar=19, lpMultiByteStr=0x19ef90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentPackageIdÄ`Ï j'öÜÄ «Ækhö\x19", lpUsedDefaultChar=0x0) returned 19 [0230.960] GetProcAddress (hModule=0x74580000, lpProcName="GetCurrentPackageId") returned 0x774dded0 [0230.960] GetCurrentPackageId () returned 0x3d54 [0230.962] send (s=0x614, buf=0x21ef014*, len=192, flags=0) returned 192 [0230.965] recv (in: s=0x614, buf=0x21ef014, len=5, flags=0 | out: buf=0x21ef014*) returned 5 [0231.181] recv (in: s=0x614, buf=0x21ef019, len=65, flags=0 | out: buf=0x21ef019*) returned 65 [0231.182] InitializeSecurityContextW (in: phCredential=0x19eeac, phContext=0x19ef38, pTargetName=0x21e3bdc, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x21ef3c4, Reserved2=0x0, phNewContext=0x21ef000, pOutput=0x21ef3d8, pfContextAttr=0x21ed8d8, ptsExpiry=0x19eea4 | out: phNewContext=0x21ef000, pOutput=0x21ef3d8, pfContextAttr=0x21ed8d8, ptsExpiry=0x19eea4) returned 0x90312 [0231.185] recv (in: s=0x614, buf=0x21ef468, len=5, flags=0 | out: buf=0x21ef468*) returned 5 [0231.187] recv (in: s=0x614, buf=0x21ef481, len=5696, flags=0 | out: buf=0x21ef481*) returned 5481 [0231.187] recv (in: s=0x614, buf=0x21f09ea, len=215, flags=0 | out: buf=0x21f09ea*) returned 215 [0231.393] InitializeSecurityContextW (in: phCredential=0x19ee14, phContext=0x19eea0, pTargetName=0x21e3bdc, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x21f0b34, Reserved2=0x0, phNewContext=0x21ef000, pOutput=0x21f0b48, pfContextAttr=0x21ed8d8, ptsExpiry=0x19ee0c | out: phNewContext=0x21ef000, pOutput=0x21f0b48, pfContextAttr=0x21ed8d8, ptsExpiry=0x19ee0c) returned 0x90312 [0231.397] recv (in: s=0x614, buf=0x21f0bd8, len=5, flags=0 | out: buf=0x21f0bd8*) returned 5 [0231.398] recv (in: s=0x614, buf=0x21f0bf1, len=333, flags=0 | out: buf=0x21f0bf1*) returned 333 [0231.398] InitializeSecurityContextW (in: phCredential=0x19ed7c, phContext=0x19ee08, pTargetName=0x21e3bdc, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x21f0db0, Reserved2=0x0, phNewContext=0x21ef000, pOutput=0x21f0dc4, pfContextAttr=0x21ed8d8, ptsExpiry=0x19ed74 | out: phNewContext=0x21ef000, pOutput=0x21f0dc4, pfContextAttr=0x21ed8d8, ptsExpiry=0x19ed74) returned 0x90312 [0231.399] recv (in: s=0x614, buf=0x21f0e54, len=5, flags=0 | out: buf=0x21f0e54*) returned 5 [0231.399] recv (in: s=0x614, buf=0x21f0e6d, len=4, flags=0 | out: buf=0x21f0e6d*) returned 4 [0231.399] InitializeSecurityContextW (in: phCredential=0x19ece4, phContext=0x19ed70, pTargetName=0x21e3bdc, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x21f0ee4, Reserved2=0x0, phNewContext=0x21ef000, pOutput=0x21f0ef8, pfContextAttr=0x21ed8d8, ptsExpiry=0x19ecdc | out: phNewContext=0x21ef000, pOutput=0x21f0ef8, pfContextAttr=0x21ed8d8, ptsExpiry=0x19ecdc) returned 0x90312 [0231.452] FreeContextBuffer (in: pvContextBuffer=0x58ba10 | out: pvContextBuffer=0x58ba10) returned 0x0 [0231.452] send (s=0x614, buf=0x21f0f74*, len=126, flags=0) returned 126 [0231.452] recv (in: s=0x614, buf=0x21f0f74, len=5, flags=0 | out: buf=0x21f0f74*) returned 5 [0231.667] recv (in: s=0x614, buf=0x21f1019, len=186, flags=0 | out: buf=0x21f1019*) returned 186 [0231.668] InitializeSecurityContextW (in: phCredential=0x19ec4c, phContext=0x19ecd8, pTargetName=0x21e3bdc, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x21f1144, Reserved2=0x0, phNewContext=0x21ef000, pOutput=0x21f1158, pfContextAttr=0x21ed8d8, ptsExpiry=0x19ec44 | out: phNewContext=0x21ef000, pOutput=0x21f1158, pfContextAttr=0x21ed8d8, ptsExpiry=0x19ec44) returned 0x90312 [0231.668] recv (in: s=0x614, buf=0x21f11e8, len=5, flags=0 | out: buf=0x21f11e8*) returned 5 [0231.668] recv (in: s=0x614, buf=0x21f1201, len=1, flags=0 | out: buf=0x21f1201*) returned 1 [0231.669] InitializeSecurityContextW (in: phCredential=0x19ebb4, phContext=0x19ec40, pTargetName=0x21e3bdc, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x21f1274, Reserved2=0x0, phNewContext=0x21ef000, pOutput=0x21f1288, pfContextAttr=0x21ed8d8, ptsExpiry=0x19ebac | out: phNewContext=0x21ef000, pOutput=0x21f1288, pfContextAttr=0x21ed8d8, ptsExpiry=0x19ebac) returned 0x90312 [0231.669] recv (in: s=0x614, buf=0x21f1318, len=5, flags=0 | out: buf=0x21f1318*) returned 5 [0231.669] recv (in: s=0x614, buf=0x21f1331, len=40, flags=0 | out: buf=0x21f1331*) returned 40 [0231.669] InitializeSecurityContextW (in: phCredential=0x19eb1c, phContext=0x19eba8, pTargetName=0x21e3bdc, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x21f13cc, Reserved2=0x0, phNewContext=0x21ef000, pOutput=0x21f13e0, pfContextAttr=0x21ed8d8, ptsExpiry=0x19eb14 | out: phNewContext=0x21ef000, pOutput=0x21f13e0, pfContextAttr=0x21ed8d8, ptsExpiry=0x19eb14) returned 0x0 [0232.426] QueryContextAttributesW (in: phContext=0x21ef000, ulAttribute=0x4, pBuffer=0x21f148c | out: pBuffer=0x21f148c) returned 0x0 [0232.426] QueryContextAttributesW (in: phContext=0x21ef000, ulAttribute=0x5a, pBuffer=0x21f14e4 | out: pBuffer=0x21f14e4) returned 0x0 [0232.428] QueryContextAttributesW (in: phContext=0x21ef000, ulAttribute=0x53, pBuffer=0x21f1798 | out: pBuffer=0x21f1798) returned 0x0 [0232.445] CertDuplicateCertificateContext (pCertContext=0x57ace8) returned 0x57ace8 [0232.445] CertDuplicateStore (hCertStore=0x5ef4b0) returned 0x5ef4b0 [0232.446] CertEnumCertificatesInStore (hCertStore=0x5ef4b0, pPrevCertContext=0x0) returned 0x57ad88 [0232.446] CertDuplicateCertificateContext (pCertContext=0x57ad88) returned 0x57ad88 [0232.447] CertEnumCertificatesInStore (hCertStore=0x5ef4b0, pPrevCertContext=0x57ad88) returned 0x57ad38 [0232.447] CertDuplicateCertificateContext (pCertContext=0x57ad38) returned 0x57ad38 [0232.447] CertEnumCertificatesInStore (hCertStore=0x5ef4b0, pPrevCertContext=0x57ad38) returned 0x57abf8 [0232.447] CertDuplicateCertificateContext (pCertContext=0x57abf8) returned 0x57abf8 [0232.447] CertEnumCertificatesInStore (hCertStore=0x5ef4b0, pPrevCertContext=0x57abf8) returned 0x57ace8 [0232.448] CertDuplicateCertificateContext (pCertContext=0x57ace8) returned 0x57ace8 [0232.448] CertEnumCertificatesInStore (hCertStore=0x5ef4b0, pPrevCertContext=0x57ace8) returned 0x0 [0232.448] CertCloseStore (hCertStore=0x5ef4b0, dwFlags=0x0) returned 1 [0232.448] CertFreeCertificateContext (pCertContext=0x57ace8) returned 1 [0232.461] CertOpenStore (lpszStoreProvider=0x2, dwEncodingType=0x10001, hCryptProv=0x0, dwFlags=0x2204, pvPara=0x0) returned 0x5efd98 [0232.583] CertAddCRLLinkToStore (in: hCertStore=0x5efd98, pCrlContext=0x57ad88, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0232.585] CertAddCRLLinkToStore (in: hCertStore=0x5efd98, pCrlContext=0x57ad38, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0232.585] CertAddCRLLinkToStore (in: hCertStore=0x5efd98, pCrlContext=0x57abf8, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0232.585] CertAddCRLLinkToStore (in: hCertStore=0x5efd98, pCrlContext=0x57ace8, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0232.590] CertGetCertificateChain (in: hChainEngine=0x0, pCertContext=0x57ace8, pTime=0x19eb28, hAdditionalStore=0x5efd98, pChainPara=0x19ea68, dwFlags=0x0, pvReserved=0x0, ppChainContext=0x19ea5c | out: ppChainContext=0x19ea5c) returned 1 [0232.727] CertDuplicateCertificateChain (pChainContext=0x5cd710) returned 0x5cd710 [0232.728] CertDuplicateCertificateContext (pCertContext=0x57ace8) returned 0x57ace8 [0232.728] CertDuplicateCertificateContext (pCertContext=0x57a888) returned 0x57a888 [0232.728] CertDuplicateCertificateContext (pCertContext=0x57a978) returned 0x57a978 [0232.729] CertDuplicateCertificateContext (pCertContext=0x57a6a8) returned 0x57a6a8 [0232.729] CertFreeCertificateChain (pChainContext=0x5cd710) [0232.730] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x1, pChainContext=0x5cd710, pPolicyPara=0x19ec08, pPolicyStatus=0x19ebf4 | out: pPolicyStatus=0x19ebf4) returned 1 [0232.731] SetLastError (dwErrCode=0x0) [0232.733] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x4, pChainContext=0x5cd710, pPolicyPara=0x19ec74, pPolicyStatus=0x19ec1c | out: pPolicyStatus=0x19ec1c) returned 1 [0232.738] CertFreeCertificateChain (pChainContext=0x5cd710) [0232.738] CertFreeCertificateContext (pCertContext=0x57ace8) returned 1 [0232.743] EtwEventRegister (in: ProviderId=0x21f4234, EnableCallback=0x46c06ae, CallbackContext=0x0, RegHandle=0x21f4210 | out: RegHandle=0x21f4210) returned 0x0 [0232.744] EtwEventSetInformation (RegHandle=0x60e558, InformationClass=0x7b, EventInformation=0x2, InformationLength=0x21f41d0) returned 0x0 [0232.749] CoTaskMemAlloc (cb=0x20c) returned 0x5cd710 [0232.749] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x5cd710, nSize=0x104 | out: lpBuffer="") returned 0x0 [0232.749] CoTaskMemFree (pv=0x5cd710) [0232.749] CoTaskMemAlloc (cb=0x20c) returned 0x5cd710 [0232.749] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x5cd710, nSize=0x104 | out: lpBuffer="") returned 0x0 [0232.749] CoTaskMemFree (pv=0x5cd710) [0232.749] CoTaskMemAlloc (cb=0x20c) returned 0x5cd710 [0232.749] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x5cd710, nSize=0x104 | out: lpBuffer="") returned 0x0 [0232.749] CoTaskMemFree (pv=0x5cd710) [0232.749] CoTaskMemAlloc (cb=0x20c) returned 0x5cd710 [0232.749] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x5cd710, nSize=0x104 | out: lpBuffer="") returned 0x0 [0232.749] CoTaskMemFree (pv=0x5cd710) [0232.753] EncryptMessage (in: phContext=0x21ef000, fQOP=0x0, pMessage=0x21fa970, MessageSeqNo=0x0 | out: pMessage=0x21fa970) returned 0x0 [0232.753] send (s=0x614, buf=0x21f9448*, len=42, flags=0) returned 42 [0232.755] recv (in: s=0x614, buf=0x2206d98, len=5, flags=0 | out: buf=0x2206d98*) returned 5 [0232.971] recv (in: s=0x614, buf=0x2206d9d, len=219, flags=0 | out: buf=0x2206d9d*) returned 219 [0232.972] DecryptMessage (in: phContext=0x21ef000, pMessage=0x220ae58, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x220ae58, pfQOP=0x0) returned 0x0 [0232.980] EncryptMessage (in: phContext=0x21ef000, fQOP=0x0, pMessage=0x220bc78, MessageSeqNo=0x0 | out: pMessage=0x220bc78) returned 0x0 [0232.981] send (s=0x614, buf=0x21f9448*, len=74, flags=0) returned 74 [0232.981] recv (in: s=0x614, buf=0x2206d98, len=5, flags=0 | out: buf=0x2206d98*) returned 5 [0233.201] recv (in: s=0x614, buf=0x2206d9d, len=42, flags=0 | out: buf=0x2206d9d*) returned 42 [0233.201] DecryptMessage (in: phContext=0x21ef000, pMessage=0x220bdf8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x220bdf8, pfQOP=0x0) returned 0x0 [0233.204] SysStringLen (param_1="勽ᨌ嫞ﭨ蕋Ꮸ曢昔봉淧옸ꮲຳ而䀩") returned 0x10 [0233.204] SystemFunction041 (in: Memory=0x5a3e34, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x5a3e34) returned 0x0 [0233.204] SysStringLen (param_1=" kOOdr$f8tSet") returned 0x10 [0233.204] SystemFunction040 (in: Memory=0x5a3e34, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x5a3e34) returned 0x0 [0233.205] SysStringLen (param_1=" kOOdr$f8") returned 0xa [0233.205] SysStringLen (param_1=" kOOdr$f8") returned 0xa [0233.205] EncryptMessage (in: phContext=0x21ef000, fQOP=0x0, pMessage=0x220c114, MessageSeqNo=0x0 | out: pMessage=0x220c114) returned 0x0 [0233.205] send (s=0x614, buf=0x21f9448*, len=47, flags=0) returned 47 [0233.206] recv (in: s=0x614, buf=0x2206d98, len=5, flags=0 | out: buf=0x2206d98*) returned 5 [0233.456] recv (in: s=0x614, buf=0x2206d9d, len=61, flags=0 | out: buf=0x2206d9d*) returned 61 [0233.456] DecryptMessage (in: phContext=0x21ef000, pMessage=0x220c294, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x220c294, pfQOP=0x0) returned 0x0 [0233.457] EncryptMessage (in: phContext=0x21ef000, fQOP=0x0, pMessage=0x220c7d0, MessageSeqNo=0x0 | out: pMessage=0x220c7d0) returned 0x0 [0233.457] send (s=0x614, buf=0x21f9448*, len=66, flags=0) returned 66 [0233.458] recv (in: s=0x614, buf=0x2206d98, len=5, flags=0 | out: buf=0x2206d98*) returned 5 [0233.782] recv (in: s=0x614, buf=0x2206d9d, len=38, flags=0 | out: buf=0x2206d9d*) returned 38 [0233.782] DecryptMessage (in: phContext=0x21ef000, pMessage=0x220c950, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x220c950, pfQOP=0x0) returned 0x0 [0233.783] EncryptMessage (in: phContext=0x21ef000, fQOP=0x0, pMessage=0x220cc08, MessageSeqNo=0x0 | out: pMessage=0x220cc08) returned 0x0 [0233.783] send (s=0x614, buf=0x21f9448*, len=64, flags=0) returned 64 [0233.783] recv (in: s=0x614, buf=0x2206d98, len=5, flags=0 | out: buf=0x2206d98*) returned 5 [0234.011] recv (in: s=0x614, buf=0x2206d9d, len=119, flags=0 | out: buf=0x2206d9d*) returned 119 [0234.012] DecryptMessage (in: phContext=0x21ef000, pMessage=0x220cd88, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x220cd88, pfQOP=0x0) returned 0x0 [0234.259] QueryContextAttributesW (in: phContext=0x21ef000, ulAttribute=0x1a, pBuffer=0x19f1d8 | out: pBuffer=0x19f1d8) returned 0x0 [0234.268] DeleteSecurityContext (phContext=0x21ef000) returned 0x0 [0234.269] shutdown (s=0x614, how=2) returned 0 [0234.270] setsockopt (s=0x614, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0234.270] closesocket (s=0x614) returned 0 [0234.328] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x19f400 | out: UnbiasedTime=0x19f400) returned 1 [0234.328] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x19f3f0 | out: UnbiasedTime=0x19f3f0) returned 1 [0234.328] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x19f400 | out: UnbiasedTime=0x19f400) returned 1 [0234.328] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x19f3f0 | out: UnbiasedTime=0x19f3f0) returned 1 [0234.438] GetModuleHandleW (lpModuleName="user32.dll") returned 0x75640000 [0234.438] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x19dc04, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcW@i'öÜÄ «ÆkðÞ\x19", lpUsedDefaultChar=0x0) returned 14 [0234.439] GetProcAddress (hModule=0x75640000, lpProcName="DefWindowProcW") returned 0x778baee0 [0234.440] GetStockObject (i=5) returned 0x1900015 [0234.442] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0234.444] CoTaskMemAlloc (cb=0x5c) returned 0x581ca8 [0234.444] RegisterClassW (lpWndClass=0x19dbf4) returned 0xc1db [0234.445] CoTaskMemFree (pv=0x581ca8) [0234.453] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0234.454] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.0.app.0.3c47a4f_r41_ad1", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x701e2 [0234.466] SetWindowLongW (hWnd=0x701e2, nIndex=-4, dwNewLong=2005642976) returned 74190966 [0234.467] GetWindowLongW (hWnd=0x701e2, nIndex=-4) returned 2005642976 [0234.468] GetCurrentProcess () returned 0xffffffff [0234.468] GetCurrentThread () returned 0xfffffffe [0234.468] GetCurrentProcess () returned 0xffffffff [0234.468] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x19d4d0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x19d4d0*=0x718) returned 1 [0234.471] GetCurrentThreadId () returned 0x91c [0234.472] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x19d454 | out: phkResult=0x19d454*=0x71c) returned 0x0 [0234.472] RegQueryValueExW (in: hKey=0x71c, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x19d474, lpData=0x0, lpcbData=0x19d470*=0x0 | out: lpType=0x19d474*=0x0, lpData=0x0, lpcbData=0x19d470*=0x0) returned 0x2 [0234.472] RegQueryValueExW (in: hKey=0x71c, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x19d474, lpData=0x0, lpcbData=0x19d470*=0x0 | out: lpType=0x19d474*=0x0, lpData=0x0, lpcbData=0x19d470*=0x0) returned 0x2 [0234.473] RegCloseKey (hKey=0x71c) returned 0x0 [0234.473] SetWindowLongW (hWnd=0x701e2, nIndex=-4, dwNewLong=74191006) returned 2005642976 [0234.474] GetWindowLongW (hWnd=0x701e2, nIndex=-4) returned 74191006 [0234.474] GetWindowLongW (hWnd=0x701e2, nIndex=-16) returned 79691776 [0234.920] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x701e2, Msg=0x24, wParam=0x0, lParam=0x19d76c) returned 0x0 [0234.921] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc20c [0234.923] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x701e2, Msg=0x81, wParam=0x0, lParam=0x19d760) returned 0x1 [0234.937] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x701e2, Msg=0x83, wParam=0x0, lParam=0x19d74c) returned 0x0 [0234.949] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x701e2, Msg=0x1, wParam=0x0, lParam=0x19d760) returned 0x0 [0235.015] SetClipboardViewer (hWndNewViewer=0x701e2) returned 0x0 [0235.255] OleInitialize (pvReserved=0x0) returned 0x0 [0235.286] OleGetClipboard (in: ppDataObj=0x19f1bc | out: ppDataObj=0x19f1bc*=0x5f91a8) returned 0x0 [0235.299] IUnknown:QueryInterface (in: This=0x5f91a8, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec7c | out: ppvObject=0x19ec7c*=0x5f91a8) returned 0x0 [0235.325] IUnknown:QueryInterface (in: This=0x5f91a8, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ec38 | out: ppvObject=0x19ec38*=0x0) returned 0x80004002 [0235.325] IUnknown:QueryInterface (in: This=0x5f91a8, riid=0x6bdafb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ea54 | out: ppvObject=0x19ea54*=0x0) returned 0x80004002 [0235.326] IUnknown:QueryInterface (in: This=0x5f91a8, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e82c | out: ppvObject=0x19e82c*=0x0) returned 0x80004002 [0235.326] IUnknown:AddRef (This=0x5f91a8) returned 0x3 [0235.326] IUnknown:QueryInterface (in: This=0x5f91a8, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e594 | out: ppvObject=0x19e594*=0x0) returned 0x80004002 [0235.326] IUnknown:QueryInterface (in: This=0x5f91a8, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0235.326] IUnknown:QueryInterface (in: This=0x5f91a8, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e550 | out: ppvObject=0x19e550*=0x0) returned 0x80004002 [0235.326] CoGetContextToken (in: pToken=0x19e5b0 | out: pToken=0x19e5b0) returned 0x0 [0235.326] CoGetContextToken (in: pToken=0x19e9b8 | out: pToken=0x19e9b8) returned 0x0 [0235.326] IUnknown:QueryInterface (in: This=0x5f91a8, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea48 | out: ppvObject=0x19ea48*=0x0) returned 0x80004002 [0235.327] IUnknown:Release (This=0x5f91a8) returned 0x2 [0235.327] CoGetContextToken (in: pToken=0x19ef90 | out: pToken=0x19ef90) returned 0x0 [0235.327] CoGetContextToken (in: pToken=0x19eef0 | out: pToken=0x19eef0) returned 0x0 [0235.327] IUnknown:QueryInterface (in: This=0x5f91a8, riid=0x19efc0*(Data1=0x10e, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19efbc | out: ppvObject=0x19efbc*=0x5f91a8) returned 0x0 [0235.328] IUnknown:AddRef (This=0x5f91a8) returned 0x4 [0235.328] IUnknown:Release (This=0x5f91a8) returned 0x3 [0235.328] IUnknown:Release (This=0x5f91a8) returned 0x2 [0235.368] CoGetContextToken (in: pToken=0x19f008 | out: pToken=0x19f008) returned 0x0 [0235.369] CoGetContextToken (in: pToken=0x19ef68 | out: pToken=0x19ef68) returned 0x0 [0235.369] IUnknown:QueryInterface (in: This=0x5f91a8, riid=0x19f038*(Data1=0x3cee8cc1, Data2=0x1adb, Data3=0x327f, Data4=([0]=0x9b, [1]=0x97, [2]=0x7a, [3]=0x9c, [4]=0x80, [5]=0x89, [6]=0xbf, [7]=0xb3)), ppvObject=0x19f034 | out: ppvObject=0x19f034*=0x0) returned 0x80004002 [0236.238] IDataObject:QueryGetData (This=0x5f91a8, pformatetc=0x19f17c) returned 0x0 [0236.995] IDataObject:RemoteGetData (in: This=0x5f91a8, pformatetcIn=0x19f17c, pRemoteMedium=0x19f10c | out: pRemoteMedium=0x19f10c) returned 0x0 [0237.011] GlobalLock (hMem=0x5a50004) returned 0x5dbea0 [0237.011] GlobalUnlock (hMem=0x5a50004) returned 0 [0237.216] SendMessageW (hWnd=0x0, Msg=0x308, wParam=0x0, lParam=0x0) returned 0x0 [0237.216] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x701e2, Msg=0x308, wParam=0x0, lParam=0x0) returned 0x0 [0237.587] GetCurrentProcessId () returned 0x8f4 [0237.591] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8f4) returned 0x728 [0237.863] EnumProcessModules (in: hProcess=0x728, lphModule=0x220f8a4, cb=0x100, lpcbNeeded=0x19f440 | out: lphModule=0x220f8a4, lpcbNeeded=0x19f440) returned 1 [0237.866] EnumProcessModules (in: hProcess=0x728, lphModule=0x220f9b0, cb=0x200, lpcbNeeded=0x19f440 | out: lphModule=0x220f9b0, lpcbNeeded=0x19f440) returned 1 [0237.869] GetModuleInformation (in: hProcess=0x728, hModule=0x400000, lpmodinfo=0x220fbf0, cb=0xc | out: lpmodinfo=0x220fbf0*(lpBaseOfDll=0x400000, SizeOfImage=0x3a000, EntryPoint=0x0)) returned 1 [0237.870] CoTaskMemAlloc (cb=0x804) returned 0x5802e0 [0237.870] GetModuleBaseNameW (in: hProcess=0x728, hModule=0x400000, lpBaseName=0x5802e0, nSize=0x800 | out: lpBaseName="c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe") returned 0x44 [0237.871] CoTaskMemFree (pv=0x5802e0) [0237.871] CoTaskMemAlloc (cb=0x804) returned 0x5802e0 [0237.871] GetModuleFileNameExW (in: hProcess=0x728, hModule=0x400000, lpFilename=0x5802e0, nSize=0x800 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe")) returned 0x62 [0237.874] CoTaskMemFree (pv=0x5802e0) [0237.874] CloseHandle (hObject=0x728) returned 1 [0237.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe", cchWideChar=68, lpMultiByteStr=0x19f3fc, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe\x83d%\x05'öÜÄ «Ækhö\x19", lpUsedDefaultChar=0x0) returned 68 [0237.892] GetModuleHandleA (lpModuleName="c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838.exe") returned 0x400000 [0237.980] SetWindowsHookExW (idHook=13, lpfn=0x46c10c6, hmod=0x400000, dwThreadId=0x0) returned 0x15012f [0237.993] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc208 [0237.993] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc150 [0237.996] GetSystemMetrics (nIndex=75) returned 1 [0238.012] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0238.018] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x67d70000 [0238.042] GetStockObject (i=5) returned 0x1900015 [0238.042] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0238.043] CoTaskMemAlloc (cb=0x5c) returned 0x581ca8 [0238.043] RegisterClassW (lpWndClass=0x19f224) returned 0xc20e [0238.043] CoTaskMemFree (pv=0x581ca8) [0238.043] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0238.044] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.3c47a4f_r41_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x801f2 [0238.044] SetWindowLongW (hWnd=0x801f2, nIndex=-4, dwNewLong=2005642976) returned 74191086 [0238.044] GetWindowLongW (hWnd=0x801f2, nIndex=-4) returned 2005642976 [0238.045] SetWindowLongW (hWnd=0x801f2, nIndex=-4, dwNewLong=74191126) returned 2005642976 [0238.045] GetWindowLongW (hWnd=0x801f2, nIndex=-4) returned 74191126 [0238.045] GetWindowLongW (hWnd=0x801f2, nIndex=-16) returned 113311744 [0238.045] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc20d [0238.045] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x801f2, Msg=0x24, wParam=0x0, lParam=0x19ed9c) returned 0x0 [0238.046] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x801f2, Msg=0x81, wParam=0x0, lParam=0x19ed90) returned 0x1 [0238.046] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x801f2, Msg=0x83, wParam=0x0, lParam=0x19ed7c) returned 0x0 [0238.047] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x801f2, Msg=0x1, wParam=0x0, lParam=0x19ed90) returned 0x0 [0238.048] GetClientRect (in: hWnd=0x801f2, lpRect=0x19eabc | out: lpRect=0x19eabc) returned 1 [0238.048] GetWindowRect (in: hWnd=0x801f2, lpRect=0x19eabc | out: lpRect=0x19eabc) returned 1 [0238.050] GetParent (hWnd=0x801f2) returned 0x0 [0238.051] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x19f444 | out: lplpMessageFilter=0x19f444*=0x0) returned 0x0 [0238.053] PeekMessageW (in: lpMsg=0x19f418, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19f418) returned 1 [0238.054] IsWindowUnicode (hWnd=0x701e2) returned 1 [0238.054] GetMessageW (in: lpMsg=0x19f418, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19f418) returned 1 [0238.084] TranslateMessage (lpMsg=0x19f418) returned 0 [0238.084] DispatchMessageW (lpMsg=0x19f418) returned 0x0 [0238.084] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x701e2, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0238.084] PeekMessageW (in: lpMsg=0x19f418, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19f418) returned 0 [0238.085] PeekMessageW (in: lpMsg=0x19f418, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19f418) returned 0 [0238.085] WaitMessage () returned 1 [0238.475] PeekMessageW (lpMsg=0x19f418, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0) [0238.476] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x701e2, Msg=0x3b, wParam=0x50e, lParam=0x0) returned 0x1 [0238.476] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x701e2, Msg=0x11, wParam=0x0, lParam=0x0) returned 0x1 [0238.478] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x701e2, Msg=0x1c, wParam=0x1, lParam=0xca8) returned 0x0 [0238.478] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x701e2, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0238.484] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x701e2, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0238.494] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x701e2, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0238.502] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x701e2, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0238.502] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x701e2, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0238.502] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x701e2, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0238.504] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x701e2, Msg=0x46, wParam=0x0, lParam=0x19f2ec) returned 0x0 [0238.505] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x701e2, Msg=0x47, wParam=0x0, lParam=0x19f2ec) returned 0x0 [0238.506] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x701e2, Msg=0x3b, wParam=0x50c, lParam=0x0) returned 0x2 [0238.507] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x701e2, Msg=0x16, wParam=0x1, lParam=0x0) returned 0x0 Thread: id = 13 os_tid = 0x9d8 Thread: id = 14 os_tid = 0x684 Thread: id = 15 os_tid = 0x7a0 [0189.338] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0189.338] RoInitialize () returned 0x1 [0189.338] RoUninitialize () returned 0x0 [0219.393] CoGetContextToken (in: pToken=0x427fc30 | out: pToken=0x427fc30) returned 0x0 [0219.393] CoGetContextToken (in: pToken=0x427fbb8 | out: pToken=0x427fbb8) returned 0x0 [0219.393] WbemDefPath:IUnknown:Release (This=0x5c1ae8) returned 0x1 [0219.393] WbemDefPath:IUnknown:Release (This=0x5c1ae8) returned 0x0 [0219.393] CoGetContextToken (in: pToken=0x427fbb8 | out: pToken=0x427fbb8) returned 0x0 [0219.393] WbemDefPath:IUnknown:Release (This=0x5e09d0) returned 0x1 [0219.393] WbemDefPath:IUnknown:Release (This=0x5e09d0) returned 0x0 [0219.393] CoGetContextToken (in: pToken=0x427fbb8 | out: pToken=0x427fbb8) returned 0x0 [0219.393] WbemDefPath:IUnknown:Release (This=0x5e06c0) returned 0x1 [0219.393] WbemDefPath:IUnknown:Release (This=0x5e06c0) returned 0x0 [0219.393] CoGetContextToken (in: pToken=0x427fbb8 | out: pToken=0x427fbb8) returned 0x0 [0219.393] WbemDefPath:IUnknown:Release (This=0x5e0490) returned 0x1 [0219.393] WbemDefPath:IUnknown:Release (This=0x5e0490) returned 0x0 [0219.393] CoGetContextToken (in: pToken=0x427fbb8 | out: pToken=0x427fbb8) returned 0x0 [0219.393] WbemDefPath:IUnknown:Release (This=0x5e0730) returned 0x1 [0219.393] WbemDefPath:IUnknown:Release (This=0x5e0730) returned 0x0 [0219.393] CoGetContextToken (in: pToken=0x427fbb8 | out: pToken=0x427fbb8) returned 0x0 [0219.393] WbemDefPath:IUnknown:Release (This=0x5e0650) returned 0x1 [0219.393] WbemDefPath:IUnknown:Release (This=0x5e0650) returned 0x0 [0219.394] CoGetContextToken (in: pToken=0x427fbb8 | out: pToken=0x427fbb8) returned 0x0 [0219.394] WbemDefPath:IUnknown:Release (This=0x5e0ab0) returned 0x1 [0219.394] WbemDefPath:IUnknown:Release (This=0x5e0ab0) returned 0x0 [0219.394] CoGetContextToken (in: pToken=0x427fc30 | out: pToken=0x427fc30) returned 0x0 [0219.394] CoGetContextToken (in: pToken=0x427fbb8 | out: pToken=0x427fbb8) returned 0x0 [0219.394] WbemLocator:IUnknown:Release (This=0x5c1ca8) returned 0x1 [0219.394] WbemLocator:IUnknown:Release (This=0x5c1ca8) returned 0x0 [0219.394] CoGetContextToken (in: pToken=0x427fbb8 | out: pToken=0x427fbb8) returned 0x0 [0219.394] WbemLocator:IUnknown:Release (This=0x5c1f38) returned 0x1 [0219.394] WbemLocator:IUnknown:Release (This=0x5c1f38) returned 0x0 [0219.394] CoGetContextToken (in: pToken=0x427fc30 | out: pToken=0x427fc30) returned 0x0 [0219.394] IUnknown:QueryInterface (in: This=0x564088, riid=0x6bd28724*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x427fbd8 | out: ppvObject=0x427fbd8*=0x564098) returned 0x0 [0219.394] CObjectContext::ContextCallback () returned 0x0 [0224.244] IUnknown:Release (This=0x564098) returned 0x1 [0224.244] IUnknown:Release (This=0x5f1088) returned 0x0 [0224.247] IUnknown:Release (This=0x5eee38) returned 0x0 [0224.248] CoGetContextToken (in: pToken=0x427fa50 | out: pToken=0x427fa50) returned 0x0 [0224.248] IUnknown:QueryInterface (in: This=0x564088, riid=0x6bd28724*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x427f9f8 | out: ppvObject=0x427f9f8*=0x564098) returned 0x0 [0224.248] CObjectContext::ContextCallback () returned 0x0 [0224.267] IUnknown:Release (This=0x564098) returned 0x1 [0224.268] CoGetContextToken (in: pToken=0x427fa50 | out: pToken=0x427fa50) returned 0x0 [0224.268] IUnknown:QueryInterface (in: This=0x564088, riid=0x6bd28724*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x427f9f8 | out: ppvObject=0x427f9f8*=0x564098) returned 0x0 [0224.268] CObjectContext::ContextCallback () returned 0x0 [0224.273] IUnknown:Release (This=0x564098) returned 0x1 [0224.274] IUnknown:Release (This=0x564088) returned 0x0 [0224.274] IUnknown:Release (This=0x5df778) returned 0x0 [0224.274] IUnknown:Release (This=0x5ec408) returned 0x0 [0224.274] CloseHandle (hObject=0x37c) returned 1 [0224.275] CloseHandle (hObject=0x490) returned 1 [0224.275] CloseHandle (hObject=0x458) returned 1 [0224.275] CloseHandle (hObject=0x524) returned 1 [0224.275] CloseHandle (hObject=0x378) returned 1 [0224.277] CloseHandle (hObject=0x508) returned 1 [0224.277] CloseHandle (hObject=0x520) returned 1 [0224.278] CloseHandle (hObject=0x504) returned 1 [0224.278] CloseHandle (hObject=0x518) returned 1 [0224.278] CloseHandle (hObject=0x4ec) returned 1 [0224.279] CloseHandle (hObject=0x4e8) returned 1 [0224.279] RegCloseKey (hKey=0x540) returned 0x0 [0224.279] CloseHandle (hObject=0x4e4) returned 1 [0224.279] CloseHandle (hObject=0x51c) returned 1 [0224.279] CloseHandle (hObject=0x394) returned 1 [0224.280] CloseHandle (hObject=0x390) returned 1 [0224.280] CloseHandle (hObject=0x38c) returned 1 [0224.280] CloseHandle (hObject=0x4e0) returned 1 [0224.280] CloseHandle (hObject=0x388) returned 1 [0224.280] CloseHandle (hObject=0x50c) returned 1 [0224.281] CloseHandle (hObject=0x384) returned 1 [0224.281] CloseHandle (hObject=0x380) returned 1 [0224.281] CloseHandle (hObject=0x494) returned 1 Thread: id = 16 os_tid = 0xb4c Thread: id = 17 os_tid = 0x1354 Thread: id = 18 os_tid = 0x644 Thread: id = 127 os_tid = 0x1398 [0199.644] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0199.644] RoInitialize () returned 0x1 [0199.644] RoUninitialize () returned 0x0 [0199.669] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x4e0f5b4 | out: lpiid=0x4e0f5b4) returned 0x0 [0199.670] CoGetClassObject (in: rclsid=0x5c30b4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6bd254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x5c1c48) returned 0x0 [0199.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c1c48, riid=0x6bcd95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0199.671] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c1c48, pUnkOuter=0x0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x5c1ae8) returned 0x0 [0199.671] WbemDefPath:IUnknown:Release (This=0x5c1c48) returned 0x0 [0199.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c1ae8, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x5c1ae8) returned 0x0 [0199.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c1ae8, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0199.672] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c1ae8, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0199.672] WbemDefPath:IUnknown:AddRef (This=0x5c1ae8) returned 0x3 [0199.672] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c1ae8, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0199.672] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c1ae8, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0199.672] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c1ae8, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x5b7bb0) returned 0x0 [0199.672] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5b7bb0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0199.672] WbemDefPath:IUnknown:Release (This=0x5b7bb0) returned 0x3 [0199.672] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0199.673] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0199.673] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c1ae8, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0199.673] WbemDefPath:IUnknown:Release (This=0x5c1ae8) returned 0x2 [0199.673] WbemDefPath:IUnknown:Release (This=0x5c1ae8) returned 0x1 [0199.673] SetEvent (hEvent=0x458) returned 1 [0199.686] CoGetClassObject (in: rclsid=0x5c30b4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6bd254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x5c1c48) returned 0x0 [0199.688] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c1c48, riid=0x6bcd95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0199.688] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c1c48, pUnkOuter=0x0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x5c3310) returned 0x0 [0199.688] WbemDefPath:IUnknown:Release (This=0x5c1c48) returned 0x0 [0199.688] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c3310, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x5c3310) returned 0x0 [0199.688] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c3310, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0199.688] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c3310, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0199.688] WbemDefPath:IUnknown:AddRef (This=0x5c3310) returned 0x3 [0199.688] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c3310, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0199.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c3310, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0199.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c3310, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x5b7c58) returned 0x0 [0199.689] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5b7c58, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0199.689] WbemDefPath:IUnknown:Release (This=0x5b7c58) returned 0x3 [0199.689] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0199.689] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0199.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c3310, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0199.689] WbemDefPath:IUnknown:Release (This=0x5c3310) returned 0x2 [0199.689] WbemDefPath:IUnknown:Release (This=0x5c3310) returned 0x1 [0199.689] SetEvent (hEvent=0x490) returned 1 [0199.693] CoGetClassObject (in: rclsid=0x5c30b4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6bd254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x5c1d18) returned 0x0 [0199.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c1d18, riid=0x6bcd95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0199.694] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c1d18, pUnkOuter=0x0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x59e028) returned 0x0 [0199.694] WbemDefPath:IUnknown:Release (This=0x5c1d18) returned 0x0 [0199.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x59e028, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x59e028) returned 0x0 [0199.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x59e028, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0199.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x59e028, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0199.694] WbemDefPath:IUnknown:AddRef (This=0x59e028) returned 0x3 [0199.695] WbemDefPath:IUnknown:QueryInterface (in: This=0x59e028, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0199.695] WbemDefPath:IUnknown:QueryInterface (in: This=0x59e028, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0199.695] WbemDefPath:IUnknown:QueryInterface (in: This=0x59e028, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x5b7b98) returned 0x0 [0199.695] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5b7b98, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0199.695] WbemDefPath:IUnknown:Release (This=0x5b7b98) returned 0x3 [0199.695] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0199.695] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0199.695] WbemDefPath:IUnknown:QueryInterface (in: This=0x59e028, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0199.695] WbemDefPath:IUnknown:Release (This=0x59e028) returned 0x2 [0199.695] WbemDefPath:IUnknown:Release (This=0x59e028) returned 0x1 [0199.695] SetEvent (hEvent=0x494) returned 1 [0201.137] CoGetClassObject (in: rclsid=0x5c30b4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6bd254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x5c1d78) returned 0x0 [0201.138] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c1d78, riid=0x6bcd95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0201.138] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c1d78, pUnkOuter=0x0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x5e0880) returned 0x0 [0201.138] WbemDefPath:IUnknown:Release (This=0x5c1d78) returned 0x0 [0201.138] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0880, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x5e0880) returned 0x0 [0201.138] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0880, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0201.138] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0880, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0201.138] WbemDefPath:IUnknown:AddRef (This=0x5e0880) returned 0x3 [0201.138] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0880, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0201.138] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0880, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0201.138] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0880, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x5e3b50) returned 0x0 [0201.138] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5e3b50, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0201.138] WbemDefPath:IUnknown:Release (This=0x5e3b50) returned 0x3 [0201.138] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0201.139] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0201.139] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0880, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0201.139] WbemDefPath:IUnknown:Release (This=0x5e0880) returned 0x2 [0201.139] WbemDefPath:IUnknown:Release (This=0x5e0880) returned 0x1 [0201.139] SetEvent (hEvent=0x4e0) returned 1 [0212.672] CoGetClassObject (in: rclsid=0x5c30b4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6bd254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x5c1dd8) returned 0x0 [0212.674] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c1dd8, riid=0x6bcd95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0212.674] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c1dd8, pUnkOuter=0x0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x5e0960) returned 0x0 [0212.675] WbemDefPath:IUnknown:Release (This=0x5c1dd8) returned 0x0 [0212.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0960, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x5e0960) returned 0x0 [0212.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0960, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0212.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0960, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0212.675] WbemDefPath:IUnknown:AddRef (This=0x5e0960) returned 0x3 [0212.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0960, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0212.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0960, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0212.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0960, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x5e3af0) returned 0x0 [0212.676] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5e3af0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0212.676] WbemDefPath:IUnknown:Release (This=0x5e3af0) returned 0x3 [0212.676] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0212.676] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0212.676] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0960, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0212.676] WbemDefPath:IUnknown:Release (This=0x5e0960) returned 0x2 [0212.676] WbemDefPath:IUnknown:Release (This=0x5e0960) returned 0x1 [0212.676] SetEvent (hEvent=0x4e4) returned 1 [0212.726] CoGetClassObject (in: rclsid=0x5c30b4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6bd254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x5c1e38) returned 0x0 [0212.728] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c1e38, riid=0x6bcd95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0212.728] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c1e38, pUnkOuter=0x0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x5e09d0) returned 0x0 [0212.728] WbemDefPath:IUnknown:Release (This=0x5c1e38) returned 0x0 [0212.728] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e09d0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x5e09d0) returned 0x0 [0212.728] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e09d0, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0212.728] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e09d0, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0212.728] WbemDefPath:IUnknown:AddRef (This=0x5e09d0) returned 0x3 [0212.728] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e09d0, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0212.728] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e09d0, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0212.728] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e09d0, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x5e3a48) returned 0x0 [0212.728] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5e3a48, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0212.728] WbemDefPath:IUnknown:Release (This=0x5e3a48) returned 0x3 [0212.729] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0212.729] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0212.729] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e09d0, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0212.729] WbemDefPath:IUnknown:Release (This=0x5e09d0) returned 0x2 [0212.729] WbemDefPath:IUnknown:Release (This=0x5e09d0) returned 0x1 [0212.729] SetEvent (hEvent=0x4e8) returned 1 [0212.732] CoGetClassObject (in: rclsid=0x5c30b4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6bd254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x5c1eb8) returned 0x0 [0212.733] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c1eb8, riid=0x6bcd95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0212.733] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c1eb8, pUnkOuter=0x0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x5e0a40) returned 0x0 [0212.733] WbemDefPath:IUnknown:Release (This=0x5c1eb8) returned 0x0 [0212.733] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0a40, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x5e0a40) returned 0x0 [0212.733] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0a40, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0212.733] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0a40, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0212.733] WbemDefPath:IUnknown:AddRef (This=0x5e0a40) returned 0x3 [0212.733] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0a40, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0212.734] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0a40, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0212.734] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0a40, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x5e3c40) returned 0x0 [0212.734] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5e3c40, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0212.734] WbemDefPath:IUnknown:Release (This=0x5e3c40) returned 0x3 [0212.734] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0212.734] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0212.734] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0a40, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0212.734] WbemDefPath:IUnknown:Release (This=0x5e0a40) returned 0x2 [0212.734] WbemDefPath:IUnknown:Release (This=0x5e0a40) returned 0x1 [0212.734] SetEvent (hEvent=0x4ec) returned 1 [0212.844] CoGetClassObject (in: rclsid=0x5c30b4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6bd254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x5c1e88) returned 0x0 [0212.844] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c1e88, riid=0x6bcd95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0212.844] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c1e88, pUnkOuter=0x0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x5e0420) returned 0x0 [0212.845] WbemDefPath:IUnknown:Release (This=0x5c1e88) returned 0x0 [0212.845] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0420, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x5e0420) returned 0x0 [0212.845] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0420, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0212.845] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0420, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0212.845] WbemDefPath:IUnknown:AddRef (This=0x5e0420) returned 0x3 [0212.845] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0420, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0212.845] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0420, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0212.845] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0420, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x5e3d48) returned 0x0 [0212.845] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5e3d48, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0212.845] WbemDefPath:IUnknown:Release (This=0x5e3d48) returned 0x3 [0212.845] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0212.845] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0212.845] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0420, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0212.846] WbemDefPath:IUnknown:Release (This=0x5e0420) returned 0x2 [0212.846] WbemDefPath:IUnknown:Release (This=0x5e0420) returned 0x1 [0212.846] SetEvent (hEvent=0x504) returned 1 [0213.300] CoGetClassObject (in: rclsid=0x5c30b4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6bd254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x5c1d88) returned 0x0 [0213.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c1d88, riid=0x6bcd95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0213.301] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c1d88, pUnkOuter=0x0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x5e06c0) returned 0x0 [0213.301] WbemDefPath:IUnknown:Release (This=0x5c1d88) returned 0x0 [0213.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e06c0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x5e06c0) returned 0x0 [0213.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e06c0, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0213.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e06c0, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0213.301] WbemDefPath:IUnknown:AddRef (This=0x5e06c0) returned 0x3 [0213.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e06c0, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0213.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e06c0, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0213.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e06c0, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x607760) returned 0x0 [0213.301] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x607760, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0213.302] WbemDefPath:IUnknown:Release (This=0x607760) returned 0x3 [0213.302] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0213.302] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0213.302] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e06c0, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0213.302] WbemDefPath:IUnknown:Release (This=0x5e06c0) returned 0x2 [0213.302] WbemDefPath:IUnknown:Release (This=0x5e06c0) returned 0x1 [0213.302] SetEvent (hEvent=0x508) returned 1 [0213.374] CoGetClassObject (in: rclsid=0x5c30b4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6bd254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x5c1e28) returned 0x0 [0213.375] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c1e28, riid=0x6bcd95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0213.375] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c1e28, pUnkOuter=0x0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x5e0490) returned 0x0 [0213.375] WbemDefPath:IUnknown:Release (This=0x5c1e28) returned 0x0 [0213.375] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0490, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x5e0490) returned 0x0 [0213.376] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0490, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0213.376] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0490, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0213.376] WbemDefPath:IUnknown:AddRef (This=0x5e0490) returned 0x3 [0213.376] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0490, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0213.376] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0490, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0213.376] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0490, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x6075b0) returned 0x0 [0213.377] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6075b0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0213.377] WbemDefPath:IUnknown:Release (This=0x6075b0) returned 0x3 [0213.377] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0213.377] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0213.377] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0490, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0213.377] WbemDefPath:IUnknown:Release (This=0x5e0490) returned 0x2 [0213.378] WbemDefPath:IUnknown:Release (This=0x5e0490) returned 0x1 [0213.378] SetEvent (hEvent=0x50c) returned 1 [0213.391] CoGetClassObject (in: rclsid=0x5c30b4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6bd254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x5c1e98) returned 0x0 [0213.392] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c1e98, riid=0x6bcd95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0213.392] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c1e98, pUnkOuter=0x0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x5e0730) returned 0x0 [0213.393] WbemDefPath:IUnknown:Release (This=0x5c1e98) returned 0x0 [0213.393] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0730, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x5e0730) returned 0x0 [0213.393] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0730, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0213.393] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0730, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0213.394] WbemDefPath:IUnknown:AddRef (This=0x5e0730) returned 0x3 [0213.394] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0730, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0213.394] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0730, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0213.394] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0730, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x607a30) returned 0x0 [0213.394] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x607a30, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0213.394] WbemDefPath:IUnknown:Release (This=0x607a30) returned 0x3 [0213.394] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0213.394] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0213.395] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0730, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0213.395] WbemDefPath:IUnknown:Release (This=0x5e0730) returned 0x2 [0213.395] WbemDefPath:IUnknown:Release (This=0x5e0730) returned 0x1 [0213.395] SetEvent (hEvent=0x51c) returned 1 [0213.417] CoGetClassObject (in: rclsid=0x5c30b4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6bd254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x5c1e38) returned 0x0 [0213.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c1e38, riid=0x6bcd95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0213.418] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c1e38, pUnkOuter=0x0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x5e0650) returned 0x0 [0213.418] WbemDefPath:IUnknown:Release (This=0x5c1e38) returned 0x0 [0213.419] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0650, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x5e0650) returned 0x0 [0213.419] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0650, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0213.419] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0650, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0213.419] WbemDefPath:IUnknown:AddRef (This=0x5e0650) returned 0x3 [0213.419] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0650, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0213.419] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0650, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0213.420] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0650, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x607328) returned 0x0 [0213.420] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x607328, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0213.420] WbemDefPath:IUnknown:Release (This=0x607328) returned 0x3 [0213.420] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0213.420] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0213.420] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0650, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0213.420] WbemDefPath:IUnknown:Release (This=0x5e0650) returned 0x2 [0213.421] WbemDefPath:IUnknown:Release (This=0x5e0650) returned 0x1 [0213.421] SetEvent (hEvent=0x518) returned 1 [0213.432] CoGetClassObject (in: rclsid=0x5c30b4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6bd254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x5c1e38) returned 0x0 [0213.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c1e38, riid=0x6bcd95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0213.432] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c1e38, pUnkOuter=0x0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x5e0ab0) returned 0x0 [0213.432] WbemDefPath:IUnknown:Release (This=0x5c1e38) returned 0x0 [0213.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0ab0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x5e0ab0) returned 0x0 [0213.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0ab0, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0213.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0ab0, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0213.433] WbemDefPath:IUnknown:AddRef (This=0x5e0ab0) returned 0x3 [0213.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0ab0, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0213.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0ab0, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0213.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0ab0, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x607520) returned 0x0 [0213.433] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x607520, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0213.433] WbemDefPath:IUnknown:Release (This=0x607520) returned 0x3 [0213.433] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0213.433] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0213.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0ab0, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0213.433] WbemDefPath:IUnknown:Release (This=0x5e0ab0) returned 0x2 [0213.433] WbemDefPath:IUnknown:Release (This=0x5e0ab0) returned 0x1 [0213.433] SetEvent (hEvent=0x520) returned 1 [0213.445] CoGetClassObject (in: rclsid=0x5c30b4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6bd254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x5c1f18) returned 0x0 [0213.445] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c1f18, riid=0x6bcd95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0213.445] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c1f18, pUnkOuter=0x0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x5e0570) returned 0x0 [0213.445] WbemDefPath:IUnknown:Release (This=0x5c1f18) returned 0x0 [0213.445] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0570, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x5e0570) returned 0x0 [0213.446] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0570, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0213.446] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0570, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0213.446] WbemDefPath:IUnknown:AddRef (This=0x5e0570) returned 0x3 [0213.446] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0570, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0213.446] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0570, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0213.446] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0570, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x5eccd0) returned 0x0 [0213.446] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5eccd0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0213.446] WbemDefPath:IUnknown:Release (This=0x5eccd0) returned 0x3 [0213.446] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0213.446] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0213.446] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0570, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0213.446] WbemDefPath:IUnknown:Release (This=0x5e0570) returned 0x2 [0213.447] WbemDefPath:IUnknown:Release (This=0x5e0570) returned 0x1 [0213.447] SetEvent (hEvent=0x524) returned 1 [0224.220] CoGetClassObject (in: rclsid=0x5c30b4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6bd254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x5c1e18) returned 0x0 [0224.220] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c1e18, riid=0x6bcd95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0224.221] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c1e18, pUnkOuter=0x0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x5e09d0) returned 0x0 [0224.221] WbemDefPath:IUnknown:Release (This=0x5c1e18) returned 0x0 [0224.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e09d0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x5e09d0) returned 0x0 [0224.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e09d0, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0224.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e09d0, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0224.221] WbemDefPath:IUnknown:AddRef (This=0x5e09d0) returned 0x3 [0224.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e09d0, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0224.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e09d0, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0224.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e09d0, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x5ed150) returned 0x0 [0224.221] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5ed150, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0224.221] WbemDefPath:IUnknown:Release (This=0x5ed150) returned 0x3 [0224.221] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0224.221] CoGetContextToken (in: pToken=0x4e0e9f8 | out: pToken=0x4e0e9f8) returned 0x0 [0224.222] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0224.222] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e09d0, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0224.222] WbemDefPath:IUnknown:Release (This=0x5e09d0) returned 0x2 [0224.222] WbemDefPath:IUnknown:Release (This=0x5e09d0) returned 0x1 [0224.222] SetEvent (hEvent=0x5c4) returned 1 [0224.489] CoGetClassObject (in: rclsid=0x5c30b4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6bd254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x5c1d28) returned 0x0 [0224.489] WbemDefPath:IUnknown:QueryInterface (in: This=0x5c1d28, riid=0x6bcd95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0224.489] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5c1d28, pUnkOuter=0x0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x5e0490) returned 0x0 [0224.489] WbemDefPath:IUnknown:Release (This=0x5c1d28) returned 0x0 [0224.489] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0490, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x5e0490) returned 0x0 [0224.489] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0490, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0224.489] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0490, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0224.490] WbemDefPath:IUnknown:AddRef (This=0x5e0490) returned 0x3 [0224.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0490, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0224.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0490, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0224.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0490, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x5ed708) returned 0x0 [0224.490] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5ed708, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0224.490] WbemDefPath:IUnknown:Release (This=0x5ed708) returned 0x3 [0224.490] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0224.490] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0224.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e0490, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0224.490] WbemDefPath:IUnknown:Release (This=0x5e0490) returned 0x2 [0224.490] WbemDefPath:IUnknown:Release (This=0x5e0490) returned 0x1 [0224.490] SetEvent (hEvent=0x5d8) returned 1 [0225.835] CoGetClassObject (in: rclsid=0x5c30b4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6bd254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x58eb60) returned 0x0 [0225.835] WbemDefPath:IUnknown:QueryInterface (in: This=0x58eb60, riid=0x6bcd95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002 [0225.835] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58eb60, pUnkOuter=0x0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x5e06c0) returned 0x0 [0225.836] WbemDefPath:IUnknown:Release (This=0x58eb60) returned 0x0 [0225.836] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e06c0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x5e06c0) returned 0x0 [0225.836] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e06c0, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002 [0225.836] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e06c0, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002 [0225.836] WbemDefPath:IUnknown:AddRef (This=0x5e06c0) returned 0x3 [0225.836] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e06c0, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002 [0225.836] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e06c0, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002 [0225.836] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e06c0, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x5ed9d8) returned 0x0 [0225.836] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5ed9d8, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0225.836] WbemDefPath:IUnknown:Release (This=0x5ed9d8) returned 0x3 [0225.836] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0 [0225.836] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0 [0225.836] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e06c0, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002 [0225.837] WbemDefPath:IUnknown:Release (This=0x5e06c0) returned 0x2 [0225.837] WbemDefPath:IUnknown:Release (This=0x5e06c0) returned 0x1 [0225.837] SetEvent (hEvent=0x4f4) returned 1 Thread: id = 128 os_tid = 0x38c [0199.701] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0199.701] RoInitialize () returned 0x1 [0199.701] RoUninitialize () returned 0x0 [0199.701] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x4f4f7fc | out: lpiid=0x4f4f7fc) returned 0x0 [0199.702] CoGetClassObject (in: rclsid=0x5c2c34*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6bd254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4f4f510 | out: ppv=0x4f4f510*=0x5b7fe8) returned 0x0 [0199.703] WbemLocator:IUnknown:QueryInterface (in: This=0x5b7fe8, riid=0x6bcd95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4f4f728 | out: ppvObject=0x4f4f728*=0x0) returned 0x80004002 [0199.703] WbemLocator:IClassFactory:CreateInstance (in: This=0x5b7fe8, pUnkOuter=0x0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f4f73c | out: ppvObject=0x4f4f73c*=0x5c1ca8) returned 0x0 [0199.703] WbemLocator:IUnknown:Release (This=0x5b7fe8) returned 0x0 [0199.703] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1ca8, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f4f35c | out: ppvObject=0x4f4f35c*=0x5c1ca8) returned 0x0 [0199.703] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1ca8, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4f4f318 | out: ppvObject=0x4f4f318*=0x0) returned 0x80004002 [0199.703] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1ca8, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4f4ef0c | out: ppvObject=0x4f4ef0c*=0x0) returned 0x80004002 [0199.703] WbemLocator:IUnknown:AddRef (This=0x5c1ca8) returned 0x3 [0199.703] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1ca8, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4f4ec74 | out: ppvObject=0x4f4ec74*=0x0) returned 0x80004002 [0199.703] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1ca8, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4f4ec24 | out: ppvObject=0x4f4ec24*=0x0) returned 0x80004002 [0199.703] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1ca8, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f4ec30 | out: ppvObject=0x4f4ec30*=0x0) returned 0x80004002 [0199.703] CoGetContextToken (in: pToken=0x4f4ec90 | out: pToken=0x4f4ec90) returned 0x0 [0199.703] CoGetObjectContext (in: riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5b7f8c | out: ppv=0x5b7f8c*=0x564140) returned 0x0 [0199.705] CoGetContextToken (in: pToken=0x4f4f098 | out: pToken=0x4f4f098) returned 0x0 [0199.705] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1ca8, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f4f128 | out: ppvObject=0x4f4f128*=0x0) returned 0x80004002 [0199.705] WbemLocator:IUnknown:Release (This=0x5c1ca8) returned 0x2 [0199.705] WbemLocator:IUnknown:Release (This=0x5c1ca8) returned 0x1 [0199.706] CoGetContextToken (in: pToken=0x4f4f708 | out: pToken=0x4f4f708) returned 0x0 [0199.706] CoGetContextToken (in: pToken=0x4f4f668 | out: pToken=0x4f4f668) returned 0x0 [0199.706] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1ca8, riid=0x4f4f738*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x4f4f734 | out: ppvObject=0x4f4f734*=0x5c1ca8) returned 0x0 [0199.706] WbemLocator:IUnknown:AddRef (This=0x5c1ca8) returned 0x3 [0199.706] WbemLocator:IUnknown:Release (This=0x5c1ca8) returned 0x2 [0199.708] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x59e028, puCount=0x4f4f8cc | out: puCount=0x4f4f8cc*=0x2) returned 0x0 [0199.708] WbemDefPath:IWbemPath:GetText (in: This=0x59e028, lFlags=8, puBuffLength=0x4f4f8c8*=0x0, pszText=0x0 | out: puBuffLength=0x4f4f8c8*=0xf, pszText=0x0) returned 0x0 [0199.709] WbemDefPath:IWbemPath:GetText (in: This=0x59e028, lFlags=8, puBuffLength=0x4f4f8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x4f4f8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0199.716] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x4f4eb4c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0199.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", cchWideChar=63, lpMultiByteStr=0x4f4f050, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll\x04ò\x18\x06h'öÜÄ «ÆkHóô\x04¸ì]", lpUsedDefaultChar=0x0) returned 63 [0199.717] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll") returned 0x6c590000 [0199.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResetSecurity", cchWideChar=13, lpMultiByteStr=0x4f4f084, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResetSecurity\x1a\x06h'öÜÄ «ÆkHóô\x04¸ì]", lpUsedDefaultChar=0x0) returned 13 [0199.870] GetProcAddress (hModule=0x6c590000, lpProcName="ResetSecurity") returned 0x6c5926fe [0199.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetSecurity", cchWideChar=11, lpMultiByteStr=0x4f4f084, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetSecurity\x04D\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 11 [0199.878] GetProcAddress (hModule=0x6c590000, lpProcName="SetSecurity") returned 0x6c592740 [0199.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServices", cchWideChar=18, lpMultiByteStr=0x4f4f080, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServices\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 18 [0199.888] GetProcAddress (hModule=0x6c590000, lpProcName="BlessIWbemServices") returned 0x6c591e89 [0199.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServicesObject", cchWideChar=24, lpMultiByteStr=0x4f4f078, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesObjectD\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 24 [0199.915] GetProcAddress (hModule=0x6c590000, lpProcName="BlessIWbemServicesObject") returned 0x6c591edb [0199.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyHandle", cchWideChar=17, lpMultiByteStr=0x4f4f080, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyHandle\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 17 [0199.946] GetProcAddress (hModule=0x6c590000, lpProcName="GetPropertyHandle") returned 0x6c5923d4 [0199.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WritePropertyValue", cchWideChar=18, lpMultiByteStr=0x4f4f080, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WritePropertyValue\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 18 [0199.964] GetProcAddress (hModule=0x6c590000, lpProcName="WritePropertyValue") returned 0x6c592837 [0199.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x4f4f08c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 5 [0199.982] GetProcAddress (hModule=0x6c590000, lpProcName="Clone") returned 0x6c591f2d [0199.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VerifyClientKey", cchWideChar=15, lpMultiByteStr=0x4f4f080, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VerifyClientKey\x04D\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 15 [0199.994] GetProcAddress (hModule=0x6c590000, lpProcName="VerifyClientKey") returned 0x6c5927d4 [0200.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetQualifierSet", cchWideChar=15, lpMultiByteStr=0x4f4f080, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetQualifierSet\x04D\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 15 [0200.002] GetProcAddress (hModule=0x6c590000, lpProcName="GetQualifierSet") returned 0x6c592435 [0200.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Get", cchWideChar=3, lpMultiByteStr=0x4f4f08c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Get\x04D\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 3 [0200.004] GetProcAddress (hModule=0x6c590000, lpProcName="Get") returned 0x6c5922f4 [0200.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Put", cchWideChar=3, lpMultiByteStr=0x4f4f08c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Put\x04D\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 3 [0200.031] GetProcAddress (hModule=0x6c590000, lpProcName="Put") returned 0x6c5924de [0200.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Delete", cchWideChar=6, lpMultiByteStr=0x4f4f08c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Delete\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 6 [0200.056] GetProcAddress (hModule=0x6c590000, lpProcName="Delete") returned 0x6c592151 [0200.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetNames", cchWideChar=8, lpMultiByteStr=0x4f4f088, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetNamesD\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 8 [0200.072] GetProcAddress (hModule=0x6c590000, lpProcName="GetNames") returned 0x6c5923a2 [0200.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginEnumeration", cchWideChar=16, lpMultiByteStr=0x4f4f080, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginEnumerationD\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 16 [0200.104] GetProcAddress (hModule=0x6c590000, lpProcName="BeginEnumeration") returned 0x6c591e63 [0200.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Next", cchWideChar=4, lpMultiByteStr=0x4f4f08c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextD\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 4 [0200.115] GetProcAddress (hModule=0x6c590000, lpProcName="Next") returned 0x6c5924a3 [0200.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndEnumeration", cchWideChar=14, lpMultiByteStr=0x4f4f084, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndEnumeration\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 14 [0200.138] GetProcAddress (hModule=0x6c590000, lpProcName="EndEnumeration") returned 0x6c5921e2 [0200.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyQualifierSet", cchWideChar=23, lpMultiByteStr=0x4f4f078, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyQualifierSet\x04D\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 23 [0200.149] GetProcAddress (hModule=0x6c590000, lpProcName="GetPropertyQualifierSet") returned 0x6c59241f [0200.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x4f4f08c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 5 [0200.169] GetProcAddress (hModule=0x6c590000, lpProcName="Clone") returned 0x6c591f2d [0200.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetObjectText", cchWideChar=13, lpMultiByteStr=0x4f4f084, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetObjectText\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 13 [0200.169] GetProcAddress (hModule=0x6c590000, lpProcName="GetObjectText") returned 0x6c5923be [0200.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnDerivedClass", cchWideChar=17, lpMultiByteStr=0x4f4f080, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnDerivedClass\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 17 [0200.185] GetProcAddress (hModule=0x6c590000, lpProcName="SpawnDerivedClass") returned 0x6c592786 [0200.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnInstance", cchWideChar=13, lpMultiByteStr=0x4f4f084, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnInstance\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 13 [0200.199] GetProcAddress (hModule=0x6c590000, lpProcName="SpawnInstance") returned 0x6c59279c [0200.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CompareTo", cchWideChar=9, lpMultiByteStr=0x4f4f088, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CompareTo\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 9 [0200.201] GetProcAddress (hModule=0x6c590000, lpProcName="CompareTo") returned 0x6c591fad [0200.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyOrigin", cchWideChar=17, lpMultiByteStr=0x4f4f080, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyOrigin\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 17 [0200.214] GetProcAddress (hModule=0x6c590000, lpProcName="GetPropertyOrigin") returned 0x6c592409 [0200.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="InheritsFrom", cchWideChar=12, lpMultiByteStr=0x4f4f084, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InheritsFromD\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 12 [0200.236] GetProcAddress (hModule=0x6c590000, lpProcName="InheritsFrom") returned 0x6c592448 [0200.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethod", cchWideChar=9, lpMultiByteStr=0x4f4f088, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethod\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 9 [0200.238] GetProcAddress (hModule=0x6c590000, lpProcName="GetMethod") returned 0x6c59235a [0200.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutMethod", cchWideChar=9, lpMultiByteStr=0x4f4f088, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutMethod\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 9 [0200.258] GetProcAddress (hModule=0x6c590000, lpProcName="PutMethod") returned 0x6c5925fa [0200.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DeleteMethod", cchWideChar=12, lpMultiByteStr=0x4f4f084, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DeleteMethodD\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 12 [0200.278] GetProcAddress (hModule=0x6c590000, lpProcName="DeleteMethod") returned 0x6c592164 [0200.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginMethodEnumeration", cchWideChar=22, lpMultiByteStr=0x4f4f07c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginMethodEnumeration\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 22 [0200.280] GetProcAddress (hModule=0x6c590000, lpProcName="BeginMethodEnumeration") returned 0x6c591e76 [0200.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NextMethod", cchWideChar=10, lpMultiByteStr=0x4f4f088, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMethod\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 10 [0200.283] GetProcAddress (hModule=0x6c590000, lpProcName="NextMethod") returned 0x6c5924c2 [0200.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndMethodEnumeration", cchWideChar=20, lpMultiByteStr=0x4f4f07c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndMethodEnumerationD\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 20 [0200.301] GetProcAddress (hModule=0x6c590000, lpProcName="EndMethodEnumeration") returned 0x6c5921f2 [0200.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodQualifierSet", cchWideChar=21, lpMultiByteStr=0x4f4f07c, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodQualifierSet\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 21 [0200.303] GetProcAddress (hModule=0x6c590000, lpProcName="GetMethodQualifierSet") returned 0x6c59238c [0200.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodOrigin", cchWideChar=15, lpMultiByteStr=0x4f4f080, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodOrigin\x04D\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 15 [0200.306] GetProcAddress (hModule=0x6c590000, lpProcName="GetMethodOrigin") returned 0x6c592376 [0200.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Get", cchWideChar=16, lpMultiByteStr=0x4f4f080, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_GetD\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 16 [0200.309] GetProcAddress (hModule=0x6c590000, lpProcName="QualifierSet_Get") returned 0x6c59264c [0200.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Put", cchWideChar=16, lpMultiByteStr=0x4f4f080, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_PutD\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 16 [0200.332] GetProcAddress (hModule=0x6c590000, lpProcName="QualifierSet_Put") returned 0x6c59269a [0200.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Delete", cchWideChar=19, lpMultiByteStr=0x4f4f07c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Delete\x04D\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 19 [0200.382] GetProcAddress (hModule=0x6c590000, lpProcName="QualifierSet_Delete") returned 0x6c592629 [0200.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_GetNames", cchWideChar=21, lpMultiByteStr=0x4f4f07c, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_GetNames\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 21 [0200.384] GetProcAddress (hModule=0x6c590000, lpProcName="QualifierSet_GetNames") returned 0x6c592668 [0200.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_BeginEnumeration", cchWideChar=29, lpMultiByteStr=0x4f4f074, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_BeginEnumeration\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 29 [0200.410] GetProcAddress (hModule=0x6c590000, lpProcName="QualifierSet_BeginEnumeration") returned 0x6c592616 [0200.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Next", cchWideChar=17, lpMultiByteStr=0x4f4f080, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Next\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 17 [0200.412] GetProcAddress (hModule=0x6c590000, lpProcName="QualifierSet_Next") returned 0x6c59267e [0200.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_EndEnumeration", cchWideChar=27, lpMultiByteStr=0x4f4f074, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_EndEnumeration\x04D\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 27 [0200.433] GetProcAddress (hModule=0x6c590000, lpProcName="QualifierSet_EndEnumeration") returned 0x6c59263c [0200.435] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentApartmentType", cchWideChar=23, lpMultiByteStr=0x4f4f078, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentApartmentType\x04D\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 23 [0200.435] GetProcAddress (hModule=0x6c590000, lpProcName="GetCurrentApartmentType") returned 0x6c592435 [0200.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetDemultiplexedStub", cchWideChar=20, lpMultiByteStr=0x4f4f07c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetDemultiplexedStubD\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 20 [0200.468] GetProcAddress (hModule=0x6c590000, lpProcName="GetDemultiplexedStub") returned 0x6c592313 [0200.490] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateInstanceEnumWmi", cchWideChar=21, lpMultiByteStr=0x4f4f07c, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateInstanceEnumWmi\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 21 [0200.491] GetProcAddress (hModule=0x6c590000, lpProcName="CreateInstanceEnumWmi") returned 0x6c5920db [0200.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateClassEnumWmi", cchWideChar=18, lpMultiByteStr=0x4f4f080, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateClassEnumWmi\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 18 [0200.533] GetProcAddress (hModule=0x6c590000, lpProcName="CreateClassEnumWmi") returned 0x6c592065 [0200.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecQueryWmi", cchWideChar=12, lpMultiByteStr=0x4f4f084, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecQueryWmiD\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 12 [0200.536] GetProcAddress (hModule=0x6c590000, lpProcName="ExecQueryWmi") returned 0x6c59227b [0200.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecNotificationQueryWmi", cchWideChar=24, lpMultiByteStr=0x4f4f078, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecNotificationQueryWmiD\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 24 [0200.706] GetProcAddress (hModule=0x6c590000, lpProcName="ExecNotificationQueryWmi") returned 0x6c592202 [0200.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutInstanceWmi", cchWideChar=14, lpMultiByteStr=0x4f4f084, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutInstanceWmi\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 14 [0200.708] GetProcAddress (hModule=0x6c590000, lpProcName="PutInstanceWmi") returned 0x6c59257a [0200.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutClassWmi", cchWideChar=11, lpMultiByteStr=0x4f4f084, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutClassWmi\x04D\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 11 [0200.756] GetProcAddress (hModule=0x6c590000, lpProcName="PutClassWmi") returned 0x6c5924fa [0200.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloneEnumWbemClassObject", cchWideChar=24, lpMultiByteStr=0x4f4f078, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloneEnumWbemClassObjectD\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 24 [0200.763] GetProcAddress (hModule=0x6c590000, lpProcName="CloneEnumWbemClassObject") returned 0x6c591f40 [0200.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ConnectServerWmi", cchWideChar=16, lpMultiByteStr=0x4f4f080, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ConnectServerWmiD\x1a\x06h'öÜÄ «ÆkHóô\x04", lpUsedDefaultChar=0x0) returned 16 [0200.797] GetProcAddress (hModule=0x6c590000, lpProcName="ConnectServerWmi") returned 0x6c591fc3 [0200.915] CoCreateInstance (in: rclsid=0x6c591284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6c5912e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x4f4f7a4 | out: ppv=0x4f4f7a4*=0x5c1cb8) returned 0x0 [0200.916] WbemLocator:IWbemLocator:ConnectServer (in: This=0x5c1cb8, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x4f4f838 | out: ppNamespace=0x4f4f838*=0x5b21a0) returned 0x0 [0201.069] WbemLocator:IUnknown:QueryInterface (in: This=0x5b21a0, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f4f6d4 | out: ppvObject=0x4f4f6d4*=0x5b3e1c) returned 0x0 [0201.069] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5b3e1c, pProxy=0x5b21a0, pAuthnSvc=0x4f4f724, pAuthzSvc=0x4f4f720, pServerPrincName=0x4f4f718, pAuthnLevel=0x4f4f71c, pImpLevel=0x4f4f70c, pAuthInfo=0x4f4f710, pCapabilites=0x4f4f714 | out: pAuthnSvc=0x4f4f724*=0xa, pAuthzSvc=0x4f4f720*=0x0, pServerPrincName=0x4f4f718, pAuthnLevel=0x4f4f71c*=0x6, pImpLevel=0x4f4f70c*=0x2, pAuthInfo=0x4f4f710, pCapabilites=0x4f4f714*=0x1) returned 0x0 [0201.069] WbemLocator:IUnknown:Release (This=0x5b3e1c) returned 0x1 [0201.069] WbemLocator:IUnknown:QueryInterface (in: This=0x5b21a0, riid=0x6c5910f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f4f6c8 | out: ppvObject=0x4f4f6c8*=0x5b3e40) returned 0x0 [0201.069] WbemLocator:IUnknown:QueryInterface (in: This=0x5b21a0, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f4f6c4 | out: ppvObject=0x4f4f6c4*=0x5b3e1c) returned 0x0 [0201.069] WbemLocator:IClientSecurity:SetBlanket (This=0x5b3e1c, pProxy=0x5b21a0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0201.070] WbemLocator:IUnknown:Release (This=0x5b3e1c) returned 0x2 [0201.070] WbemLocator:IUnknown:Release (This=0x5b3e40) returned 0x1 [0201.070] CoTaskMemFree (pv=0x5c3018) [0201.070] WbemLocator:IUnknown:Release (This=0x5c1cb8) returned 0x0 [0201.070] WbemLocator:IUnknown:QueryInterface (in: This=0x5b21a0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f4f2c4 | out: ppvObject=0x4f4f2c4*=0x5b3e40) returned 0x0 [0201.070] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3e40, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4f4f280 | out: ppvObject=0x4f4f280*=0x0) returned 0x80004002 [0201.072] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3e40, riid=0x6bdafb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4f4f09c | out: ppvObject=0x4f4f09c*=0x0) returned 0x80004002 [0201.073] WbemLocator:IUnknown:QueryInterface (in: This=0x5b21a0, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4f4ee74 | out: ppvObject=0x4f4ee74*=0x0) returned 0x80004002 [0201.073] WbemLocator:IUnknown:AddRef (This=0x5b3e40) returned 0x3 [0201.073] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3e40, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4f4ebdc | out: ppvObject=0x4f4ebdc*=0x0) returned 0x80004002 [0201.073] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3e40, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4f4eb8c | out: ppvObject=0x4f4eb8c*=0x0) returned 0x80004002 [0201.073] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3e40, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f4eb98 | out: ppvObject=0x4f4eb98*=0x5b3d9c) returned 0x0 [0201.074] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5b3d9c, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4f4eba0 | out: pCid=0x4f4eba0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0201.074] WbemLocator:IUnknown:Release (This=0x5b3d9c) returned 0x3 [0201.074] CoGetContextToken (in: pToken=0x4f4ebf8 | out: pToken=0x4f4ebf8) returned 0x0 [0201.074] CoGetContextToken (in: pToken=0x4f4f000 | out: pToken=0x4f4f000) returned 0x0 [0201.074] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3e40, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f4f090 | out: ppvObject=0x4f4f090*=0x5b3e24) returned 0x0 [0201.074] WbemLocator:IRpcOptions:Query (in: This=0x5b3e24, pPrx=0x5b3e40, dwProperty=2, pdwValue=0x4f4f0b8 | out: pdwValue=0x4f4f0b8) returned 0x80004002 [0201.074] WbemLocator:IUnknown:Release (This=0x5b3e24) returned 0x3 [0201.074] WbemLocator:IUnknown:Release (This=0x5b3e40) returned 0x2 [0201.074] CoGetContextToken (in: pToken=0x4f4f5d8 | out: pToken=0x4f4f5d8) returned 0x0 [0201.074] CoGetContextToken (in: pToken=0x4f4f538 | out: pToken=0x4f4f538) returned 0x0 [0201.074] WbemLocator:IUnknown:QueryInterface (in: This=0x5b3e40, riid=0x4f4f608*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x4f4f604 | out: ppvObject=0x4f4f604*=0x5b21a0) returned 0x0 [0201.074] WbemLocator:IUnknown:AddRef (This=0x5b21a0) returned 0x4 [0201.074] WbemLocator:IUnknown:Release (This=0x5b21a0) returned 0x3 [0201.074] WbemLocator:IUnknown:Release (This=0x5b21a0) returned 0x2 [0201.080] SysStringLen (param_1=0x0) returned 0x0 [0201.081] CoUninitialize () Thread: id = 129 os_tid = 0xe20 [0201.091] CoGetContextToken (in: pToken=0x4f4f26c | out: pToken=0x4f4f26c) returned 0x0 [0201.091] CoGetContextToken (in: pToken=0x4f4f25c | out: pToken=0x4f4f25c) returned 0x0 [0201.092] CoGetMarshalSizeMax (in: pulSize=0x4f4f218, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5b3e40, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x4f4f218) returned 0x0 [0201.093] CoMarshalInterface (pStm=0x5a40c8, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5b3e40, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0212.795] CoGetContextToken (in: pToken=0x4f4f26c | out: pToken=0x4f4f26c) returned 0x0 [0212.795] CoGetContextToken (in: pToken=0x4f4f25c | out: pToken=0x4f4f25c) returned 0x0 [0212.795] CoGetMarshalSizeMax (in: pulSize=0x4f4f218, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5b5040, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x4f4f218) returned 0x0 [0212.795] CoMarshalInterface (pStm=0x5a4808, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5b5040, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0224.311] CoGetContextToken (in: pToken=0x4f4f26c | out: pToken=0x4f4f26c) returned 0x0 [0224.311] CoGetContextToken (in: pToken=0x4f4f25c | out: pToken=0x4f4f25c) returned 0x0 [0224.311] CoGetMarshalSizeMax (in: pulSize=0x4f4f218, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5b4840, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x4f4f218) returned 0x0 [0224.312] CoMarshalInterface (pStm=0x5a4088, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5b4840, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0224.575] CoGetContextToken (in: pToken=0x4f4f26c | out: pToken=0x4f4f26c) returned 0x0 [0224.575] CoGetContextToken (in: pToken=0x4f4f25c | out: pToken=0x4f4f25c) returned 0x0 [0224.575] CoGetMarshalSizeMax (in: pulSize=0x4f4f218, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5b4d40, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x4f4f218) returned 0x0 [0224.575] CoMarshalInterface (pStm=0x5a41e8, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5b4d40, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 Thread: id = 131 os_tid = 0x1290 [0212.747] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0212.747] RoInitialize () returned 0x1 [0212.747] RoUninitialize () returned 0x0 [0212.748] CoGetClassObject (in: rclsid=0x5c2c34*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6bd254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x508f490 | out: ppv=0x508f490*=0x5e3e20) returned 0x0 [0212.749] WbemLocator:IUnknown:QueryInterface (in: This=0x5e3e20, riid=0x6bcd95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x508f6a8 | out: ppvObject=0x508f6a8*=0x0) returned 0x80004002 [0212.749] WbemLocator:IClassFactory:CreateInstance (in: This=0x5e3e20, pUnkOuter=0x0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508f6bc | out: ppvObject=0x508f6bc*=0x5c1f38) returned 0x0 [0212.749] WbemLocator:IUnknown:Release (This=0x5e3e20) returned 0x0 [0212.749] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1f38, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508f2dc | out: ppvObject=0x508f2dc*=0x5c1f38) returned 0x0 [0212.750] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1f38, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x508f298 | out: ppvObject=0x508f298*=0x0) returned 0x80004002 [0212.750] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1f38, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x508ee8c | out: ppvObject=0x508ee8c*=0x0) returned 0x80004002 [0212.750] WbemLocator:IUnknown:AddRef (This=0x5c1f38) returned 0x3 [0212.750] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1f38, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x508ebf4 | out: ppvObject=0x508ebf4*=0x0) returned 0x80004002 [0212.750] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1f38, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x508eba4 | out: ppvObject=0x508eba4*=0x0) returned 0x80004002 [0212.750] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1f38, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508ebb0 | out: ppvObject=0x508ebb0*=0x0) returned 0x80004002 [0212.750] CoGetContextToken (in: pToken=0x508ec10 | out: pToken=0x508ec10) returned 0x0 [0212.752] CoGetContextToken (in: pToken=0x508f018 | out: pToken=0x508f018) returned 0x0 [0212.752] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1f38, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508f0a8 | out: ppvObject=0x508f0a8*=0x0) returned 0x80004002 [0212.752] WbemLocator:IUnknown:Release (This=0x5c1f38) returned 0x2 [0212.752] WbemLocator:IUnknown:Release (This=0x5c1f38) returned 0x1 [0212.752] CoGetContextToken (in: pToken=0x508f688 | out: pToken=0x508f688) returned 0x0 [0212.752] CoGetContextToken (in: pToken=0x508f5e8 | out: pToken=0x508f5e8) returned 0x0 [0212.752] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1f38, riid=0x508f6b8*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x508f6b4 | out: ppvObject=0x508f6b4*=0x5c1f38) returned 0x0 [0212.752] WbemLocator:IUnknown:AddRef (This=0x5c1f38) returned 0x3 [0212.752] WbemLocator:IUnknown:Release (This=0x5c1f38) returned 0x2 [0212.752] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5e0a40, puCount=0x508f84c | out: puCount=0x508f84c*=0x2) returned 0x0 [0212.752] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=8, puBuffLength=0x508f848*=0x0, pszText=0x0 | out: puBuffLength=0x508f848*=0xf, pszText=0x0) returned 0x0 [0212.752] WbemDefPath:IWbemPath:GetText (in: This=0x5e0a40, lFlags=8, puBuffLength=0x508f848*=0xf, pszText="00000000000000" | out: puBuffLength=0x508f848*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0212.753] CoCreateInstance (in: rclsid=0x6c591284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6c5912e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x508f724 | out: ppv=0x508f724*=0x5c1f28) returned 0x0 [0212.753] WbemLocator:IWbemLocator:ConnectServer (in: This=0x5c1f28, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x508f7b8 | out: ppNamespace=0x508f7b8*=0x5b21f0) returned 0x0 [0212.773] WbemLocator:IUnknown:QueryInterface (in: This=0x5b21f0, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508f654 | out: ppvObject=0x508f654*=0x5b501c) returned 0x0 [0212.773] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5b501c, pProxy=0x5b21f0, pAuthnSvc=0x508f6a4, pAuthzSvc=0x508f6a0, pServerPrincName=0x508f698, pAuthnLevel=0x508f69c, pImpLevel=0x508f68c, pAuthInfo=0x508f690, pCapabilites=0x508f694 | out: pAuthnSvc=0x508f6a4*=0xa, pAuthzSvc=0x508f6a0*=0x0, pServerPrincName=0x508f698, pAuthnLevel=0x508f69c*=0x6, pImpLevel=0x508f68c*=0x2, pAuthInfo=0x508f690, pCapabilites=0x508f694*=0x1) returned 0x0 [0212.773] WbemLocator:IUnknown:Release (This=0x5b501c) returned 0x1 [0212.773] WbemLocator:IUnknown:QueryInterface (in: This=0x5b21f0, riid=0x6c5910f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508f648 | out: ppvObject=0x508f648*=0x5b5040) returned 0x0 [0212.773] WbemLocator:IUnknown:QueryInterface (in: This=0x5b21f0, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508f644 | out: ppvObject=0x508f644*=0x5b501c) returned 0x0 [0212.773] WbemLocator:IClientSecurity:SetBlanket (This=0x5b501c, pProxy=0x5b21f0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0212.773] WbemLocator:IUnknown:Release (This=0x5b501c) returned 0x2 [0212.773] WbemLocator:IUnknown:Release (This=0x5b5040) returned 0x1 [0212.774] CoTaskMemFree (pv=0x5c3048) [0212.774] WbemLocator:IUnknown:Release (This=0x5c1f28) returned 0x0 [0212.774] WbemLocator:IUnknown:QueryInterface (in: This=0x5b21f0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508f244 | out: ppvObject=0x508f244*=0x5b5040) returned 0x0 [0212.774] WbemLocator:IUnknown:QueryInterface (in: This=0x5b5040, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x508f200 | out: ppvObject=0x508f200*=0x0) returned 0x80004002 [0212.775] WbemLocator:IUnknown:QueryInterface (in: This=0x5b5040, riid=0x6bdafb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x508f01c | out: ppvObject=0x508f01c*=0x0) returned 0x80004002 [0212.775] WbemLocator:IUnknown:QueryInterface (in: This=0x5b21f0, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x508edf4 | out: ppvObject=0x508edf4*=0x0) returned 0x80004002 [0212.776] WbemLocator:IUnknown:AddRef (This=0x5b5040) returned 0x3 [0212.776] WbemLocator:IUnknown:QueryInterface (in: This=0x5b5040, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x508eb5c | out: ppvObject=0x508eb5c*=0x0) returned 0x80004002 [0212.776] WbemLocator:IUnknown:QueryInterface (in: This=0x5b5040, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x508eb0c | out: ppvObject=0x508eb0c*=0x0) returned 0x80004002 [0212.776] WbemLocator:IUnknown:QueryInterface (in: This=0x5b5040, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508eb18 | out: ppvObject=0x508eb18*=0x5b4f9c) returned 0x0 [0212.776] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5b4f9c, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x508eb20 | out: pCid=0x508eb20*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0212.776] WbemLocator:IUnknown:Release (This=0x5b4f9c) returned 0x3 [0212.776] CoGetContextToken (in: pToken=0x508eb78 | out: pToken=0x508eb78) returned 0x0 [0212.777] CoGetContextToken (in: pToken=0x508ef80 | out: pToken=0x508ef80) returned 0x0 [0212.777] WbemLocator:IUnknown:QueryInterface (in: This=0x5b5040, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x508f010 | out: ppvObject=0x508f010*=0x5b5024) returned 0x0 [0212.777] WbemLocator:IRpcOptions:Query (in: This=0x5b5024, pPrx=0x5b5040, dwProperty=2, pdwValue=0x508f038 | out: pdwValue=0x508f038) returned 0x80004002 [0212.777] WbemLocator:IUnknown:Release (This=0x5b5024) returned 0x3 [0212.777] WbemLocator:IUnknown:Release (This=0x5b5040) returned 0x2 [0212.777] CoGetContextToken (in: pToken=0x508f558 | out: pToken=0x508f558) returned 0x0 [0212.777] CoGetContextToken (in: pToken=0x508f4b8 | out: pToken=0x508f4b8) returned 0x0 [0212.777] WbemLocator:IUnknown:QueryInterface (in: This=0x5b5040, riid=0x508f588*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x508f584 | out: ppvObject=0x508f584*=0x5b21f0) returned 0x0 [0212.778] WbemLocator:IUnknown:AddRef (This=0x5b21f0) returned 0x4 [0212.778] WbemLocator:IUnknown:Release (This=0x5b21f0) returned 0x3 [0212.778] WbemLocator:IUnknown:Release (This=0x5b21f0) returned 0x2 [0212.778] SysStringLen (param_1=0x0) returned 0x0 [0212.778] CoUninitialize () Thread: id = 133 os_tid = 0x133c [0213.857] CoGetContextToken (in: pToken=0x50cfebc | out: pToken=0x50cfebc) returned 0x0 [0213.857] IUnknown:QueryInterface (in: This=0x564140, riid=0x6bcf4564*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x50cfee0 | out: ppvObject=0x50cfee0*=0x56414c) returned 0x0 [0213.870] IComThreadingInfo:GetCurrentThreadType (in: This=0x56414c, pThreadType=0x50cff0c | out: pThreadType=0x50cff0c*=0) returned 0x0 [0213.870] IUnknown:Release (This=0x56414c) returned 0x1 [0213.870] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0213.870] RoInitialize () returned 0x1 [0213.870] RoUninitialize () returned 0x0 Thread: id = 134 os_tid = 0x510 [0215.180] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0215.180] CoGetContextToken (in: pToken=0x520fbc4 | out: pToken=0x520fbc4) returned 0x0 [0215.180] IUnknown:QueryInterface (in: This=0x564140, riid=0x6bcf4564*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x520fbe8 | out: ppvObject=0x520fbe8*=0x56414c) returned 0x0 [0215.181] IComThreadingInfo:GetCurrentThreadType (in: This=0x56414c, pThreadType=0x520fc14 | out: pThreadType=0x520fc14*=0) returned 0x0 [0215.181] IUnknown:Release (This=0x56414c) returned 0x1 [0215.181] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0215.181] CoUninitialize () [0215.181] RoInitialize () returned 0x1 [0215.181] RoUninitialize () returned 0x0 [0215.181] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x520f8d4 | out: UnbiasedTime=0x520f8d4) returned 1 [0215.181] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x520f8c4 | out: UnbiasedTime=0x520f8c4) returned 1 [0237.731] CoUninitialize () Thread: id = 135 os_tid = 0x2a4 Thread: id = 136 os_tid = 0xf74 [0224.255] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0224.255] RoInitialize () returned 0x1 [0224.256] RoUninitialize () returned 0x0 [0224.257] CoGetClassObject (in: rclsid=0x5c2c34*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6bd254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x544f390 | out: ppv=0x544f390*=0x5ed3c0) returned 0x0 [0224.257] WbemLocator:IUnknown:QueryInterface (in: This=0x5ed3c0, riid=0x6bcd95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x544f5a8 | out: ppvObject=0x544f5a8*=0x0) returned 0x80004002 [0224.257] WbemLocator:IClassFactory:CreateInstance (in: This=0x5ed3c0, pUnkOuter=0x0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x544f5bc | out: ppvObject=0x544f5bc*=0x5c1ee8) returned 0x0 [0224.258] WbemLocator:IUnknown:Release (This=0x5ed3c0) returned 0x0 [0224.258] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1ee8, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x544f1dc | out: ppvObject=0x544f1dc*=0x5c1ee8) returned 0x0 [0224.258] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1ee8, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x544f198 | out: ppvObject=0x544f198*=0x0) returned 0x80004002 [0224.258] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1ee8, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x544ed8c | out: ppvObject=0x544ed8c*=0x0) returned 0x80004002 [0224.258] WbemLocator:IUnknown:AddRef (This=0x5c1ee8) returned 0x3 [0224.258] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1ee8, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x544eaf4 | out: ppvObject=0x544eaf4*=0x0) returned 0x80004002 [0224.258] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1ee8, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x544eaa4 | out: ppvObject=0x544eaa4*=0x0) returned 0x80004002 [0224.258] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1ee8, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x544eab0 | out: ppvObject=0x544eab0*=0x0) returned 0x80004002 [0224.258] CoGetContextToken (in: pToken=0x544eb10 | out: pToken=0x544eb10) returned 0x0 [0224.258] CoGetContextToken (in: pToken=0x544ef18 | out: pToken=0x544ef18) returned 0x0 [0224.259] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1ee8, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x544efa8 | out: ppvObject=0x544efa8*=0x0) returned 0x80004002 [0224.259] WbemLocator:IUnknown:Release (This=0x5c1ee8) returned 0x2 [0224.259] WbemLocator:IUnknown:Release (This=0x5c1ee8) returned 0x1 [0224.259] CoGetContextToken (in: pToken=0x544f588 | out: pToken=0x544f588) returned 0x0 [0224.259] CoGetContextToken (in: pToken=0x544f4e8 | out: pToken=0x544f4e8) returned 0x0 [0224.259] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1ee8, riid=0x544f5b8*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x544f5b4 | out: ppvObject=0x544f5b4*=0x5c1ee8) returned 0x0 [0224.259] WbemLocator:IUnknown:AddRef (This=0x5c1ee8) returned 0x3 [0224.259] WbemLocator:IUnknown:Release (This=0x5c1ee8) returned 0x2 [0224.259] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5c3310, puCount=0x544f74c | out: puCount=0x544f74c*=0x2) returned 0x0 [0224.259] WbemDefPath:IWbemPath:GetText (in: This=0x5c3310, lFlags=8, puBuffLength=0x544f748*=0x0, pszText=0x0 | out: puBuffLength=0x544f748*=0xf, pszText=0x0) returned 0x0 [0224.259] WbemDefPath:IWbemPath:GetText (in: This=0x5c3310, lFlags=8, puBuffLength=0x544f748*=0xf, pszText="00000000000000" | out: puBuffLength=0x544f748*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0224.259] CoCreateInstance (in: rclsid=0x6c591284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6c5912e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x544f624 | out: ppv=0x544f624*=0x5c1e18) returned 0x0 [0224.259] WbemLocator:IWbemLocator:ConnectServer (in: This=0x5c1e18, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x544f6b8 | out: ppNamespace=0x544f6b8*=0x5b25b0) returned 0x0 [0224.302] WbemLocator:IUnknown:QueryInterface (in: This=0x5b25b0, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x544f554 | out: ppvObject=0x544f554*=0x5b481c) returned 0x0 [0224.302] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5b481c, pProxy=0x5b25b0, pAuthnSvc=0x544f5a4, pAuthzSvc=0x544f5a0, pServerPrincName=0x544f598, pAuthnLevel=0x544f59c, pImpLevel=0x544f58c, pAuthInfo=0x544f590, pCapabilites=0x544f594 | out: pAuthnSvc=0x544f5a4*=0xa, pAuthzSvc=0x544f5a0*=0x0, pServerPrincName=0x544f598, pAuthnLevel=0x544f59c*=0x6, pImpLevel=0x544f58c*=0x2, pAuthInfo=0x544f590, pCapabilites=0x544f594*=0x1) returned 0x0 [0224.302] WbemLocator:IUnknown:Release (This=0x5b481c) returned 0x1 [0224.302] WbemLocator:IUnknown:QueryInterface (in: This=0x5b25b0, riid=0x6c5910f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x544f548 | out: ppvObject=0x544f548*=0x5b4840) returned 0x0 [0224.302] WbemLocator:IUnknown:QueryInterface (in: This=0x5b25b0, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x544f544 | out: ppvObject=0x544f544*=0x5b481c) returned 0x0 [0224.302] WbemLocator:IClientSecurity:SetBlanket (This=0x5b481c, pProxy=0x5b25b0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0224.303] WbemLocator:IUnknown:Release (This=0x5b481c) returned 0x2 [0224.303] WbemLocator:IUnknown:Release (This=0x5b4840) returned 0x1 [0224.303] CoTaskMemFree (pv=0x5a3138) [0224.303] WbemLocator:IUnknown:Release (This=0x5c1e18) returned 0x0 [0224.303] WbemLocator:IUnknown:QueryInterface (in: This=0x5b25b0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x544f144 | out: ppvObject=0x544f144*=0x5b4840) returned 0x0 [0224.303] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4840, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x544f100 | out: ppvObject=0x544f100*=0x0) returned 0x80004002 [0224.304] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4840, riid=0x6bdafb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x544ef1c | out: ppvObject=0x544ef1c*=0x0) returned 0x80004002 [0224.305] WbemLocator:IUnknown:QueryInterface (in: This=0x5b25b0, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x544ecf4 | out: ppvObject=0x544ecf4*=0x0) returned 0x80004002 [0224.305] WbemLocator:IUnknown:AddRef (This=0x5b4840) returned 0x3 [0224.305] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4840, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x544ea5c | out: ppvObject=0x544ea5c*=0x0) returned 0x80004002 [0224.305] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4840, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x544ea0c | out: ppvObject=0x544ea0c*=0x0) returned 0x80004002 [0224.305] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4840, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x544ea18 | out: ppvObject=0x544ea18*=0x5b479c) returned 0x0 [0224.305] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5b479c, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x544ea20 | out: pCid=0x544ea20*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0224.305] WbemLocator:IUnknown:Release (This=0x5b479c) returned 0x3 [0224.306] CoGetContextToken (in: pToken=0x544ea78 | out: pToken=0x544ea78) returned 0x0 [0224.306] CoGetContextToken (in: pToken=0x544ee80 | out: pToken=0x544ee80) returned 0x0 [0224.306] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4840, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x544ef10 | out: ppvObject=0x544ef10*=0x5b4824) returned 0x0 [0224.306] WbemLocator:IRpcOptions:Query (in: This=0x5b4824, pPrx=0x5b4840, dwProperty=2, pdwValue=0x544ef38 | out: pdwValue=0x544ef38) returned 0x80004002 [0224.306] WbemLocator:IUnknown:Release (This=0x5b4824) returned 0x3 [0224.306] WbemLocator:IUnknown:Release (This=0x5b4840) returned 0x2 [0224.306] CoGetContextToken (in: pToken=0x544f458 | out: pToken=0x544f458) returned 0x0 [0224.306] CoGetContextToken (in: pToken=0x544f3b8 | out: pToken=0x544f3b8) returned 0x0 [0224.306] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4840, riid=0x544f488*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x544f484 | out: ppvObject=0x544f484*=0x5b25b0) returned 0x0 [0224.306] WbemLocator:IUnknown:AddRef (This=0x5b25b0) returned 0x4 [0224.306] WbemLocator:IUnknown:Release (This=0x5b25b0) returned 0x3 [0224.306] WbemLocator:IUnknown:Release (This=0x5b25b0) returned 0x2 [0224.306] SysStringLen (param_1=0x0) returned 0x0 [0224.306] CoUninitialize () Thread: id = 137 os_tid = 0x794 [0224.538] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0224.538] RoInitialize () returned 0x1 [0224.538] RoUninitialize () returned 0x0 [0224.540] CoGetClassObject (in: rclsid=0x5c2c34*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6bd254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x544f310 | out: ppv=0x544f310*=0x5ed450) returned 0x0 [0224.540] WbemLocator:IUnknown:QueryInterface (in: This=0x5ed450, riid=0x6bcd95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x544f528 | out: ppvObject=0x544f528*=0x0) returned 0x80004002 [0224.540] WbemLocator:IClassFactory:CreateInstance (in: This=0x5ed450, pUnkOuter=0x0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x544f53c | out: ppvObject=0x544f53c*=0x5c1d28) returned 0x0 [0224.540] WbemLocator:IUnknown:Release (This=0x5ed450) returned 0x0 [0224.540] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1d28, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x544f15c | out: ppvObject=0x544f15c*=0x5c1d28) returned 0x0 [0224.541] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1d28, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x544f118 | out: ppvObject=0x544f118*=0x0) returned 0x80004002 [0224.541] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1d28, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x544ed0c | out: ppvObject=0x544ed0c*=0x0) returned 0x80004002 [0224.541] WbemLocator:IUnknown:AddRef (This=0x5c1d28) returned 0x3 [0224.541] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1d28, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x544ea74 | out: ppvObject=0x544ea74*=0x0) returned 0x80004002 [0224.541] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1d28, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x544ea24 | out: ppvObject=0x544ea24*=0x0) returned 0x80004002 [0224.541] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1d28, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x544ea30 | out: ppvObject=0x544ea30*=0x0) returned 0x80004002 [0224.541] CoGetContextToken (in: pToken=0x544ea90 | out: pToken=0x544ea90) returned 0x0 [0224.542] CoGetContextToken (in: pToken=0x544ee98 | out: pToken=0x544ee98) returned 0x0 [0224.542] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1d28, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x544ef28 | out: ppvObject=0x544ef28*=0x0) returned 0x80004002 [0224.542] WbemLocator:IUnknown:Release (This=0x5c1d28) returned 0x2 [0224.542] WbemLocator:IUnknown:Release (This=0x5c1d28) returned 0x1 [0224.542] CoGetContextToken (in: pToken=0x544f508 | out: pToken=0x544f508) returned 0x0 [0224.542] CoGetContextToken (in: pToken=0x544f468 | out: pToken=0x544f468) returned 0x0 [0224.542] WbemLocator:IUnknown:QueryInterface (in: This=0x5c1d28, riid=0x544f538*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x544f534 | out: ppvObject=0x544f534*=0x5c1d28) returned 0x0 [0224.542] WbemLocator:IUnknown:AddRef (This=0x5c1d28) returned 0x3 [0224.542] WbemLocator:IUnknown:Release (This=0x5c1d28) returned 0x2 [0224.542] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5c3310, puCount=0x544f6cc | out: puCount=0x544f6cc*=0x2) returned 0x0 [0224.542] WbemDefPath:IWbemPath:GetText (in: This=0x5c3310, lFlags=8, puBuffLength=0x544f6c8*=0x0, pszText=0x0 | out: puBuffLength=0x544f6c8*=0xf, pszText=0x0) returned 0x0 [0224.542] WbemDefPath:IWbemPath:GetText (in: This=0x5c3310, lFlags=8, puBuffLength=0x544f6c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x544f6c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0224.542] CoCreateInstance (in: rclsid=0x6c591284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6c5912e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x544f5a4 | out: ppv=0x544f5a4*=0x5c1d78) returned 0x0 [0224.542] WbemLocator:IWbemLocator:ConnectServer (in: This=0x5c1d78, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x544f638 | out: ppNamespace=0x544f638*=0x5b29c0) returned 0x0 [0224.567] WbemLocator:IUnknown:QueryInterface (in: This=0x5b29c0, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x544f4d4 | out: ppvObject=0x544f4d4*=0x5b4d1c) returned 0x0 [0224.567] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5b4d1c, pProxy=0x5b29c0, pAuthnSvc=0x544f524, pAuthzSvc=0x544f520, pServerPrincName=0x544f518, pAuthnLevel=0x544f51c, pImpLevel=0x544f50c, pAuthInfo=0x544f510, pCapabilites=0x544f514 | out: pAuthnSvc=0x544f524*=0xa, pAuthzSvc=0x544f520*=0x0, pServerPrincName=0x544f518, pAuthnLevel=0x544f51c*=0x6, pImpLevel=0x544f50c*=0x2, pAuthInfo=0x544f510, pCapabilites=0x544f514*=0x1) returned 0x0 [0224.567] WbemLocator:IUnknown:Release (This=0x5b4d1c) returned 0x1 [0224.567] WbemLocator:IUnknown:QueryInterface (in: This=0x5b29c0, riid=0x6c5910f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x544f4c8 | out: ppvObject=0x544f4c8*=0x5b4d40) returned 0x0 [0224.567] WbemLocator:IUnknown:QueryInterface (in: This=0x5b29c0, riid=0x6c591104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x544f4c4 | out: ppvObject=0x544f4c4*=0x5b4d1c) returned 0x0 [0224.567] WbemLocator:IClientSecurity:SetBlanket (This=0x5b4d1c, pProxy=0x5b29c0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0224.568] WbemLocator:IUnknown:Release (This=0x5b4d1c) returned 0x2 [0224.568] WbemLocator:IUnknown:Release (This=0x5b4d40) returned 0x1 [0224.568] CoTaskMemFree (pv=0x5a3138) [0224.568] WbemLocator:IUnknown:Release (This=0x5c1d78) returned 0x0 [0224.568] WbemLocator:IUnknown:QueryInterface (in: This=0x5b29c0, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x544f0c4 | out: ppvObject=0x544f0c4*=0x5b4d40) returned 0x0 [0224.568] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4d40, riid=0x6bdafdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x544f080 | out: ppvObject=0x544f080*=0x0) returned 0x80004002 [0224.569] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4d40, riid=0x6bdafb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x544ee9c | out: ppvObject=0x544ee9c*=0x0) returned 0x80004002 [0224.569] WbemLocator:IUnknown:QueryInterface (in: This=0x5b29c0, riid=0x6bdb056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x544ec74 | out: ppvObject=0x544ec74*=0x0) returned 0x80004002 [0224.570] WbemLocator:IUnknown:AddRef (This=0x5b4d40) returned 0x3 [0224.570] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4d40, riid=0x6bdb0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x544e9dc | out: ppvObject=0x544e9dc*=0x0) returned 0x80004002 [0224.570] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4d40, riid=0x6bdb015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x544e98c | out: ppvObject=0x544e98c*=0x0) returned 0x80004002 [0224.570] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4d40, riid=0x6bc840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x544e998 | out: ppvObject=0x544e998*=0x5b4c9c) returned 0x0 [0224.570] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5b4c9c, riid=0x6bc76c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x544e9a0 | out: pCid=0x544e9a0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0224.570] WbemLocator:IUnknown:Release (This=0x5b4c9c) returned 0x3 [0224.570] CoGetContextToken (in: pToken=0x544e9f8 | out: pToken=0x544e9f8) returned 0x0 [0224.570] CoGetContextToken (in: pToken=0x544ee00 | out: pToken=0x544ee00) returned 0x0 [0224.570] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4d40, riid=0x6bdb0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x544ee90 | out: ppvObject=0x544ee90*=0x5b4d24) returned 0x0 [0224.570] WbemLocator:IRpcOptions:Query (in: This=0x5b4d24, pPrx=0x5b4d40, dwProperty=2, pdwValue=0x544eeb8 | out: pdwValue=0x544eeb8) returned 0x80004002 [0224.570] WbemLocator:IUnknown:Release (This=0x5b4d24) returned 0x3 [0224.571] WbemLocator:IUnknown:Release (This=0x5b4d40) returned 0x2 [0224.571] CoGetContextToken (in: pToken=0x544f3d8 | out: pToken=0x544f3d8) returned 0x0 [0224.571] CoGetContextToken (in: pToken=0x544f338 | out: pToken=0x544f338) returned 0x0 [0224.571] WbemLocator:IUnknown:QueryInterface (in: This=0x5b4d40, riid=0x544f408*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x544f404 | out: ppvObject=0x544f404*=0x5b29c0) returned 0x0 [0224.571] WbemLocator:IUnknown:AddRef (This=0x5b29c0) returned 0x4 [0224.571] WbemLocator:IUnknown:Release (This=0x5b29c0) returned 0x3 [0224.571] WbemLocator:IUnknown:Release (This=0x5b29c0) returned 0x2 [0224.571] SysStringLen (param_1=0x0) returned 0x0 [0224.571] CoUninitialize () Thread: id = 140 os_tid = 0x1388 [0227.497] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0227.497] RoInitialize () returned 0x1 [0227.497] RoUninitialize () returned 0x0 [0227.498] ResetEvent (hEvent=0x364) returned 1 Thread: id = 141 os_tid = 0x8b8 Process: id = "3" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x7534a000" os_pid = "0x364" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x214" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000ac37" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 856 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 857 start_va = 0x20000 end_va = 0x21fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 858 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 859 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 860 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 861 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 862 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 863 start_va = 0x100000 end_va = 0x100fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netmsg.dll" filename = "\\Windows\\System32\\netmsg.dll" (normalized: "c:\\windows\\system32\\netmsg.dll") Region: id = 864 start_va = 0x110000 end_va = 0x110fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 865 start_va = 0x120000 end_va = 0x120fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 866 start_va = 0x140000 end_va = 0x141fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 867 start_va = 0x150000 end_va = 0x151fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 868 start_va = 0x170000 end_va = 0x176fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 869 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 870 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 871 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 872 start_va = 0x1b0000 end_va = 0x1b6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 873 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 874 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 875 start_va = 0x1f0000 end_va = 0x1f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 876 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 877 start_va = 0x400000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 878 start_va = 0x500000 end_va = 0x5bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 879 start_va = 0x5c0000 end_va = 0x747fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 880 start_va = 0x750000 end_va = 0x750fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000750000" filename = "" Region: id = 881 start_va = 0x760000 end_va = 0x760fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000760000" filename = "" Region: id = 882 start_va = 0x770000 end_va = 0x773fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 883 start_va = 0x780000 end_va = 0x783fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 884 start_va = 0x790000 end_va = 0x796fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 885 start_va = 0x7a0000 end_va = 0x7e4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000005.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db") Region: id = 886 start_va = 0x800000 end_va = 0x8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 887 start_va = 0x900000 end_va = 0xa80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000900000" filename = "" Region: id = 888 start_va = 0xa90000 end_va = 0xb4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a90000" filename = "" Region: id = 889 start_va = 0xb50000 end_va = 0xf4afff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b50000" filename = "" Region: id = 890 start_va = 0xf50000 end_va = 0xfcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f50000" filename = "" Region: id = 891 start_va = 0x10b0000 end_va = 0x10b6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010b0000" filename = "" Region: id = 892 start_va = 0x10d0000 end_va = 0x10d6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010d0000" filename = "" Region: id = 893 start_va = 0x1100000 end_va = 0x1106fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001100000" filename = "" Region: id = 894 start_va = 0x1110000 end_va = 0x115efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001110000" filename = "" Region: id = 895 start_va = 0x1180000 end_va = 0x1186fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001180000" filename = "" Region: id = 896 start_va = 0x1200000 end_va = 0x12fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001200000" filename = "" Region: id = 897 start_va = 0x1300000 end_va = 0x13fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001300000" filename = "" Region: id = 898 start_va = 0x1400000 end_va = 0x14fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001400000" filename = "" Region: id = 899 start_va = 0x1500000 end_va = 0x15fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001500000" filename = "" Region: id = 900 start_va = 0x1600000 end_va = 0x1936fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 901 start_va = 0x1940000 end_va = 0x1a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001940000" filename = "" Region: id = 902 start_va = 0x1a40000 end_va = 0x1b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a40000" filename = "" Region: id = 903 start_va = 0x1b40000 end_va = 0x1c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b40000" filename = "" Region: id = 904 start_va = 0x1c40000 end_va = 0x1ccdfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 905 start_va = 0x1d40000 end_va = 0x1e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d40000" filename = "" Region: id = 906 start_va = 0x1e40000 end_va = 0x1f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 907 start_va = 0x1f40000 end_va = 0x203ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f40000" filename = "" Region: id = 908 start_va = 0x2040000 end_va = 0x20bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002040000" filename = "" Region: id = 909 start_va = 0x2100000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 910 start_va = 0x2200000 end_va = 0x22fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 911 start_va = 0x2300000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 912 start_va = 0x2400000 end_va = 0x24fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 913 start_va = 0x2500000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 914 start_va = 0x2600000 end_va = 0x267ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 915 start_va = 0x2680000 end_va = 0x26fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002680000" filename = "" Region: id = 916 start_va = 0x2700000 end_va = 0x27fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002700000" filename = "" Region: id = 917 start_va = 0x2800000 end_va = 0x28fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002800000" filename = "" Region: id = 918 start_va = 0x2900000 end_va = 0x29fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 919 start_va = 0x2a00000 end_va = 0x2afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 920 start_va = 0x2b00000 end_va = 0x2bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b00000" filename = "" Region: id = 921 start_va = 0x2c00000 end_va = 0x2cdffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 922 start_va = 0x2ce0000 end_va = 0x2ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ce0000" filename = "" Region: id = 923 start_va = 0x2de0000 end_va = 0x2edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002de0000" filename = "" Region: id = 924 start_va = 0x2ee0000 end_va = 0x2fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 925 start_va = 0x3000000 end_va = 0x30fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 926 start_va = 0x3100000 end_va = 0x317ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003100000" filename = "" Region: id = 927 start_va = 0x3180000 end_va = 0x31fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003180000" filename = "" Region: id = 928 start_va = 0x3200000 end_va = 0x3206fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003200000" filename = "" Region: id = 929 start_va = 0x3210000 end_va = 0x330ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003210000" filename = "" Region: id = 930 start_va = 0x3310000 end_va = 0x340ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003310000" filename = "" Region: id = 931 start_va = 0x3610000 end_va = 0x368ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003610000" filename = "" Region: id = 932 start_va = 0x36f0000 end_va = 0x36f6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000036f0000" filename = "" Region: id = 933 start_va = 0x3700000 end_va = 0x377ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003700000" filename = "" Region: id = 934 start_va = 0x3900000 end_va = 0x39fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003900000" filename = "" Region: id = 935 start_va = 0x3a00000 end_va = 0x3afffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003a00000" filename = "" Region: id = 936 start_va = 0x3b00000 end_va = 0x3bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b00000" filename = "" Region: id = 937 start_va = 0x3c00000 end_va = 0x3cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003c00000" filename = "" Region: id = 938 start_va = 0x3d00000 end_va = 0x3dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003d00000" filename = "" Region: id = 939 start_va = 0x3e00000 end_va = 0x3efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e00000" filename = "" Region: id = 940 start_va = 0x3f00000 end_va = 0x3ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f00000" filename = "" Region: id = 941 start_va = 0x4000000 end_va = 0x40fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004000000" filename = "" Region: id = 942 start_va = 0x4100000 end_va = 0x41fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004100000" filename = "" Region: id = 943 start_va = 0x4200000 end_va = 0x42fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004200000" filename = "" Region: id = 944 start_va = 0x4300000 end_va = 0x43fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004300000" filename = "" Region: id = 945 start_va = 0x4400000 end_va = 0x44fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004400000" filename = "" Region: id = 946 start_va = 0x4500000 end_va = 0x45fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004500000" filename = "" Region: id = 947 start_va = 0x4600000 end_va = 0x46fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004600000" filename = "" Region: id = 948 start_va = 0x4700000 end_va = 0x47fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004700000" filename = "" Region: id = 949 start_va = 0x4800000 end_va = 0x48fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004800000" filename = "" Region: id = 950 start_va = 0x4900000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004900000" filename = "" Region: id = 951 start_va = 0x4a00000 end_va = 0x4afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a00000" filename = "" Region: id = 952 start_va = 0x4b00000 end_va = 0x4b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 953 start_va = 0x4c40000 end_va = 0x4c40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usocore.dll.mui" filename = "\\Windows\\System32\\en-US\\usocore.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\usocore.dll.mui") Region: id = 954 start_va = 0x4c70000 end_va = 0x4c71fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004c70000" filename = "" Region: id = 955 start_va = 0x4c80000 end_va = 0x4c97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c80000" filename = "" Region: id = 956 start_va = 0x4d00000 end_va = 0x4d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 957 start_va = 0x4d80000 end_va = 0x4d80fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msxml6r.dll" filename = "\\Windows\\System32\\msxml6r.dll" (normalized: "c:\\windows\\system32\\msxml6r.dll") Region: id = 958 start_va = 0x4e90000 end_va = 0x4e91fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "activeds.dll.mui" filename = "\\Windows\\System32\\en-US\\activeds.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\activeds.dll.mui") Region: id = 959 start_va = 0x4eb0000 end_va = 0x4eb0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004eb0000" filename = "" Region: id = 960 start_va = 0x4ec0000 end_va = 0x4ec4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll" filename = "\\Windows\\System32\\winnlsres.dll" (normalized: "c:\\windows\\system32\\winnlsres.dll") Region: id = 961 start_va = 0x4ed0000 end_va = 0x4ed6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ed0000" filename = "" Region: id = 962 start_va = 0x4ee0000 end_va = 0x4eeffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll.mui" filename = "\\Windows\\System32\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winnlsres.dll.mui") Region: id = 963 start_va = 0x4f00000 end_va = 0x4ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f00000" filename = "" Region: id = 964 start_va = 0x5000000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005000000" filename = "" Region: id = 965 start_va = 0x5200000 end_va = 0x52fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005200000" filename = "" Region: id = 966 start_va = 0x5300000 end_va = 0x53fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005300000" filename = "" Region: id = 967 start_va = 0x5400000 end_va = 0x54fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005400000" filename = "" Region: id = 968 start_va = 0x5500000 end_va = 0x55fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005500000" filename = "" Region: id = 969 start_va = 0x5620000 end_va = 0x5630fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1256.nls" filename = "\\Windows\\System32\\C_1256.NLS" (normalized: "c:\\windows\\system32\\c_1256.nls") Region: id = 970 start_va = 0x5640000 end_va = 0x5650fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1251.nls" filename = "\\Windows\\System32\\C_1251.NLS" (normalized: "c:\\windows\\system32\\c_1251.nls") Region: id = 971 start_va = 0x5660000 end_va = 0x5670fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1254.nls" filename = "\\Windows\\System32\\C_1254.NLS" (normalized: "c:\\windows\\system32\\c_1254.nls") Region: id = 972 start_va = 0x5680000 end_va = 0x5690fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1250.nls" filename = "\\Windows\\System32\\C_1250.NLS" (normalized: "c:\\windows\\system32\\c_1250.nls") Region: id = 973 start_va = 0x56a0000 end_va = 0x56b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1253.nls" filename = "\\Windows\\System32\\C_1253.NLS" (normalized: "c:\\windows\\system32\\c_1253.nls") Region: id = 974 start_va = 0x56c0000 end_va = 0x56d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1257.nls" filename = "\\Windows\\System32\\C_1257.NLS" (normalized: "c:\\windows\\system32\\c_1257.nls") Region: id = 975 start_va = 0x56f0000 end_va = 0x56f6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000056f0000" filename = "" Region: id = 976 start_va = 0x5700000 end_va = 0x57fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005700000" filename = "" Region: id = 977 start_va = 0x5800000 end_va = 0x58fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005800000" filename = "" Region: id = 978 start_va = 0x5a00000 end_va = 0x5a10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1255.nls" filename = "\\Windows\\System32\\C_1255.NLS" (normalized: "c:\\windows\\system32\\c_1255.nls") Region: id = 979 start_va = 0x5a20000 end_va = 0x5a30fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_874.nls" filename = "\\Windows\\System32\\C_874.NLS" (normalized: "c:\\windows\\system32\\c_874.nls") Region: id = 980 start_va = 0x5a50000 end_va = 0x5acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a50000" filename = "" Region: id = 981 start_va = 0x5ad0000 end_va = 0x5b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ad0000" filename = "" Region: id = 982 start_va = 0x5b50000 end_va = 0x5bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 983 start_va = 0x5bd0000 end_va = 0x5bd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005bd0000" filename = "" Region: id = 984 start_va = 0x5be0000 end_va = 0x5bf0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1258.nls" filename = "\\Windows\\System32\\C_1258.NLS" (normalized: "c:\\windows\\system32\\c_1258.nls") Region: id = 985 start_va = 0x5c10000 end_va = 0x5c37fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_932.nls" filename = "\\Windows\\System32\\C_932.NLS" (normalized: "c:\\windows\\system32\\c_932.nls") Region: id = 986 start_va = 0x5c40000 end_va = 0x5c70fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_949.nls" filename = "\\Windows\\System32\\C_949.NLS" (normalized: "c:\\windows\\system32\\c_949.nls") Region: id = 987 start_va = 0x5c80000 end_va = 0x5cb0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_936.nls" filename = "\\Windows\\System32\\C_936.NLS" (normalized: "c:\\windows\\system32\\c_936.nls") Region: id = 988 start_va = 0x5cc0000 end_va = 0x5cf0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_950.nls" filename = "\\Windows\\System32\\C_950.NLS" (normalized: "c:\\windows\\system32\\c_950.nls") Region: id = 989 start_va = 0x5d10000 end_va = 0x5e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d10000" filename = "" Region: id = 990 start_va = 0x5e10000 end_va = 0x5f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e10000" filename = "" Region: id = 991 start_va = 0x5f10000 end_va = 0x5f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 992 start_va = 0x5f90000 end_va = 0x608ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f90000" filename = "" Region: id = 993 start_va = 0x6110000 end_va = 0x620ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006110000" filename = "" Region: id = 994 start_va = 0x6310000 end_va = 0x640ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006310000" filename = "" Region: id = 995 start_va = 0x6410000 end_va = 0x650ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006410000" filename = "" Region: id = 996 start_va = 0x6510000 end_va = 0x660ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006510000" filename = "" Region: id = 997 start_va = 0x6610000 end_va = 0x670ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006610000" filename = "" Region: id = 998 start_va = 0x6710000 end_va = 0x680ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006710000" filename = "" Region: id = 999 start_va = 0x6900000 end_va = 0x69fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006900000" filename = "" Region: id = 1000 start_va = 0x6a00000 end_va = 0x6afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006a00000" filename = "" Region: id = 1001 start_va = 0x6b00000 end_va = 0x6bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006b00000" filename = "" Region: id = 1002 start_va = 0x6c00000 end_va = 0x6cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006c00000" filename = "" Region: id = 1003 start_va = 0x6e00000 end_va = 0x6efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006e00000" filename = "" Region: id = 1004 start_va = 0x7000000 end_va = 0x70fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007000000" filename = "" Region: id = 1005 start_va = 0x7200000 end_va = 0x72fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007200000" filename = "" Region: id = 1006 start_va = 0x7300000 end_va = 0x73fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007300000" filename = "" Region: id = 1007 start_va = 0x7400000 end_va = 0x74fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007400000" filename = "" Region: id = 1008 start_va = 0x7500000 end_va = 0x75fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007500000" filename = "" Region: id = 1009 start_va = 0x7720000 end_va = 0x781ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007720000" filename = "" Region: id = 1010 start_va = 0x7b20000 end_va = 0x7c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007b20000" filename = "" Region: id = 1011 start_va = 0x7d20000 end_va = 0x7e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007d20000" filename = "" Region: id = 1012 start_va = 0x8020000 end_va = 0x811ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008020000" filename = "" Region: id = 1013 start_va = 0x9120000 end_va = 0x921ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009120000" filename = "" Region: id = 1014 start_va = 0x9220000 end_va = 0x931ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009220000" filename = "" Region: id = 1015 start_va = 0x9320000 end_va = 0x941ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009320000" filename = "" Region: id = 1016 start_va = 0x9420000 end_va = 0x951ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009420000" filename = "" Region: id = 1017 start_va = 0x9520000 end_va = 0x961ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009520000" filename = "" Region: id = 1018 start_va = 0x9620000 end_va = 0x971ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009620000" filename = "" Region: id = 1019 start_va = 0xa720000 end_va = 0xa81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a720000" filename = "" Region: id = 1020 start_va = 0xa820000 end_va = 0xa91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000a820000" filename = "" Region: id = 1021 start_va = 0xae20000 end_va = 0xaf1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ae20000" filename = "" Region: id = 1022 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1023 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 1024 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 1025 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 1026 start_va = 0x7ff73cbd0000 end_va = 0x7ff73cbdcfff monitored = 0 entry_point = 0x7ff73cbd3980 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 1027 start_va = 0x7ffd8cf10000 end_va = 0x7ffd8d1bffff monitored = 0 entry_point = 0x7ffd8cf11cf0 region_type = mapped_file name = "netshell.dll" filename = "\\Windows\\System32\\netshell.dll" (normalized: "c:\\windows\\system32\\netshell.dll") Region: id = 1028 start_va = 0x7ffd8eac0000 end_va = 0x7ffd8eb03fff monitored = 0 entry_point = 0x7ffd8eae83e0 region_type = mapped_file name = "updatehandlers.dll" filename = "\\Windows\\System32\\updatehandlers.dll" (normalized: "c:\\windows\\system32\\updatehandlers.dll") Region: id = 1029 start_va = 0x7ffd8ef10000 end_va = 0x7ffd8ef6cfff monitored = 0 entry_point = 0x7ffd8ef3e510 region_type = mapped_file name = "usocore.dll" filename = "\\Windows\\System32\\usocore.dll" (normalized: "c:\\windows\\system32\\usocore.dll") Region: id = 1030 start_va = 0x7ffd96d00000 end_va = 0x7ffd96d13fff monitored = 0 entry_point = 0x7ffd96d03710 region_type = mapped_file name = "mskeyprotect.dll" filename = "\\Windows\\System32\\mskeyprotect.dll" (normalized: "c:\\windows\\system32\\mskeyprotect.dll") Region: id = 1031 start_va = 0x7ffd96d20000 end_va = 0x7ffd96d47fff monitored = 0 entry_point = 0x7ffd96d2efc0 region_type = mapped_file name = "dssenh.dll" filename = "\\Windows\\System32\\dssenh.dll" (normalized: "c:\\windows\\system32\\dssenh.dll") Region: id = 1032 start_va = 0x7ffd96db0000 end_va = 0x7ffd96dcdfff monitored = 0 entry_point = 0x7ffd96dbef80 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\System32\\ncryptsslp.dll" (normalized: "c:\\windows\\system32\\ncryptsslp.dll") Region: id = 1033 start_va = 0x7ffd96dd0000 end_va = 0x7ffd96e4ffff monitored = 0 entry_point = 0x7ffd96dfd280 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 1034 start_va = 0x7ffd96e50000 end_va = 0x7ffd96e85fff monitored = 0 entry_point = 0x7ffd96e527f0 region_type = mapped_file name = "windows.networking.hostname.dll" filename = "\\Windows\\System32\\Windows.Networking.HostName.dll" (normalized: "c:\\windows\\system32\\windows.networking.hostname.dll") Region: id = 1035 start_va = 0x7ffd96ef0000 end_va = 0x7ffd96f05fff monitored = 0 entry_point = 0x7ffd96ef1d50 region_type = mapped_file name = "wwapi.dll" filename = "\\Windows\\System32\\wwapi.dll" (normalized: "c:\\windows\\system32\\wwapi.dll") Region: id = 1036 start_va = 0x7ffd96fc0000 end_va = 0x7ffd96fd0fff monitored = 0 entry_point = 0x7ffd96fc7480 region_type = mapped_file name = "tetheringclient.dll" filename = "\\Windows\\System32\\tetheringclient.dll" (normalized: "c:\\windows\\system32\\tetheringclient.dll") Region: id = 1037 start_va = 0x7ffd96fe0000 end_va = 0x7ffd97063fff monitored = 0 entry_point = 0x7ffd96ff8d50 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 1038 start_va = 0x7ffd97150000 end_va = 0x7ffd97165fff monitored = 0 entry_point = 0x7ffd971555e0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1039 start_va = 0x7ffd97170000 end_va = 0x7ffd97245fff monitored = 0 entry_point = 0x7ffd9719a800 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 1040 start_va = 0x7ffd97250000 end_va = 0x7ffd972b3fff monitored = 0 entry_point = 0x7ffd9726bed0 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 1041 start_va = 0x7ffd972c0000 end_va = 0x7ffd972e4fff monitored = 0 entry_point = 0x7ffd972c9900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1042 start_va = 0x7ffd972f0000 end_va = 0x7ffd97303fff monitored = 0 entry_point = 0x7ffd972f1800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1043 start_va = 0x7ffd97310000 end_va = 0x7ffd97325fff monitored = 0 entry_point = 0x7ffd97311af0 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 1044 start_va = 0x7ffd97330000 end_va = 0x7ffd97349fff monitored = 0 entry_point = 0x7ffd97332330 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 1045 start_va = 0x7ffd97350000 end_va = 0x7ffd97445fff monitored = 0 entry_point = 0x7ffd97389590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1046 start_va = 0x7ffd97450000 end_va = 0x7ffd974c3fff monitored = 0 entry_point = 0x7ffd97465eb0 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 1047 start_va = 0x7ffd974d0000 end_va = 0x7ffd97606fff monitored = 0 entry_point = 0x7ffd97510480 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 1048 start_va = 0x7ffd97630000 end_va = 0x7ffd97640fff monitored = 0 entry_point = 0x7ffd97632fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1049 start_va = 0x7ffd97650000 end_va = 0x7ffd9766dfff monitored = 0 entry_point = 0x7ffd97653a40 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 1050 start_va = 0x7ffd97670000 end_va = 0x7ffd976f1fff monitored = 0 entry_point = 0x7ffd97672a10 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 1051 start_va = 0x7ffd98150000 end_va = 0x7ffd9815efff monitored = 0 entry_point = 0x7ffd98154960 region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 1052 start_va = 0x7ffd98160000 end_va = 0x7ffd981a5fff monitored = 0 entry_point = 0x7ffd981679a0 region_type = mapped_file name = "adsldp.dll" filename = "\\Windows\\System32\\adsldp.dll" (normalized: "c:\\windows\\system32\\adsldp.dll") Region: id = 1053 start_va = 0x7ffd981b0000 end_va = 0x7ffd981effff monitored = 0 entry_point = 0x7ffd981bcbe0 region_type = mapped_file name = "adsldpc.dll" filename = "\\Windows\\System32\\adsldpc.dll" (normalized: "c:\\windows\\system32\\adsldpc.dll") Region: id = 1054 start_va = 0x7ffd981f0000 end_va = 0x7ffd98236fff monitored = 0 entry_point = 0x7ffd981f1d10 region_type = mapped_file name = "activeds.dll" filename = "\\Windows\\System32\\activeds.dll" (normalized: "c:\\windows\\system32\\activeds.dll") Region: id = 1055 start_va = 0x7ffd98290000 end_va = 0x7ffd9829cfff monitored = 0 entry_point = 0x7ffd98291420 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 1056 start_va = 0x7ffd984f0000 end_va = 0x7ffd98531fff monitored = 0 entry_point = 0x7ffd984f3670 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 1057 start_va = 0x7ffd985b0000 end_va = 0x7ffd985cefff monitored = 0 entry_point = 0x7ffd985b37e0 region_type = mapped_file name = "netsetupapi.dll" filename = "\\Windows\\System32\\NetSetupApi.dll" (normalized: "c:\\windows\\system32\\netsetupapi.dll") Region: id = 1058 start_va = 0x7ffd985d0000 end_va = 0x7ffd98648fff monitored = 0 entry_point = 0x7ffd985d76a0 region_type = mapped_file name = "netsetupshim.dll" filename = "\\Windows\\System32\\NetSetupShim.dll" (normalized: "c:\\windows\\system32\\netsetupshim.dll") Region: id = 1059 start_va = 0x7ffd98830000 end_va = 0x7ffd98847fff monitored = 0 entry_point = 0x7ffd98832000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 1060 start_va = 0x7ffd98850000 end_va = 0x7ffd989d1fff monitored = 0 entry_point = 0x7ffd988682a0 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 1061 start_va = 0x7ffd989e0000 end_va = 0x7ffd989f7fff monitored = 0 entry_point = 0x7ffd989e4e10 region_type = mapped_file name = "adhsvc.dll" filename = "\\Windows\\System32\\adhsvc.dll" (normalized: "c:\\windows\\system32\\adhsvc.dll") Region: id = 1062 start_va = 0x7ffd98a00000 end_va = 0x7ffd98a24fff monitored = 0 entry_point = 0x7ffd98a05ca0 region_type = mapped_file name = "httpprxm.dll" filename = "\\Windows\\System32\\httpprxm.dll" (normalized: "c:\\windows\\system32\\httpprxm.dll") Region: id = 1063 start_va = 0x7ffd98b40000 end_va = 0x7ffd98be2fff monitored = 0 entry_point = 0x7ffd98b42c10 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 1064 start_va = 0x7ffd98bf0000 end_va = 0x7ffd98c41fff monitored = 0 entry_point = 0x7ffd98bf5770 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 1065 start_va = 0x7ffd98c50000 end_va = 0x7ffd98c7dfff monitored = 1 entry_point = 0x7ffd98c52300 region_type = mapped_file name = "wmidcom.dll" filename = "\\Windows\\System32\\wmidcom.dll" (normalized: "c:\\windows\\system32\\wmidcom.dll") Region: id = 1066 start_va = 0x7ffd98c80000 end_va = 0x7ffd98cddfff monitored = 0 entry_point = 0x7ffd98c85080 region_type = mapped_file name = "miutils.dll" filename = "\\Windows\\System32\\miutils.dll" (normalized: "c:\\windows\\system32\\miutils.dll") Region: id = 1067 start_va = 0x7ffd98ce0000 end_va = 0x7ffd98cfffff monitored = 0 entry_point = 0x7ffd98ce1f50 region_type = mapped_file name = "mi.dll" filename = "\\Windows\\System32\\mi.dll" (normalized: "c:\\windows\\system32\\mi.dll") Region: id = 1068 start_va = 0x7ffd98d00000 end_va = 0x7ffd98d08fff monitored = 0 entry_point = 0x7ffd98d018f0 region_type = mapped_file name = "sscoreext.dll" filename = "\\Windows\\System32\\sscoreext.dll" (normalized: "c:\\windows\\system32\\sscoreext.dll") Region: id = 1069 start_va = 0x7ffd98d10000 end_va = 0x7ffd98d20fff monitored = 0 entry_point = 0x7ffd98d11d30 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 1070 start_va = 0x7ffd98d30000 end_va = 0x7ffd98d70fff monitored = 0 entry_point = 0x7ffd98d33750 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 1071 start_va = 0x7ffd98d80000 end_va = 0x7ffd98e72fff monitored = 0 entry_point = 0x7ffd98da5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1072 start_va = 0x7ffd9b190000 end_va = 0x7ffd9b1dbfff monitored = 0 entry_point = 0x7ffd9b1a5310 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 1073 start_va = 0x7ffd9b2a0000 end_va = 0x7ffd9b2a9fff monitored = 0 entry_point = 0x7ffd9b2a1350 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1074 start_va = 0x7ffd9b340000 end_va = 0x7ffd9b3befff monitored = 0 entry_point = 0x7ffd9b357110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1075 start_va = 0x7ffd9b3c0000 end_va = 0x7ffd9b3fbfff monitored = 0 entry_point = 0x7ffd9b3c6aa0 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 1076 start_va = 0x7ffd9b400000 end_va = 0x7ffd9b40bfff monitored = 0 entry_point = 0x7ffd9b4035c0 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1077 start_va = 0x7ffd9ca20000 end_va = 0x7ffd9ca28fff monitored = 0 entry_point = 0x7ffd9ca221d0 region_type = mapped_file name = "httpprxc.dll" filename = "\\Windows\\System32\\httpprxc.dll" (normalized: "c:\\windows\\system32\\httpprxc.dll") Region: id = 1078 start_va = 0x7ffd9ca30000 end_va = 0x7ffd9ca64fff monitored = 0 entry_point = 0x7ffd9ca3a270 region_type = mapped_file name = "fwpolicyiomgr.dll" filename = "\\Windows\\System32\\fwpolicyiomgr.dll" (normalized: "c:\\windows\\system32\\fwpolicyiomgr.dll") Region: id = 1079 start_va = 0x7ffd9cb70000 end_va = 0x7ffd9cde9fff monitored = 0 entry_point = 0x7ffd9cb8a7a0 region_type = mapped_file name = "msxml6.dll" filename = "\\Windows\\System32\\msxml6.dll" (normalized: "c:\\windows\\system32\\msxml6.dll") Region: id = 1080 start_va = 0x7ffd9d000000 end_va = 0x7ffd9d00ffff monitored = 0 entry_point = 0x7ffd9d001690 region_type = mapped_file name = "wups.dll" filename = "\\Windows\\System32\\wups.dll" (normalized: "c:\\windows\\system32\\wups.dll") Region: id = 1081 start_va = 0x7ffd9da20000 end_va = 0x7ffd9da41fff monitored = 0 entry_point = 0x7ffd9da32540 region_type = mapped_file name = "updatepolicy.dll" filename = "\\Windows\\System32\\updatepolicy.dll" (normalized: "c:\\windows\\system32\\updatepolicy.dll") Region: id = 1082 start_va = 0x7ffd9da50000 end_va = 0x7ffd9db24fff monitored = 0 entry_point = 0x7ffd9da6cf80 region_type = mapped_file name = "wuapi.dll" filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll") Region: id = 1083 start_va = 0x7ffd9e610000 end_va = 0x7ffd9e61ffff monitored = 0 entry_point = 0x7ffd9e611700 region_type = mapped_file name = "proximityservicepal.dll" filename = "\\Windows\\System32\\ProximityServicePal.dll" (normalized: "c:\\windows\\system32\\proximityservicepal.dll") Region: id = 1084 start_va = 0x7ffd9e620000 end_va = 0x7ffd9e628fff monitored = 0 entry_point = 0x7ffd9e621ed0 region_type = mapped_file name = "proximitycommonpal.dll" filename = "\\Windows\\System32\\ProximityCommonPal.dll" (normalized: "c:\\windows\\system32\\proximitycommonpal.dll") Region: id = 1085 start_va = 0x7ffd9e630000 end_va = 0x7ffd9e65cfff monitored = 0 entry_point = 0x7ffd9e632290 region_type = mapped_file name = "proximitycommon.dll" filename = "\\Windows\\System32\\ProximityCommon.dll" (normalized: "c:\\windows\\system32\\proximitycommon.dll") Region: id = 1086 start_va = 0x7ffd9e660000 end_va = 0x7ffd9e6b1fff monitored = 0 entry_point = 0x7ffd9e6638e0 region_type = mapped_file name = "proximityservice.dll" filename = "\\Windows\\System32\\ProximityService.dll" (normalized: "c:\\windows\\system32\\proximityservice.dll") Region: id = 1087 start_va = 0x7ffd9ece0000 end_va = 0x7ffd9ece9fff monitored = 0 entry_point = 0x7ffd9ece14c0 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 1088 start_va = 0x7ffd9f020000 end_va = 0x7ffd9f031fff monitored = 0 entry_point = 0x7ffd9f023580 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 1089 start_va = 0x7ffd9f0b0000 end_va = 0x7ffd9f0cafff monitored = 0 entry_point = 0x7ffd9f0b1040 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 1090 start_va = 0x7ffd9f1b0000 end_va = 0x7ffd9f1c4fff monitored = 0 entry_point = 0x7ffd9f1b2dc0 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll") Region: id = 1091 start_va = 0x7ffd9f1d0000 end_va = 0x7ffd9f1e2fff monitored = 0 entry_point = 0x7ffd9f1d1b10 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 1092 start_va = 0x7ffd9f1f0000 end_va = 0x7ffd9f28ffff monitored = 0 entry_point = 0x7ffd9f260910 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 1093 start_va = 0x7ffd9f290000 end_va = 0x7ffd9f2b5fff monitored = 0 entry_point = 0x7ffd9f2a9020 region_type = mapped_file name = "devicemetadataretrievalclient.dll" filename = "\\Windows\\System32\\DeviceMetadataRetrievalClient.dll" (normalized: "c:\\windows\\system32\\devicemetadataretrievalclient.dll") Region: id = 1094 start_va = 0x7ffd9f360000 end_va = 0x7ffd9f391fff monitored = 0 entry_point = 0x7ffd9f36b0c0 region_type = mapped_file name = "shacct.dll" filename = "\\Windows\\System32\\shacct.dll" (normalized: "c:\\windows\\system32\\shacct.dll") Region: id = 1095 start_va = 0x7ffd9f4c0000 end_va = 0x7ffd9f4d6fff monitored = 0 entry_point = 0x7ffd9f4c7520 region_type = mapped_file name = "usoapi.dll" filename = "\\Windows\\System32\\usoapi.dll" (normalized: "c:\\windows\\system32\\usoapi.dll") Region: id = 1096 start_va = 0x7ffd9f590000 end_va = 0x7ffd9f5a0fff monitored = 0 entry_point = 0x7ffd9f5928d0 region_type = mapped_file name = "credentialmigrationhandler.dll" filename = "\\Windows\\System32\\CredentialMigrationHandler.dll" (normalized: "c:\\windows\\system32\\credentialmigrationhandler.dll") Region: id = 1097 start_va = 0x7ffd9f5c0000 end_va = 0x7ffd9f5dcfff monitored = 0 entry_point = 0x7ffd9f5c4f60 region_type = mapped_file name = "appinfo.dll" filename = "\\Windows\\System32\\appinfo.dll" (normalized: "c:\\windows\\system32\\appinfo.dll") Region: id = 1098 start_va = 0x7ffd9f5e0000 end_va = 0x7ffd9f61efff monitored = 0 entry_point = 0x7ffd9f6082d0 region_type = mapped_file name = "tcpipcfg.dll" filename = "\\Windows\\System32\\tcpipcfg.dll" (normalized: "c:\\windows\\system32\\tcpipcfg.dll") Region: id = 1099 start_va = 0x7ffd9f620000 end_va = 0x7ffd9f72efff monitored = 0 entry_point = 0x7ffd9f65c010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 1100 start_va = 0x7ffd9f760000 end_va = 0x7ffd9f771fff monitored = 0 entry_point = 0x7ffd9f761a80 region_type = mapped_file name = "bitsproxy.dll" filename = "\\Windows\\System32\\BitsProxy.dll" (normalized: "c:\\windows\\system32\\bitsproxy.dll") Region: id = 1101 start_va = 0x7ffd9f850000 end_va = 0x7ffd9f8b6fff monitored = 0 entry_point = 0x7ffd9f85b160 region_type = mapped_file name = "upnp.dll" filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll") Region: id = 1102 start_va = 0x7ffd9f9c0000 end_va = 0x7ffd9f9d3fff monitored = 0 entry_point = 0x7ffd9f9c2a00 region_type = mapped_file name = "bitsigd.dll" filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll") Region: id = 1103 start_va = 0x7ffda0000000 end_va = 0x7ffda011cfff monitored = 0 entry_point = 0x7ffda002fe60 region_type = mapped_file name = "qmgr.dll" filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll") Region: id = 1104 start_va = 0x7ffda0120000 end_va = 0x7ffda012cfff monitored = 0 entry_point = 0x7ffda0125020 region_type = mapped_file name = "devicedriverretrievalclient.dll" filename = "\\Windows\\System32\\DeviceDriverRetrievalClient.dll" (normalized: "c:\\windows\\system32\\devicedriverretrievalclient.dll") Region: id = 1105 start_va = 0x7ffda0130000 end_va = 0x7ffda0153fff monitored = 0 entry_point = 0x7ffda0146390 region_type = mapped_file name = "devpropmgr.dll" filename = "\\Windows\\System32\\DevPropMgr.dll" (normalized: "c:\\windows\\system32\\devpropmgr.dll") Region: id = 1106 start_va = 0x7ffda0160000 end_va = 0x7ffda01f9fff monitored = 0 entry_point = 0x7ffda017ada0 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 1107 start_va = 0x7ffda0290000 end_va = 0x7ffda02aefff monitored = 0 entry_point = 0x7ffda0294960 region_type = mapped_file name = "ncprov.dll" filename = "\\Windows\\System32\\wbem\\NCProv.dll" (normalized: "c:\\windows\\system32\\wbem\\ncprov.dll") Region: id = 1108 start_va = 0x7ffda02c0000 end_va = 0x7ffda02d7fff monitored = 0 entry_point = 0x7ffda02cb850 region_type = mapped_file name = "dmcmnutils.dll" filename = "\\Windows\\System32\\dmcmnutils.dll" (normalized: "c:\\windows\\system32\\dmcmnutils.dll") Region: id = 1109 start_va = 0x7ffda02f0000 end_va = 0x7ffda02fdfff monitored = 0 entry_point = 0x7ffda02f1460 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 1110 start_va = 0x7ffda0310000 end_va = 0x7ffda0376fff monitored = 0 entry_point = 0x7ffda03163e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1111 start_va = 0x7ffda0530000 end_va = 0x7ffda05effff monitored = 0 entry_point = 0x7ffda055fd20 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 1112 start_va = 0x7ffda0770000 end_va = 0x7ffda077afff monitored = 0 entry_point = 0x7ffda0771de0 region_type = mapped_file name = "bitsperf.dll" filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll") Region: id = 1113 start_va = 0x7ffda07a0000 end_va = 0x7ffda084dfff monitored = 0 entry_point = 0x7ffda07b80c0 region_type = mapped_file name = "windows.networking.connectivity.dll" filename = "\\Windows\\System32\\Windows.Networking.Connectivity.dll" (normalized: "c:\\windows\\system32\\windows.networking.connectivity.dll") Region: id = 1114 start_va = 0x7ffda0850000 end_va = 0x7ffda0861fff monitored = 0 entry_point = 0x7ffda0859260 region_type = mapped_file name = "rilproxy.dll" filename = "\\Windows\\System32\\rilproxy.dll" (normalized: "c:\\windows\\system32\\rilproxy.dll") Region: id = 1115 start_va = 0x7ffda0870000 end_va = 0x7ffda0920fff monitored = 0 entry_point = 0x7ffda08e88b0 region_type = mapped_file name = "cellularapi.dll" filename = "\\Windows\\System32\\CellularAPI.dll" (normalized: "c:\\windows\\system32\\cellularapi.dll") Region: id = 1116 start_va = 0x7ffda0930000 end_va = 0x7ffda0954fff monitored = 0 entry_point = 0x7ffda0942f20 region_type = mapped_file name = "wificonnapi.dll" filename = "\\Windows\\System32\\wificonnapi.dll" (normalized: "c:\\windows\\system32\\wificonnapi.dll") Region: id = 1117 start_va = 0x7ffda0960000 end_va = 0x7ffda0970fff monitored = 0 entry_point = 0x7ffda0967ea0 region_type = mapped_file name = "dcpapi.dll" filename = "\\Windows\\System32\\dcpapi.dll" (normalized: "c:\\windows\\system32\\dcpapi.dll") Region: id = 1118 start_va = 0x7ffda0980000 end_va = 0x7ffda0999fff monitored = 0 entry_point = 0x7ffda0982cf0 region_type = mapped_file name = "locationpelegacywinlocation.dll" filename = "\\Windows\\System32\\LocationPeLegacyWinLocation.dll" (normalized: "c:\\windows\\system32\\locationpelegacywinlocation.dll") Region: id = 1119 start_va = 0x7ffda09a0000 end_va = 0x7ffda09abfff monitored = 0 entry_point = 0x7ffda09a14d0 region_type = mapped_file name = "locationframeworkps.dll" filename = "\\Windows\\System32\\LocationFrameworkPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkps.dll") Region: id = 1120 start_va = 0x7ffda09b0000 end_va = 0x7ffda09c4fff monitored = 0 entry_point = 0x7ffda09b3460 region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 1121 start_va = 0x7ffda0aa0000 end_va = 0x7ffda0af4fff monitored = 0 entry_point = 0x7ffda0aa3fb0 region_type = mapped_file name = "policymanager.dll" filename = "\\Windows\\System32\\policymanager.dll" (normalized: "c:\\windows\\system32\\policymanager.dll") Region: id = 1122 start_va = 0x7ffda0b00000 end_va = 0x7ffda0b36fff monitored = 0 entry_point = 0x7ffda0b06020 region_type = mapped_file name = "gnssadapter.dll" filename = "\\Windows\\System32\\GnssAdapter.dll" (normalized: "c:\\windows\\system32\\gnssadapter.dll") Region: id = 1123 start_va = 0x7ffda0b40000 end_va = 0x7ffda0b5ffff monitored = 0 entry_point = 0x7ffda0b439a0 region_type = mapped_file name = "locationwinpalmisc.dll" filename = "\\Windows\\System32\\LocationWinPalMisc.dll" (normalized: "c:\\windows\\system32\\locationwinpalmisc.dll") Region: id = 1124 start_va = 0x7ffda0b60000 end_va = 0x7ffda0ba0fff monitored = 0 entry_point = 0x7ffda0b64840 region_type = mapped_file name = "usermgrproxy.dll" filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll") Region: id = 1125 start_va = 0x7ffda0bd0000 end_va = 0x7ffda0bd7fff monitored = 0 entry_point = 0x7ffda0bd13b0 region_type = mapped_file name = "dmiso8601utils.dll" filename = "\\Windows\\System32\\dmiso8601utils.dll" (normalized: "c:\\windows\\system32\\dmiso8601utils.dll") Region: id = 1126 start_va = 0x7ffda0d10000 end_va = 0x7ffda0d23fff monitored = 0 entry_point = 0x7ffda0d12d50 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 1127 start_va = 0x7ffda0de0000 end_va = 0x7ffda0df7fff monitored = 0 entry_point = 0x7ffda0de1b10 region_type = mapped_file name = "locationframeworkinternalps.dll" filename = "\\Windows\\System32\\LocationFrameworkInternalPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkinternalps.dll") Region: id = 1128 start_va = 0x7ffda1010000 end_va = 0x7ffda10a2fff monitored = 0 entry_point = 0x7ffda1019680 region_type = mapped_file name = "msvcp_win.dll" filename = "\\Windows\\System32\\msvcp_win.dll" (normalized: "c:\\windows\\system32\\msvcp_win.dll") Region: id = 1129 start_va = 0x7ffda11c0000 end_va = 0x7ffda11d8fff monitored = 0 entry_point = 0x7ffda11c4520 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1130 start_va = 0x7ffda1290000 end_va = 0x7ffda1357fff monitored = 0 entry_point = 0x7ffda12d13f0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1131 start_va = 0x7ffda1360000 end_va = 0x7ffda13c0fff monitored = 0 entry_point = 0x7ffda1364b50 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 1132 start_va = 0x7ffda13d0000 end_va = 0x7ffda154bfff monitored = 0 entry_point = 0x7ffda1421650 region_type = mapped_file name = "locationframework.dll" filename = "\\Windows\\System32\\LocationFramework.dll" (normalized: "c:\\windows\\system32\\locationframework.dll") Region: id = 1133 start_va = 0x7ffda1550000 end_va = 0x7ffda155afff monitored = 0 entry_point = 0x7ffda1551770 region_type = mapped_file name = "lfsvc.dll" filename = "\\Windows\\System32\\lfsvc.dll" (normalized: "c:\\windows\\system32\\lfsvc.dll") Region: id = 1134 start_va = 0x7ffda1560000 end_va = 0x7ffda158dfff monitored = 0 entry_point = 0x7ffda1567550 region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 1135 start_va = 0x7ffda1590000 end_va = 0x7ffda15a6fff monitored = 0 entry_point = 0x7ffda1595630 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 1136 start_va = 0x7ffda1790000 end_va = 0x7ffda17a9fff monitored = 0 entry_point = 0x7ffda1792430 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1137 start_va = 0x7ffda17b0000 end_va = 0x7ffda17c5fff monitored = 0 entry_point = 0x7ffda17b19f0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1138 start_va = 0x7ffda17d0000 end_va = 0x7ffda1807fff monitored = 0 entry_point = 0x7ffda17e8cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1139 start_va = 0x7ffda1810000 end_va = 0x7ffda181afff monitored = 0 entry_point = 0x7ffda1811d30 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1140 start_va = 0x7ffda1820000 end_va = 0x7ffda182cfff monitored = 0 entry_point = 0x7ffda1822ca0 region_type = mapped_file name = "csystemeventsbrokerclient.dll" filename = "\\Windows\\System32\\CSystemEventsBrokerClient.dll" (normalized: "c:\\windows\\system32\\csystemeventsbrokerclient.dll") Region: id = 1141 start_va = 0x7ffda1830000 end_va = 0x7ffda185efff monitored = 0 entry_point = 0x7ffda1838910 region_type = mapped_file name = "wptaskscheduler.dll" filename = "\\Windows\\System32\\WPTaskScheduler.dll" (normalized: "c:\\windows\\system32\\wptaskscheduler.dll") Region: id = 1142 start_va = 0x7ffda18b0000 end_va = 0x7ffda18c5fff monitored = 0 entry_point = 0x7ffda18b1b60 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1143 start_va = 0x7ffda1930000 end_va = 0x7ffda1a15fff monitored = 0 entry_point = 0x7ffda194cf10 region_type = mapped_file name = "usermgr.dll" filename = "\\Windows\\System32\\usermgr.dll" (normalized: "c:\\windows\\system32\\usermgr.dll") Region: id = 1144 start_va = 0x7ffda1a20000 end_va = 0x7ffda1a99fff monitored = 0 entry_point = 0x7ffda1a47630 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 1145 start_va = 0x7ffda1cd0000 end_va = 0x7ffda1d3dfff monitored = 0 entry_point = 0x7ffda1cd7f60 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 1146 start_va = 0x7ffda1d80000 end_va = 0x7ffda1e11fff monitored = 0 entry_point = 0x7ffda1dca780 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 1147 start_va = 0x7ffda1ea0000 end_va = 0x7ffda1eb0fff monitored = 0 entry_point = 0x7ffda1ea3320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 1148 start_va = 0x7ffda22b0000 end_va = 0x7ffda22f0fff monitored = 0 entry_point = 0x7ffda22c7eb0 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 1149 start_va = 0x7ffda2300000 end_va = 0x7ffda23fbfff monitored = 0 entry_point = 0x7ffda2336df0 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 1150 start_va = 0x7ffda25e0000 end_va = 0x7ffda2961fff monitored = 0 entry_point = 0x7ffda2631220 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 1151 start_va = 0x7ffda2970000 end_va = 0x7ffda2aa5fff monitored = 0 entry_point = 0x7ffda299f350 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 1152 start_va = 0x7ffda3ba0000 end_va = 0x7ffda3cadfff monitored = 0 entry_point = 0x7ffda3beeaa0 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 1153 start_va = 0x7ffda3fb0000 end_va = 0x7ffda3fbffff monitored = 0 entry_point = 0x7ffda3fb2c60 region_type = mapped_file name = "usermgrcli.dll" filename = "\\Windows\\System32\\usermgrcli.dll" (normalized: "c:\\windows\\system32\\usermgrcli.dll") Region: id = 1154 start_va = 0x7ffda3fc0000 end_va = 0x7ffda3fd2fff monitored = 0 entry_point = 0x7ffda3fc57f0 region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 1155 start_va = 0x7ffda3fe0000 end_va = 0x7ffda401dfff monitored = 0 entry_point = 0x7ffda3fea050 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 1156 start_va = 0x7ffda4020000 end_va = 0x7ffda4046fff monitored = 0 entry_point = 0x7ffda4023bf0 region_type = mapped_file name = "profsvcext.dll" filename = "\\Windows\\System32\\profsvcext.dll" (normalized: "c:\\windows\\system32\\profsvcext.dll") Region: id = 1157 start_va = 0x7ffda4050000 end_va = 0x7ffda405bfff monitored = 0 entry_point = 0x7ffda4052830 region_type = mapped_file name = "bi.dll" filename = "\\Windows\\System32\\bi.dll" (normalized: "c:\\windows\\system32\\bi.dll") Region: id = 1158 start_va = 0x7ffda4060000 end_va = 0x7ffda40b4fff monitored = 0 entry_point = 0x7ffda406fc00 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 1159 start_va = 0x7ffda40c0000 end_va = 0x7ffda4123fff monitored = 0 entry_point = 0x7ffda40d5ae0 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1160 start_va = 0x7ffda42f0000 end_va = 0x7ffda43aefff monitored = 0 entry_point = 0x7ffda4311c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 1161 start_va = 0x7ffda43b0000 end_va = 0x7ffda43effff monitored = 0 entry_point = 0x7ffda43c6c60 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 1162 start_va = 0x7ffda43f0000 end_va = 0x7ffda4418fff monitored = 0 entry_point = 0x7ffda43fca00 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 1163 start_va = 0x7ffda4420000 end_va = 0x7ffda4455fff monitored = 0 entry_point = 0x7ffda4430070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 1164 start_va = 0x7ffda4d20000 end_va = 0x7ffda4d29fff monitored = 0 entry_point = 0x7ffda4d21660 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1165 start_va = 0x7ffda4d30000 end_va = 0x7ffda4d47fff monitored = 0 entry_point = 0x7ffda4d35910 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 1166 start_va = 0x7ffda4d50000 end_va = 0x7ffda4e9cfff monitored = 0 entry_point = 0x7ffda4d93da0 region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 1167 start_va = 0x7ffda5930000 end_va = 0x7ffda59a8fff monitored = 0 entry_point = 0x7ffda594fb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 1168 start_va = 0x7ffda5b60000 end_va = 0x7ffda5ff2fff monitored = 0 entry_point = 0x7ffda5b6f760 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 1169 start_va = 0x7ffda6000000 end_va = 0x7ffda6066fff monitored = 0 entry_point = 0x7ffda601e710 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 1170 start_va = 0x7ffda60c0000 end_va = 0x7ffda60c7fff monitored = 0 entry_point = 0x7ffda60c13e0 region_type = mapped_file name = "dabapi.dll" filename = "\\Windows\\System32\\dabapi.dll" (normalized: "c:\\windows\\system32\\dabapi.dll") Region: id = 1171 start_va = 0x7ffda6100000 end_va = 0x7ffda6285fff monitored = 0 entry_point = 0x7ffda614d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1172 start_va = 0x7ffda6290000 end_va = 0x7ffda62abfff monitored = 0 entry_point = 0x7ffda62937a0 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 1173 start_va = 0x7ffda62f0000 end_va = 0x7ffda6302fff monitored = 0 entry_point = 0x7ffda62f2760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1174 start_va = 0x7ffda6460000 end_va = 0x7ffda649ffff monitored = 0 entry_point = 0x7ffda6471960 region_type = mapped_file name = "brokerlib.dll" filename = "\\Windows\\System32\\BrokerLib.dll" (normalized: "c:\\windows\\system32\\brokerlib.dll") Region: id = 1175 start_va = 0x7ffda65d0000 end_va = 0x7ffda65f6fff monitored = 0 entry_point = 0x7ffda65d7940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1176 start_va = 0x7ffda6620000 end_va = 0x7ffda66c9fff monitored = 0 entry_point = 0x7ffda6647910 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1177 start_va = 0x7ffda66d0000 end_va = 0x7ffda67cffff monitored = 0 entry_point = 0x7ffda6710f80 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 1178 start_va = 0x7ffda6860000 end_va = 0x7ffda686bfff monitored = 0 entry_point = 0x7ffda6862480 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 1179 start_va = 0x7ffda6a30000 end_va = 0x7ffda6a61fff monitored = 0 entry_point = 0x7ffda6a42340 region_type = mapped_file name = "fwbase.dll" filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll") Region: id = 1180 start_va = 0x7ffda6ba0000 end_va = 0x7ffda6babfff monitored = 0 entry_point = 0x7ffda6ba2790 region_type = mapped_file name = "hid.dll" filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll") Region: id = 1181 start_va = 0x7ffda6bb0000 end_va = 0x7ffda6bd3fff monitored = 0 entry_point = 0x7ffda6bb3260 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 1182 start_va = 0x7ffda6d50000 end_va = 0x7ffda6e43fff monitored = 0 entry_point = 0x7ffda6d5a960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 1183 start_va = 0x7ffda6ea0000 end_va = 0x7ffda6ee8fff monitored = 0 entry_point = 0x7ffda6eaa090 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 1184 start_va = 0x7ffda6fc0000 end_va = 0x7ffda6fcbfff monitored = 0 entry_point = 0x7ffda6fc27e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1185 start_va = 0x7ffda70a0000 end_va = 0x7ffda70d0fff monitored = 0 entry_point = 0x7ffda70a7d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1186 start_va = 0x7ffda7100000 end_va = 0x7ffda7179fff monitored = 0 entry_point = 0x7ffda7121a50 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 1187 start_va = 0x7ffda71c0000 end_va = 0x7ffda71f3fff monitored = 0 entry_point = 0x7ffda71dae70 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1188 start_va = 0x7ffda7200000 end_va = 0x7ffda7209fff monitored = 0 entry_point = 0x7ffda7201830 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll") Region: id = 1189 start_va = 0x7ffda7310000 end_va = 0x7ffda732efff monitored = 0 entry_point = 0x7ffda7315d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1190 start_va = 0x7ffda7480000 end_va = 0x7ffda74dbfff monitored = 0 entry_point = 0x7ffda7496f70 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1191 start_va = 0x7ffda7530000 end_va = 0x7ffda7546fff monitored = 0 entry_point = 0x7ffda75379d0 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1192 start_va = 0x7ffda7650000 end_va = 0x7ffda765afff monitored = 0 entry_point = 0x7ffda76519a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1193 start_va = 0x7ffda7690000 end_va = 0x7ffda76b0fff monitored = 0 entry_point = 0x7ffda76a0250 region_type = mapped_file name = "joinutil.dll" filename = "\\Windows\\System32\\joinutil.dll" (normalized: "c:\\windows\\system32\\joinutil.dll") Region: id = 1194 start_va = 0x7ffda76e0000 end_va = 0x7ffda7719fff monitored = 0 entry_point = 0x7ffda76e8d20 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll") Region: id = 1195 start_va = 0x7ffda7720000 end_va = 0x7ffda7746fff monitored = 0 entry_point = 0x7ffda7730aa0 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 1196 start_va = 0x7ffda7830000 end_va = 0x7ffda785cfff monitored = 0 entry_point = 0x7ffda7849d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1197 start_va = 0x7ffda79c0000 end_va = 0x7ffda7a15fff monitored = 0 entry_point = 0x7ffda79d0bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1198 start_va = 0x7ffda7a20000 end_va = 0x7ffda7a38fff monitored = 0 entry_point = 0x7ffda7a25e10 region_type = mapped_file name = "eventaggregation.dll" filename = "\\Windows\\System32\\EventAggregation.dll" (normalized: "c:\\windows\\system32\\eventaggregation.dll") Region: id = 1199 start_va = 0x7ffda7a40000 end_va = 0x7ffda7a68fff monitored = 0 entry_point = 0x7ffda7a54530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1200 start_va = 0x7ffda7a70000 end_va = 0x7ffda7b08fff monitored = 0 entry_point = 0x7ffda7a9f4e0 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 1201 start_va = 0x7ffda7bb0000 end_va = 0x7ffda7bfafff monitored = 0 entry_point = 0x7ffda7bb35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1202 start_va = 0x7ffda7c00000 end_va = 0x7ffda7c0efff monitored = 0 entry_point = 0x7ffda7c03210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1203 start_va = 0x7ffda7c10000 end_va = 0x7ffda7c23fff monitored = 0 entry_point = 0x7ffda7c152e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1204 start_va = 0x7ffda7c30000 end_va = 0x7ffda7c3ffff monitored = 0 entry_point = 0x7ffda7c356e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1205 start_va = 0x7ffda7c40000 end_va = 0x7ffda7cc5fff monitored = 0 entry_point = 0x7ffda7c4d8f0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 1206 start_va = 0x7ffda7cd0000 end_va = 0x7ffda7d39fff monitored = 0 entry_point = 0x7ffda7d06d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1207 start_va = 0x7ffda7d40000 end_va = 0x7ffda7f27fff monitored = 0 entry_point = 0x7ffda7d6ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1208 start_va = 0x7ffda7f30000 end_va = 0x7ffda80f6fff monitored = 0 entry_point = 0x7ffda7f8db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1209 start_va = 0x7ffda8100000 end_va = 0x7ffda8142fff monitored = 0 entry_point = 0x7ffda8114b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1210 start_va = 0x7ffda8150000 end_va = 0x7ffda81a4fff monitored = 0 entry_point = 0x7ffda8167970 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 1211 start_va = 0x7ffda8260000 end_va = 0x7ffda8314fff monitored = 0 entry_point = 0x7ffda82a22e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1212 start_va = 0x7ffda8320000 end_va = 0x7ffda8963fff monitored = 0 entry_point = 0x7ffda84e64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 1213 start_va = 0x7ffda8970000 end_va = 0x7ffda8986fff monitored = 0 entry_point = 0x7ffda8971390 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1214 start_va = 0x7ffda8990000 end_va = 0x7ffda89ebfff monitored = 0 entry_point = 0x7ffda89ab720 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1215 start_va = 0x7ffda8a30000 end_va = 0x7ffda8adcfff monitored = 0 entry_point = 0x7ffda8a481a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1216 start_va = 0x7ffda8ae0000 end_va = 0x7ffda8b86fff monitored = 0 entry_point = 0x7ffda8aeb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1217 start_va = 0x7ffda8b90000 end_va = 0x7ffda8b97fff monitored = 0 entry_point = 0x7ffda8b91ea0 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1218 start_va = 0x7ffda8ba0000 end_va = 0x7ffda8cbbfff monitored = 0 entry_point = 0x7ffda8be02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1219 start_va = 0x7ffda8cc0000 end_va = 0x7ffda8d80fff monitored = 0 entry_point = 0x7ffda8ce0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1220 start_va = 0x7ffda8ea0000 end_va = 0x7ffda8ff5fff monitored = 0 entry_point = 0x7ffda8eaa8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1221 start_va = 0x7ffda9000000 end_va = 0x7ffda927cfff monitored = 0 entry_point = 0x7ffda90d4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1222 start_va = 0x7ffda9280000 end_va = 0x7ffda96a8fff monitored = 0 entry_point = 0x7ffda92a8740 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1223 start_va = 0x7ffda96b0000 end_va = 0x7ffda97f2fff monitored = 0 entry_point = 0x7ffda96d8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1224 start_va = 0x7ffda9800000 end_va = 0x7ffda986afff monitored = 0 entry_point = 0x7ffda98190c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1225 start_va = 0x7ffda9870000 end_va = 0x7ffdaadcefff monitored = 0 entry_point = 0x7ffda99d11f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1226 start_va = 0x7ffdaadd0000 end_va = 0x7ffdaae21fff monitored = 0 entry_point = 0x7ffdaaddf530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1227 start_va = 0x7ffdaae30000 end_va = 0x7ffdaaeccfff monitored = 0 entry_point = 0x7ffdaae378a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1228 start_va = 0x7ffdaaee0000 end_va = 0x7ffdaaf86fff monitored = 0 entry_point = 0x7ffdaaef58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1229 start_va = 0x7ffdab030000 end_va = 0x7ffdab08afff monitored = 0 entry_point = 0x7ffdab0438b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1230 start_va = 0x7ffdab400000 end_va = 0x7ffdab585fff monitored = 0 entry_point = 0x7ffdab44ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1231 start_va = 0x7ffdab590000 end_va = 0x7ffdab750fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1266 start_va = 0xb120000 end_va = 0xb21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b120000" filename = "" Region: id = 1267 start_va = 0xb220000 end_va = 0xb31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b220000" filename = "" Region: id = 1268 start_va = 0xb320000 end_va = 0xb41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b320000" filename = "" Region: id = 1269 start_va = 0xb420000 end_va = 0xb51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b420000" filename = "" Region: id = 1395 start_va = 0x130000 end_va = 0x134fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 1814 start_va = 0x130000 end_va = 0x131fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 1815 start_va = 0xb520000 end_va = 0xb61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b520000" filename = "" Region: id = 1816 start_va = 0x130000 end_va = 0x132fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 1817 start_va = 0x140000 end_va = 0x142fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 1828 start_va = 0x130000 end_va = 0x132fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 1829 start_va = 0x130000 end_va = 0x133fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 2235 start_va = 0x130000 end_va = 0x132fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 2241 start_va = 0xb620000 end_va = 0xb71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b620000" filename = "" Region: id = 2242 start_va = 0xb720000 end_va = 0xb81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b720000" filename = "" Region: id = 2244 start_va = 0x130000 end_va = 0x132fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 2245 start_va = 0x130000 end_va = 0x132fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 2280 start_va = 0xb820000 end_va = 0xb91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b820000" filename = "" Region: id = 2302 start_va = 0x130000 end_va = 0x130fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 2305 start_va = 0xb920000 end_va = 0xba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000b920000" filename = "" Region: id = 2306 start_va = 0xba20000 end_va = 0xbb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000000ba20000" filename = "" Region: id = 2307 start_va = 0xfd0000 end_va = 0x104ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fd0000" filename = "" Region: id = 2308 start_va = 0x3410000 end_va = 0x348ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003410000" filename = "" Region: id = 2309 start_va = 0x7ffda5a30000 end_va = 0x7ffda5a80fff monitored = 0 entry_point = 0x7ffda5a325e0 region_type = mapped_file name = "cscobj.dll" filename = "\\Windows\\System32\\cscobj.dll" (normalized: "c:\\windows\\system32\\cscobj.dll") Thread: id = 19 os_tid = 0x1224 Thread: id = 20 os_tid = 0xac8 Thread: id = 21 os_tid = 0xab8 Thread: id = 22 os_tid = 0x1350 Thread: id = 23 os_tid = 0xddc Thread: id = 24 os_tid = 0x10f8 Thread: id = 25 os_tid = 0x3ac Thread: id = 26 os_tid = 0xf04 Thread: id = 27 os_tid = 0x5c0 Thread: id = 28 os_tid = 0x22c Thread: id = 29 os_tid = 0xfa8 Thread: id = 30 os_tid = 0x7b8 Thread: id = 31 os_tid = 0xf48 Thread: id = 32 os_tid = 0xf4c Thread: id = 33 os_tid = 0xa94 Thread: id = 34 os_tid = 0xb5c Thread: id = 35 os_tid = 0xa90 Thread: id = 36 os_tid = 0xe50 Thread: id = 37 os_tid = 0xaec Thread: id = 38 os_tid = 0xf34 Thread: id = 39 os_tid = 0x29c Thread: id = 40 os_tid = 0x234 Thread: id = 41 os_tid = 0x17c Thread: id = 42 os_tid = 0xbcc Thread: id = 43 os_tid = 0xec4 Thread: id = 44 os_tid = 0xed0 Thread: id = 45 os_tid = 0xc70 Thread: id = 46 os_tid = 0xe6c Thread: id = 47 os_tid = 0xe64 Thread: id = 48 os_tid = 0xdd8 Thread: id = 49 os_tid = 0xde8 Thread: id = 50 os_tid = 0x768 Thread: id = 51 os_tid = 0xa88 Thread: id = 52 os_tid = 0xdb4 Thread: id = 53 os_tid = 0x6b8 Thread: id = 54 os_tid = 0x504 Thread: id = 55 os_tid = 0x4c8 Thread: id = 56 os_tid = 0xb38 Thread: id = 57 os_tid = 0xd50 Thread: id = 58 os_tid = 0xc40 Thread: id = 59 os_tid = 0xfd8 Thread: id = 60 os_tid = 0xcac Thread: id = 61 os_tid = 0x6c4 Thread: id = 62 os_tid = 0x8ac Thread: id = 63 os_tid = 0x8a4 Thread: id = 64 os_tid = 0x8a0 Thread: id = 65 os_tid = 0x878 Thread: id = 66 os_tid = 0x860 Thread: id = 67 os_tid = 0x858 Thread: id = 68 os_tid = 0x854 Thread: id = 69 os_tid = 0x840 Thread: id = 70 os_tid = 0x834 Thread: id = 71 os_tid = 0x814 Thread: id = 72 os_tid = 0x808 Thread: id = 73 os_tid = 0x500 Thread: id = 74 os_tid = 0x554 Thread: id = 75 os_tid = 0x4f4 Thread: id = 76 os_tid = 0x520 Thread: id = 77 os_tid = 0x524 Thread: id = 78 os_tid = 0x774 Thread: id = 79 os_tid = 0x460 Thread: id = 80 os_tid = 0x574 Thread: id = 81 os_tid = 0x760 Thread: id = 82 os_tid = 0x718 Thread: id = 83 os_tid = 0x6c0 Thread: id = 84 os_tid = 0x694 Thread: id = 85 os_tid = 0x618 Thread: id = 86 os_tid = 0x608 Thread: id = 87 os_tid = 0x59c Thread: id = 88 os_tid = 0x4fc Thread: id = 89 os_tid = 0x4bc Thread: id = 90 os_tid = 0x4a8 Thread: id = 91 os_tid = 0x478 Thread: id = 92 os_tid = 0x41c Thread: id = 93 os_tid = 0x2e4 Thread: id = 94 os_tid = 0x3bc Thread: id = 95 os_tid = 0x3b4 Thread: id = 96 os_tid = 0x8 Thread: id = 97 os_tid = 0x2f0 Thread: id = 98 os_tid = 0x308 Thread: id = 99 os_tid = 0x270 Thread: id = 100 os_tid = 0x210 Thread: id = 101 os_tid = 0x18c Thread: id = 102 os_tid = 0x140 Thread: id = 103 os_tid = 0x3f4 Thread: id = 104 os_tid = 0x3ec Thread: id = 105 os_tid = 0x3e4 Thread: id = 106 os_tid = 0x368 Thread: id = 123 os_tid = 0xd60 Thread: id = 124 os_tid = 0xdcc Thread: id = 125 os_tid = 0xcb8 Thread: id = 126 os_tid = 0x1c4 Thread: id = 130 os_tid = 0xd3c Thread: id = 138 os_tid = 0x1288 Thread: id = 139 os_tid = 0x7bc Thread: id = 142 os_tid = 0xe78 Thread: id = 143 os_tid = 0xb6c Thread: id = 144 os_tid = 0x13c8 Thread: id = 145 os_tid = 0x13c4 Thread: id = 146 os_tid = 0x84 Thread: id = 147 os_tid = 0xd74 Process: id = "4" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x639c5000" os_pid = "0xb94" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x274" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xe], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xe], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xe], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000ac37" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1429 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1430 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1431 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1432 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1433 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 1434 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1435 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1436 start_va = 0x100000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 1437 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1438 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1439 start_va = 0x540000 end_va = 0x546fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 1440 start_va = 0x550000 end_va = 0x60ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 1441 start_va = 0x610000 end_va = 0x610fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 1442 start_va = 0x620000 end_va = 0x620fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 1443 start_va = 0x630000 end_va = 0x631fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 1444 start_va = 0x640000 end_va = 0x640fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000640000" filename = "" Region: id = 1445 start_va = 0x650000 end_va = 0x654fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 1446 start_va = 0x660000 end_va = 0x660fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000660000" filename = "" Region: id = 1447 start_va = 0x670000 end_va = 0x670fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000670000" filename = "" Region: id = 1448 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 1449 start_va = 0x690000 end_va = 0x9c6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1450 start_va = 0x9d0000 end_va = 0xb57fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009d0000" filename = "" Region: id = 1451 start_va = 0xb60000 end_va = 0xce0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1452 start_va = 0xcf0000 end_va = 0xd6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cf0000" filename = "" Region: id = 1453 start_va = 0xd70000 end_va = 0xe6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d70000" filename = "" Region: id = 1454 start_va = 0xe70000 end_va = 0xe70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e70000" filename = "" Region: id = 1455 start_va = 0xe80000 end_va = 0xefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e80000" filename = "" Region: id = 1456 start_va = 0xf00000 end_va = 0xf7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f00000" filename = "" Region: id = 1457 start_va = 0xf80000 end_va = 0xffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f80000" filename = "" Region: id = 1458 start_va = 0x1000000 end_va = 0x107ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001000000" filename = "" Region: id = 1459 start_va = 0x1080000 end_va = 0x10fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001080000" filename = "" Region: id = 1460 start_va = 0x1100000 end_va = 0x117ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001100000" filename = "" Region: id = 1461 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1462 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 1463 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 1464 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 1465 start_va = 0x7ff61e550000 end_va = 0x7ff61e5cffff monitored = 0 entry_point = 0x7ff61e565f50 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 1466 start_va = 0x7ffd90390000 end_va = 0x7ffd903dcfff monitored = 0 entry_point = 0x7ffd9039b470 region_type = mapped_file name = "pdh.dll" filename = "\\Windows\\System32\\pdh.dll" (normalized: "c:\\windows\\system32\\pdh.dll") Region: id = 1467 start_va = 0x7ffd92570000 end_va = 0x7ffd92594fff monitored = 1 entry_point = 0x7ffd92585dc0 region_type = mapped_file name = "wmiperfclass.dll" filename = "\\Windows\\System32\\wbem\\WmiPerfClass.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiperfclass.dll") Region: id = 1468 start_va = 0x7ffd97150000 end_va = 0x7ffd97165fff monitored = 0 entry_point = 0x7ffd971555e0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1469 start_va = 0x7ffd972c0000 end_va = 0x7ffd972e4fff monitored = 0 entry_point = 0x7ffd972c9900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1470 start_va = 0x7ffd972f0000 end_va = 0x7ffd97303fff monitored = 0 entry_point = 0x7ffd972f1800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1471 start_va = 0x7ffd97350000 end_va = 0x7ffd97445fff monitored = 0 entry_point = 0x7ffd97389590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1472 start_va = 0x7ffd97630000 end_va = 0x7ffd97640fff monitored = 0 entry_point = 0x7ffd97632fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1473 start_va = 0x7ffd9b340000 end_va = 0x7ffd9b3befff monitored = 1 entry_point = 0x7ffd9b357110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1474 start_va = 0x7ffd9f310000 end_va = 0x7ffd9f34cfff monitored = 1 entry_point = 0x7ffd9f31b760 region_type = mapped_file name = "wmiprov.dll" filename = "\\Windows\\System32\\wbem\\wmiprov.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprov.dll") Region: id = 1475 start_va = 0x7ffda1ea0000 end_va = 0x7ffda1eb0fff monitored = 0 entry_point = 0x7ffda1ea3320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 1476 start_va = 0x7ffda40c0000 end_va = 0x7ffda4123fff monitored = 0 entry_point = 0x7ffda40d5ae0 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1477 start_va = 0x7ffda70a0000 end_va = 0x7ffda70d0fff monitored = 0 entry_point = 0x7ffda70a7d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1478 start_va = 0x7ffda7a40000 end_va = 0x7ffda7a68fff monitored = 0 entry_point = 0x7ffda7a54530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1479 start_va = 0x7ffda7c00000 end_va = 0x7ffda7c0efff monitored = 0 entry_point = 0x7ffda7c03210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1480 start_va = 0x7ffda7cd0000 end_va = 0x7ffda7d39fff monitored = 0 entry_point = 0x7ffda7d06d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1481 start_va = 0x7ffda7d40000 end_va = 0x7ffda7f27fff monitored = 0 entry_point = 0x7ffda7d6ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1482 start_va = 0x7ffda8a30000 end_va = 0x7ffda8adcfff monitored = 0 entry_point = 0x7ffda8a481a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1483 start_va = 0x7ffda8ae0000 end_va = 0x7ffda8b86fff monitored = 0 entry_point = 0x7ffda8aeb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1484 start_va = 0x7ffda8ba0000 end_va = 0x7ffda8cbbfff monitored = 0 entry_point = 0x7ffda8be02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1485 start_va = 0x7ffda8cc0000 end_va = 0x7ffda8d80fff monitored = 0 entry_point = 0x7ffda8ce0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1486 start_va = 0x7ffda8ea0000 end_va = 0x7ffda8ff5fff monitored = 0 entry_point = 0x7ffda8eaa8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1487 start_va = 0x7ffda9000000 end_va = 0x7ffda927cfff monitored = 0 entry_point = 0x7ffda90d4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1488 start_va = 0x7ffda9800000 end_va = 0x7ffda986afff monitored = 0 entry_point = 0x7ffda98190c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1489 start_va = 0x7ffdaae30000 end_va = 0x7ffdaaeccfff monitored = 0 entry_point = 0x7ffdaae378a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1490 start_va = 0x7ffdaaee0000 end_va = 0x7ffdaaf86fff monitored = 0 entry_point = 0x7ffdaaef58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1491 start_va = 0x7ffdab030000 end_va = 0x7ffdab08afff monitored = 0 entry_point = 0x7ffdab0438b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1492 start_va = 0x7ffdab400000 end_va = 0x7ffdab585fff monitored = 0 entry_point = 0x7ffdab44ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1493 start_va = 0x7ffdab590000 end_va = 0x7ffdab750fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Thread: id = 107 os_tid = 0xc2c Thread: id = 108 os_tid = 0x238 Thread: id = 109 os_tid = 0xfe0 Thread: id = 110 os_tid = 0xc98 Thread: id = 111 os_tid = 0xc8c Thread: id = 112 os_tid = 0x2f4 Thread: id = 113 os_tid = 0xfa0 Thread: id = 114 os_tid = 0x9e8 Process: id = "5" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x2010b000" os_pid = "0xe18" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x274" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:00038627" [0xc000000f] Region: id = 1270 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1271 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1272 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1273 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1274 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 1275 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1276 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1277 start_va = 0x100000 end_va = 0x1bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1278 start_va = 0x1c0000 end_va = 0x1c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 1279 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1280 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 1281 start_va = 0x1f0000 end_va = 0x1f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 1282 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1283 start_va = 0x400000 end_va = 0x400fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 1284 start_va = 0x410000 end_va = 0x414fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 1285 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1286 start_va = 0x430000 end_va = 0x430fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 1287 start_va = 0x440000 end_va = 0x440fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 1288 start_va = 0x450000 end_va = 0x452fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cimwin32.dll.mui" filename = "\\Windows\\System32\\wbem\\en-US\\cimwin32.dll.mui" (normalized: "c:\\windows\\system32\\wbem\\en-us\\cimwin32.dll.mui") Region: id = 1289 start_va = 0x460000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 1290 start_va = 0x470000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 1291 start_va = 0x580000 end_va = 0x582fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "security.dll" filename = "\\Windows\\System32\\security.dll" (normalized: "c:\\windows\\system32\\security.dll") Region: id = 1292 start_va = 0x5f0000 end_va = 0x926fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1293 start_va = 0x930000 end_va = 0xab7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000930000" filename = "" Region: id = 1294 start_va = 0xac0000 end_va = 0xc40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ac0000" filename = "" Region: id = 1295 start_va = 0xc50000 end_va = 0xd0ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c50000" filename = "" Region: id = 1296 start_va = 0xd90000 end_va = 0xe8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d90000" filename = "" Region: id = 1297 start_va = 0xe90000 end_va = 0xf8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e90000" filename = "" Region: id = 1298 start_va = 0x1010000 end_va = 0x108ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001010000" filename = "" Region: id = 1299 start_va = 0x1110000 end_va = 0x118ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001110000" filename = "" Region: id = 1300 start_va = 0x1210000 end_va = 0x128ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001210000" filename = "" Region: id = 1301 start_va = 0x1290000 end_va = 0x130ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001290000" filename = "" Region: id = 1302 start_va = 0x1310000 end_va = 0x138ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001310000" filename = "" Region: id = 1303 start_va = 0x1410000 end_va = 0x148ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001410000" filename = "" Region: id = 1304 start_va = 0x1490000 end_va = 0x150ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001490000" filename = "" Region: id = 1305 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1306 start_va = 0x180000000 end_va = 0x180002fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wmi.dll" filename = "\\Windows\\System32\\wmi.dll" (normalized: "c:\\windows\\system32\\wmi.dll") Region: id = 1307 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 1308 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 1309 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 1310 start_va = 0x7ff61e550000 end_va = 0x7ff61e5cffff monitored = 0 entry_point = 0x7ff61e565f50 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 1311 start_va = 0x7ffd8ecc0000 end_va = 0x7ffd8ee8efff monitored = 1 entry_point = 0x7ffd8ece7df0 region_type = mapped_file name = "cimwin32.dll" filename = "\\Windows\\System32\\wbem\\cimwin32.dll" (normalized: "c:\\windows\\system32\\wbem\\cimwin32.dll") Region: id = 1312 start_va = 0x7ffd91320000 end_va = 0x7ffd9136dfff monitored = 0 entry_point = 0x7ffd91331ce0 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 1313 start_va = 0x7ffd92210000 end_va = 0x7ffd9221dfff monitored = 0 entry_point = 0x7ffd92211da0 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 1314 start_va = 0x7ffd96f10000 end_va = 0x7ffd96f23fff monitored = 0 entry_point = 0x7ffd96f11310 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\System32\\browcli.dll" (normalized: "c:\\windows\\system32\\browcli.dll") Region: id = 1315 start_va = 0x7ffd97150000 end_va = 0x7ffd97165fff monitored = 0 entry_point = 0x7ffd971555e0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1316 start_va = 0x7ffd972c0000 end_va = 0x7ffd972e4fff monitored = 0 entry_point = 0x7ffd972c9900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1317 start_va = 0x7ffd972f0000 end_va = 0x7ffd97303fff monitored = 0 entry_point = 0x7ffd972f1800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1318 start_va = 0x7ffd97350000 end_va = 0x7ffd97445fff monitored = 0 entry_point = 0x7ffd97389590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1319 start_va = 0x7ffd982b0000 end_va = 0x7ffd982d5fff monitored = 0 entry_point = 0x7ffd982b1cf0 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1320 start_va = 0x7ffd9b340000 end_va = 0x7ffd9b3befff monitored = 1 entry_point = 0x7ffd9b357110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1321 start_va = 0x7ffd9b400000 end_va = 0x7ffd9b40bfff monitored = 0 entry_point = 0x7ffd9b4035c0 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1322 start_va = 0x7ffd9f020000 end_va = 0x7ffd9f031fff monitored = 0 entry_point = 0x7ffd9f023580 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 1323 start_va = 0x7ffd9f730000 end_va = 0x7ffd9f73afff monitored = 0 entry_point = 0x7ffd9f7312b0 region_type = mapped_file name = "schedcli.dll" filename = "\\Windows\\System32\\schedcli.dll" (normalized: "c:\\windows\\system32\\schedcli.dll") Region: id = 1324 start_va = 0x7ffda11c0000 end_va = 0x7ffda11d8fff monitored = 0 entry_point = 0x7ffda11c4520 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1325 start_va = 0x7ffda18b0000 end_va = 0x7ffda18c5fff monitored = 0 entry_point = 0x7ffda18b1b60 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1326 start_va = 0x7ffda1ea0000 end_va = 0x7ffda1eb0fff monitored = 0 entry_point = 0x7ffda1ea3320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 1327 start_va = 0x7ffda3fe0000 end_va = 0x7ffda401dfff monitored = 0 entry_point = 0x7ffda3fea050 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 1328 start_va = 0x7ffda4d20000 end_va = 0x7ffda4d29fff monitored = 0 entry_point = 0x7ffda4d21660 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1329 start_va = 0x7ffda62f0000 end_va = 0x7ffda6302fff monitored = 0 entry_point = 0x7ffda62f2760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1330 start_va = 0x7ffda65d0000 end_va = 0x7ffda65f6fff monitored = 0 entry_point = 0x7ffda65d7940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1331 start_va = 0x7ffda6fc0000 end_va = 0x7ffda6fcbfff monitored = 0 entry_point = 0x7ffda6fc27e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1332 start_va = 0x7ffda7100000 end_va = 0x7ffda7179fff monitored = 0 entry_point = 0x7ffda7121a50 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 1333 start_va = 0x7ffda7830000 end_va = 0x7ffda785cfff monitored = 0 entry_point = 0x7ffda7849d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1334 start_va = 0x7ffda79c0000 end_va = 0x7ffda7a15fff monitored = 0 entry_point = 0x7ffda79d0bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1335 start_va = 0x7ffda7a40000 end_va = 0x7ffda7a68fff monitored = 0 entry_point = 0x7ffda7a54530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1336 start_va = 0x7ffda7bb0000 end_va = 0x7ffda7bfafff monitored = 0 entry_point = 0x7ffda7bb35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1337 start_va = 0x7ffda7c00000 end_va = 0x7ffda7c0efff monitored = 0 entry_point = 0x7ffda7c03210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1338 start_va = 0x7ffda7c30000 end_va = 0x7ffda7c3ffff monitored = 0 entry_point = 0x7ffda7c356e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1339 start_va = 0x7ffda7cd0000 end_va = 0x7ffda7d39fff monitored = 0 entry_point = 0x7ffda7d06d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1340 start_va = 0x7ffda7d40000 end_va = 0x7ffda7f27fff monitored = 0 entry_point = 0x7ffda7d6ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1341 start_va = 0x7ffda7f30000 end_va = 0x7ffda80f6fff monitored = 0 entry_point = 0x7ffda7f8db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1342 start_va = 0x7ffda8100000 end_va = 0x7ffda8142fff monitored = 0 entry_point = 0x7ffda8114b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1343 start_va = 0x7ffda8970000 end_va = 0x7ffda8986fff monitored = 0 entry_point = 0x7ffda8971390 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1344 start_va = 0x7ffda8a30000 end_va = 0x7ffda8adcfff monitored = 0 entry_point = 0x7ffda8a481a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1345 start_va = 0x7ffda8ae0000 end_va = 0x7ffda8b86fff monitored = 0 entry_point = 0x7ffda8aeb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1346 start_va = 0x7ffda8ba0000 end_va = 0x7ffda8cbbfff monitored = 0 entry_point = 0x7ffda8be02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1347 start_va = 0x7ffda8cc0000 end_va = 0x7ffda8d80fff monitored = 0 entry_point = 0x7ffda8ce0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1348 start_va = 0x7ffda8ea0000 end_va = 0x7ffda8ff5fff monitored = 0 entry_point = 0x7ffda8eaa8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1349 start_va = 0x7ffda9000000 end_va = 0x7ffda927cfff monitored = 0 entry_point = 0x7ffda90d4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1350 start_va = 0x7ffda9800000 end_va = 0x7ffda986afff monitored = 0 entry_point = 0x7ffda98190c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1351 start_va = 0x7ffdaae30000 end_va = 0x7ffdaaeccfff monitored = 0 entry_point = 0x7ffdaae378a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1352 start_va = 0x7ffdaaee0000 end_va = 0x7ffdaaf86fff monitored = 0 entry_point = 0x7ffdaaef58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1353 start_va = 0x7ffdab030000 end_va = 0x7ffdab08afff monitored = 0 entry_point = 0x7ffdab0438b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1354 start_va = 0x7ffdab400000 end_va = 0x7ffdab585fff monitored = 0 entry_point = 0x7ffdab44ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1355 start_va = 0x7ffdab590000 end_va = 0x7ffdab750fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1396 start_va = 0x570000 end_va = 0x571fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 1397 start_va = 0x1510000 end_va = 0x160ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001510000" filename = "" Region: id = 1398 start_va = 0x590000 end_va = 0x5a5fff monitored = 0 entry_point = 0x5a0420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1399 start_va = 0x5b0000 end_va = 0x5b2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1400 start_va = 0x590000 end_va = 0x5a5fff monitored = 0 entry_point = 0x5a0420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1401 start_va = 0x5b0000 end_va = 0x5b2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1402 start_va = 0x590000 end_va = 0x5a5fff monitored = 0 entry_point = 0x5a0420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1403 start_va = 0x5b0000 end_va = 0x5b2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1404 start_va = 0x590000 end_va = 0x5a5fff monitored = 0 entry_point = 0x5a0420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1405 start_va = 0x5b0000 end_va = 0x5b2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1406 start_va = 0x590000 end_va = 0x5a9fff monitored = 1 entry_point = 0x591190 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 1407 start_va = 0x5b0000 end_va = 0x5b5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 1408 start_va = 0x590000 end_va = 0x5a9fff monitored = 1 entry_point = 0x591190 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 1409 start_va = 0x5b0000 end_va = 0x5b5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 1410 start_va = 0x590000 end_va = 0x5bafff monitored = 0 entry_point = 0x5ad000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1411 start_va = 0x5c0000 end_va = 0x5c4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1412 start_va = 0x16d0000 end_va = 0x1acafff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000016d0000" filename = "" Region: id = 1413 start_va = 0x590000 end_va = 0x5bafff monitored = 0 entry_point = 0x5ad000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1414 start_va = 0x5c0000 end_va = 0x5c4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1415 start_va = 0x590000 end_va = 0x5bafff monitored = 0 entry_point = 0x5ad000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1416 start_va = 0x5c0000 end_va = 0x5c4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1417 start_va = 0x590000 end_va = 0x5bafff monitored = 0 entry_point = 0x5ad000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1418 start_va = 0x5c0000 end_va = 0x5c4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1419 start_va = 0x590000 end_va = 0x5b8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 1420 start_va = 0x1ad0000 end_va = 0x1bb3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 1421 start_va = 0x590000 end_va = 0x5b8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 1422 start_va = 0x1ad0000 end_va = 0x1bb3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 1423 start_va = 0x590000 end_va = 0x595fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 1424 start_va = 0x1610000 end_va = 0x16a2fff monitored = 0 entry_point = 0x1689000 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 1425 start_va = 0x590000 end_va = 0x595fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 1426 start_va = 0x1610000 end_va = 0x16a2fff monitored = 0 entry_point = 0x1689000 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 1427 start_va = 0x590000 end_va = 0x595fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fvevol.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui") Region: id = 1428 start_va = 0x1610000 end_va = 0x16b0fff monitored = 0 entry_point = 0x16a3000 region_type = mapped_file name = "fvevol.sys" filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys") Region: id = 1494 start_va = 0x590000 end_va = 0x595fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fvevol.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui") Region: id = 1495 start_va = 0x1610000 end_va = 0x16b0fff monitored = 0 entry_point = 0x16a3000 region_type = mapped_file name = "fvevol.sys" filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys") Region: id = 1496 start_va = 0x590000 end_va = 0x59afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1497 start_va = 0x1610000 end_va = 0x1695fff monitored = 0 entry_point = 0x1681000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1498 start_va = 0x590000 end_va = 0x59afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1499 start_va = 0x1610000 end_va = 0x1695fff monitored = 0 entry_point = 0x1681000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1500 start_va = 0x590000 end_va = 0x59afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1501 start_va = 0x1610000 end_va = 0x1695fff monitored = 0 entry_point = 0x1681000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1502 start_va = 0x590000 end_va = 0x59afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1503 start_va = 0x1610000 end_va = 0x1695fff monitored = 0 entry_point = 0x1681000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1504 start_va = 0x590000 end_va = 0x59efff monitored = 0 entry_point = 0x5936e0 region_type = mapped_file name = "dmvsc.sys" filename = "\\Windows\\System32\\drivers\\dmvsc.sys" (normalized: "c:\\windows\\system32\\drivers\\dmvsc.sys") Region: id = 1505 start_va = 0x5a0000 end_va = 0x5a1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dmvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\dmvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\dmvsc.sys.mui") Region: id = 1506 start_va = 0x590000 end_va = 0x59efff monitored = 0 entry_point = 0x5936e0 region_type = mapped_file name = "dmvsc.sys" filename = "\\Windows\\System32\\drivers\\dmvsc.sys" (normalized: "c:\\windows\\system32\\drivers\\dmvsc.sys") Region: id = 1507 start_va = 0x5a0000 end_va = 0x5a1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dmvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\dmvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\dmvsc.sys.mui") Region: id = 1508 start_va = 0x590000 end_va = 0x5aafff monitored = 1 entry_point = 0x591190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1509 start_va = 0x5b0000 end_va = 0x5bbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1510 start_va = 0x590000 end_va = 0x5aafff monitored = 1 entry_point = 0x591190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1511 start_va = 0x5b0000 end_va = 0x5bbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1512 start_va = 0x590000 end_va = 0x5aafff monitored = 1 entry_point = 0x591190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1513 start_va = 0x5b0000 end_va = 0x5bbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1514 start_va = 0x590000 end_va = 0x5aafff monitored = 1 entry_point = 0x591190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1515 start_va = 0x5b0000 end_va = 0x5bbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1516 start_va = 0x590000 end_va = 0x5aafff monitored = 1 entry_point = 0x591190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1517 start_va = 0x5b0000 end_va = 0x5bbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1518 start_va = 0x590000 end_va = 0x5aafff monitored = 1 entry_point = 0x591190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1519 start_va = 0x5b0000 end_va = 0x5bbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1520 start_va = 0x590000 end_va = 0x591fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 1521 start_va = 0x1ad0000 end_va = 0x1bdefff monitored = 0 entry_point = 0x1b0c010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 1522 start_va = 0x590000 end_va = 0x591fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 1523 start_va = 0x1ad0000 end_va = 0x1bdefff monitored = 0 entry_point = 0x1b0c010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 1524 start_va = 0x590000 end_va = 0x5a6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 1525 start_va = 0x1ad0000 end_va = 0x1d26fff monitored = 0 entry_point = 0x1cdce10 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 1526 start_va = 0x590000 end_va = 0x5a6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 1527 start_va = 0x1ad0000 end_va = 0x1d26fff monitored = 0 entry_point = 0x1cdce10 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 1528 start_va = 0x590000 end_va = 0x599fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1529 start_va = 0x1ad0000 end_va = 0x1be0fff monitored = 0 entry_point = 0x1bc1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1530 start_va = 0x590000 end_va = 0x599fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1531 start_va = 0x1ad0000 end_va = 0x1be0fff monitored = 0 entry_point = 0x1bc1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1532 start_va = 0x590000 end_va = 0x599fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1533 start_va = 0x1ad0000 end_va = 0x1be0fff monitored = 0 entry_point = 0x1bc1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1534 start_va = 0x590000 end_va = 0x599fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1535 start_va = 0x1ad0000 end_va = 0x1be0fff monitored = 0 entry_point = 0x1bc1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1536 start_va = 0x590000 end_va = 0x599fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1537 start_va = 0x1ad0000 end_va = 0x1be0fff monitored = 0 entry_point = 0x1bc1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1538 start_va = 0x590000 end_va = 0x599fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1539 start_va = 0x1ad0000 end_va = 0x1be0fff monitored = 0 entry_point = 0x1bc1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1540 start_va = 0x590000 end_va = 0x59ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 1541 start_va = 0x5a0000 end_va = 0x5adfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 1542 start_va = 0x590000 end_va = 0x59ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 1543 start_va = 0x5a0000 end_va = 0x5adfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 1544 start_va = 0x590000 end_va = 0x5a1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1545 start_va = 0x1610000 end_va = 0x16befff monitored = 0 entry_point = 0x1687000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1546 start_va = 0x590000 end_va = 0x5a1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1547 start_va = 0x1610000 end_va = 0x16befff monitored = 0 entry_point = 0x1687000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1548 start_va = 0x590000 end_va = 0x5a1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1549 start_va = 0x1610000 end_va = 0x16befff monitored = 0 entry_point = 0x1687000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1550 start_va = 0x590000 end_va = 0x5a1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1551 start_va = 0x1610000 end_va = 0x16befff monitored = 0 entry_point = 0x1687000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1552 start_va = 0x590000 end_va = 0x5a1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1553 start_va = 0x1610000 end_va = 0x16befff monitored = 0 entry_point = 0x1687000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1554 start_va = 0x590000 end_va = 0x5a1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1555 start_va = 0x1610000 end_va = 0x16befff monitored = 0 entry_point = 0x1687000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1556 start_va = 0x590000 end_va = 0x593fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1557 start_va = 0xd10000 end_va = 0xd70fff monitored = 0 entry_point = 0xd20770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1558 start_va = 0x590000 end_va = 0x593fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1559 start_va = 0xd10000 end_va = 0xd70fff monitored = 0 entry_point = 0xd20770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1560 start_va = 0x590000 end_va = 0x593fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1561 start_va = 0xd10000 end_va = 0xd70fff monitored = 0 entry_point = 0xd20770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1562 start_va = 0x590000 end_va = 0x593fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1563 start_va = 0xd10000 end_va = 0xd70fff monitored = 0 entry_point = 0xd20770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1564 start_va = 0x590000 end_va = 0x593fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1565 start_va = 0xd10000 end_va = 0xd70fff monitored = 0 entry_point = 0xd20770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1566 start_va = 0x590000 end_va = 0x593fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1567 start_va = 0xd10000 end_va = 0xd70fff monitored = 0 entry_point = 0xd20770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1568 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1569 start_va = 0x1ad0000 end_va = 0x1beffff monitored = 0 entry_point = 0x1bcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1570 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1571 start_va = 0x1ad0000 end_va = 0x1beffff monitored = 0 entry_point = 0x1bcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1572 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1573 start_va = 0x1ad0000 end_va = 0x1beffff monitored = 0 entry_point = 0x1bcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1574 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1575 start_va = 0x1ad0000 end_va = 0x1beffff monitored = 0 entry_point = 0x1bcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1576 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1577 start_va = 0x1ad0000 end_va = 0x1beffff monitored = 0 entry_point = 0x1bcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1578 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1579 start_va = 0x1ad0000 end_va = 0x1beffff monitored = 0 entry_point = 0x1bcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1580 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1581 start_va = 0x1ad0000 end_va = 0x1beffff monitored = 0 entry_point = 0x1bcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1582 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1583 start_va = 0x1ad0000 end_va = 0x1beffff monitored = 0 entry_point = 0x1bcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1584 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1585 start_va = 0x1ad0000 end_va = 0x1beffff monitored = 0 entry_point = 0x1bcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1586 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1587 start_va = 0x1ad0000 end_va = 0x1beffff monitored = 0 entry_point = 0x1bcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1588 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1589 start_va = 0x1ad0000 end_va = 0x1beffff monitored = 0 entry_point = 0x1bcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1590 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1591 start_va = 0x1ad0000 end_va = 0x1beffff monitored = 0 entry_point = 0x1bcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1592 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1593 start_va = 0x1ad0000 end_va = 0x1beffff monitored = 0 entry_point = 0x1bcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1594 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1595 start_va = 0x1ad0000 end_va = 0x1beffff monitored = 0 entry_point = 0x1bcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1596 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1597 start_va = 0x1ad0000 end_va = 0x1beffff monitored = 0 entry_point = 0x1bcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1598 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1599 start_va = 0x1ad0000 end_va = 0x1beffff monitored = 0 entry_point = 0x1bcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1600 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1601 start_va = 0x1ad0000 end_va = 0x1beffff monitored = 0 entry_point = 0x1bcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1602 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1603 start_va = 0x1ad0000 end_va = 0x1beffff monitored = 0 entry_point = 0x1bcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1604 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1605 start_va = 0x5a0000 end_va = 0x5b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1606 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1607 start_va = 0x5a0000 end_va = 0x5b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1608 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1609 start_va = 0x5a0000 end_va = 0x5b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1610 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1611 start_va = 0x5a0000 end_va = 0x5b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1612 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1613 start_va = 0x5a0000 end_va = 0x5b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1614 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1615 start_va = 0x5a0000 end_va = 0x5b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1616 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1617 start_va = 0x5a0000 end_va = 0x5b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1618 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1619 start_va = 0x5a0000 end_va = 0x5b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1620 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1621 start_va = 0x5a0000 end_va = 0x5b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1622 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1623 start_va = 0x5a0000 end_va = 0x5b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1624 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1625 start_va = 0x5a0000 end_va = 0x5b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1626 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1627 start_va = 0x5a0000 end_va = 0x5b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1628 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1629 start_va = 0x5a0000 end_va = 0x5b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1630 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1631 start_va = 0x5a0000 end_va = 0x5b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1632 start_va = 0x590000 end_va = 0x59ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mrxsmb.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\mrxsmb.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\mrxsmb.sys.mui") Region: id = 1633 start_va = 0xd10000 end_va = 0xd81fff monitored = 0 entry_point = 0xd67000 region_type = mapped_file name = "mrxsmb.sys" filename = "\\Windows\\System32\\drivers\\mrxsmb.sys" (normalized: "c:\\windows\\system32\\drivers\\mrxsmb.sys") Region: id = 1634 start_va = 0x590000 end_va = 0x59ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mrxsmb.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\mrxsmb.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\mrxsmb.sys.mui") Region: id = 1635 start_va = 0xd10000 end_va = 0xd81fff monitored = 0 entry_point = 0xd67000 region_type = mapped_file name = "mrxsmb.sys" filename = "\\Windows\\System32\\drivers\\mrxsmb.sys" (normalized: "c:\\windows\\system32\\drivers\\mrxsmb.sys") Region: id = 1636 start_va = 0x1ad0000 end_va = 0x1ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ad0000" filename = "" Region: id = 1637 start_va = 0x590000 end_va = 0x5a5fff monitored = 0 entry_point = 0x5a0420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1638 start_va = 0x5b0000 end_va = 0x5b2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1639 start_va = 0x590000 end_va = 0x5a5fff monitored = 0 entry_point = 0x5a0420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1640 start_va = 0x5b0000 end_va = 0x5b2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1641 start_va = 0x590000 end_va = 0x5a5fff monitored = 0 entry_point = 0x5a0420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1642 start_va = 0x5b0000 end_va = 0x5b2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1643 start_va = 0x590000 end_va = 0x5a5fff monitored = 0 entry_point = 0x5a0420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1644 start_va = 0x5b0000 end_va = 0x5b2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1645 start_va = 0x590000 end_va = 0x5a9fff monitored = 1 entry_point = 0x591190 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 1646 start_va = 0x5b0000 end_va = 0x5b5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 1647 start_va = 0x590000 end_va = 0x5a9fff monitored = 1 entry_point = 0x591190 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 1648 start_va = 0x5b0000 end_va = 0x5b5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 1649 start_va = 0x590000 end_va = 0x5bafff monitored = 0 entry_point = 0x5ad000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1650 start_va = 0x5c0000 end_va = 0x5c4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1651 start_va = 0x590000 end_va = 0x5bafff monitored = 0 entry_point = 0x5ad000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1652 start_va = 0x5c0000 end_va = 0x5c4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1653 start_va = 0x590000 end_va = 0x5bafff monitored = 0 entry_point = 0x5ad000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1654 start_va = 0x5c0000 end_va = 0x5c4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1655 start_va = 0x590000 end_va = 0x5bafff monitored = 0 entry_point = 0x5ad000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1656 start_va = 0x5c0000 end_va = 0x5c4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1657 start_va = 0x590000 end_va = 0x5b8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 1658 start_va = 0x1cd0000 end_va = 0x1db3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 1659 start_va = 0x590000 end_va = 0x5b8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 1660 start_va = 0x1cd0000 end_va = 0x1db3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 1661 start_va = 0x590000 end_va = 0x595fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 1662 start_va = 0x1610000 end_va = 0x16a2fff monitored = 0 entry_point = 0x1689000 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 1663 start_va = 0x590000 end_va = 0x595fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 1664 start_va = 0x1610000 end_va = 0x16a2fff monitored = 0 entry_point = 0x1689000 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 1665 start_va = 0x590000 end_va = 0x595fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fvevol.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui") Region: id = 1666 start_va = 0x1610000 end_va = 0x16b0fff monitored = 0 entry_point = 0x16a3000 region_type = mapped_file name = "fvevol.sys" filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys") Region: id = 1667 start_va = 0x590000 end_va = 0x595fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fvevol.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui") Region: id = 1668 start_va = 0x1610000 end_va = 0x16b0fff monitored = 0 entry_point = 0x16a3000 region_type = mapped_file name = "fvevol.sys" filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys") Region: id = 1669 start_va = 0x590000 end_va = 0x59afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1670 start_va = 0x1610000 end_va = 0x1695fff monitored = 0 entry_point = 0x1681000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1671 start_va = 0x590000 end_va = 0x59afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1672 start_va = 0x1610000 end_va = 0x1695fff monitored = 0 entry_point = 0x1681000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1673 start_va = 0x590000 end_va = 0x59afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1674 start_va = 0x1610000 end_va = 0x1695fff monitored = 0 entry_point = 0x1681000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1675 start_va = 0x590000 end_va = 0x59afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1676 start_va = 0x1610000 end_va = 0x1695fff monitored = 0 entry_point = 0x1681000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1677 start_va = 0x590000 end_va = 0x59efff monitored = 0 entry_point = 0x5936e0 region_type = mapped_file name = "dmvsc.sys" filename = "\\Windows\\System32\\drivers\\dmvsc.sys" (normalized: "c:\\windows\\system32\\drivers\\dmvsc.sys") Region: id = 1678 start_va = 0x5a0000 end_va = 0x5a1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dmvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\dmvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\dmvsc.sys.mui") Region: id = 1679 start_va = 0x590000 end_va = 0x5aafff monitored = 1 entry_point = 0x591190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1680 start_va = 0x5b0000 end_va = 0x5bbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1681 start_va = 0x590000 end_va = 0x5aafff monitored = 1 entry_point = 0x591190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1682 start_va = 0x5b0000 end_va = 0x5bbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1683 start_va = 0x590000 end_va = 0x5aafff monitored = 1 entry_point = 0x591190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1684 start_va = 0x5b0000 end_va = 0x5bbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1685 start_va = 0x590000 end_va = 0x5aafff monitored = 1 entry_point = 0x591190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1686 start_va = 0x5b0000 end_va = 0x5bbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1687 start_va = 0x590000 end_va = 0x5aafff monitored = 1 entry_point = 0x591190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1688 start_va = 0x5b0000 end_va = 0x5bbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1689 start_va = 0x590000 end_va = 0x5aafff monitored = 1 entry_point = 0x591190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1690 start_va = 0x5b0000 end_va = 0x5bbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1691 start_va = 0x590000 end_va = 0x5aafff monitored = 1 entry_point = 0x591190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1692 start_va = 0x5b0000 end_va = 0x5bbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1693 start_va = 0x590000 end_va = 0x591fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 1694 start_va = 0x1cd0000 end_va = 0x1ddefff monitored = 0 entry_point = 0x1d0c010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 1695 start_va = 0x590000 end_va = 0x591fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 1696 start_va = 0x1cd0000 end_va = 0x1ddefff monitored = 0 entry_point = 0x1d0c010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 1697 start_va = 0x590000 end_va = 0x5a6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 1698 start_va = 0x1cd0000 end_va = 0x1f26fff monitored = 0 entry_point = 0x1edce10 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 1699 start_va = 0x590000 end_va = 0x5a6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 1700 start_va = 0x1cd0000 end_va = 0x1f26fff monitored = 0 entry_point = 0x1edce10 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 1701 start_va = 0x590000 end_va = 0x599fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1702 start_va = 0x1cd0000 end_va = 0x1de0fff monitored = 0 entry_point = 0x1dc1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1703 start_va = 0x590000 end_va = 0x599fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1704 start_va = 0x1cd0000 end_va = 0x1de0fff monitored = 0 entry_point = 0x1dc1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1705 start_va = 0x590000 end_va = 0x599fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1706 start_va = 0x1cd0000 end_va = 0x1de0fff monitored = 0 entry_point = 0x1dc1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1707 start_va = 0x590000 end_va = 0x599fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1708 start_va = 0x1cd0000 end_va = 0x1de0fff monitored = 0 entry_point = 0x1dc1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1709 start_va = 0x590000 end_va = 0x599fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1710 start_va = 0x1cd0000 end_va = 0x1de0fff monitored = 0 entry_point = 0x1dc1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1711 start_va = 0x590000 end_va = 0x599fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1712 start_va = 0x1cd0000 end_va = 0x1de0fff monitored = 0 entry_point = 0x1dc1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1713 start_va = 0x590000 end_va = 0x59ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 1714 start_va = 0x5a0000 end_va = 0x5adfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 1715 start_va = 0x590000 end_va = 0x59ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 1716 start_va = 0x5a0000 end_va = 0x5adfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 1717 start_va = 0x590000 end_va = 0x59ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 1718 start_va = 0x5a0000 end_va = 0x5adfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 1719 start_va = 0x590000 end_va = 0x5a1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1720 start_va = 0x1610000 end_va = 0x16befff monitored = 0 entry_point = 0x1687000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1721 start_va = 0x590000 end_va = 0x5a1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1722 start_va = 0x1610000 end_va = 0x16befff monitored = 0 entry_point = 0x1687000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1723 start_va = 0x590000 end_va = 0x5a1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1724 start_va = 0x1610000 end_va = 0x16befff monitored = 0 entry_point = 0x1687000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1725 start_va = 0x590000 end_va = 0x5a1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1726 start_va = 0x1610000 end_va = 0x16befff monitored = 0 entry_point = 0x1687000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1727 start_va = 0x590000 end_va = 0x5a1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1728 start_va = 0x1610000 end_va = 0x16befff monitored = 0 entry_point = 0x1687000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1729 start_va = 0x590000 end_va = 0x5a1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1730 start_va = 0x1610000 end_va = 0x16befff monitored = 0 entry_point = 0x1687000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1731 start_va = 0x590000 end_va = 0x593fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1732 start_va = 0xd10000 end_va = 0xd70fff monitored = 0 entry_point = 0xd20770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1733 start_va = 0x590000 end_va = 0x593fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1734 start_va = 0xd10000 end_va = 0xd70fff monitored = 0 entry_point = 0xd20770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1735 start_va = 0x590000 end_va = 0x593fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1736 start_va = 0xd10000 end_va = 0xd70fff monitored = 0 entry_point = 0xd20770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1737 start_va = 0x590000 end_va = 0x593fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1738 start_va = 0xd10000 end_va = 0xd70fff monitored = 0 entry_point = 0xd20770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1739 start_va = 0x590000 end_va = 0x593fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1740 start_va = 0xd10000 end_va = 0xd70fff monitored = 0 entry_point = 0xd20770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1741 start_va = 0x590000 end_va = 0x593fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1742 start_va = 0xd10000 end_va = 0xd70fff monitored = 0 entry_point = 0xd20770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1743 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1744 start_va = 0x1cd0000 end_va = 0x1deffff monitored = 0 entry_point = 0x1dcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1745 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1746 start_va = 0x1cd0000 end_va = 0x1deffff monitored = 0 entry_point = 0x1dcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1747 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1748 start_va = 0x1cd0000 end_va = 0x1deffff monitored = 0 entry_point = 0x1dcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1749 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1750 start_va = 0x1cd0000 end_va = 0x1deffff monitored = 0 entry_point = 0x1dcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1751 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1752 start_va = 0x1cd0000 end_va = 0x1deffff monitored = 0 entry_point = 0x1dcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1753 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1754 start_va = 0x1cd0000 end_va = 0x1deffff monitored = 0 entry_point = 0x1dcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1755 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1756 start_va = 0x1cd0000 end_va = 0x1deffff monitored = 0 entry_point = 0x1dcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1757 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1758 start_va = 0x1cd0000 end_va = 0x1deffff monitored = 0 entry_point = 0x1dcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1759 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1760 start_va = 0x1cd0000 end_va = 0x1deffff monitored = 0 entry_point = 0x1dcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1761 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1762 start_va = 0x1cd0000 end_va = 0x1deffff monitored = 0 entry_point = 0x1dcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1763 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1764 start_va = 0x1cd0000 end_va = 0x1deffff monitored = 0 entry_point = 0x1dcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1765 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1766 start_va = 0x1cd0000 end_va = 0x1deffff monitored = 0 entry_point = 0x1dcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1767 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1768 start_va = 0x1cd0000 end_va = 0x1deffff monitored = 0 entry_point = 0x1dcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1769 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1770 start_va = 0x1cd0000 end_va = 0x1deffff monitored = 0 entry_point = 0x1dcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1771 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1772 start_va = 0x1cd0000 end_va = 0x1deffff monitored = 0 entry_point = 0x1dcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1773 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1774 start_va = 0x1cd0000 end_va = 0x1deffff monitored = 0 entry_point = 0x1dcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1775 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1776 start_va = 0x1cd0000 end_va = 0x1deffff monitored = 0 entry_point = 0x1dcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1777 start_va = 0x590000 end_va = 0x5a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1778 start_va = 0x1cd0000 end_va = 0x1deffff monitored = 0 entry_point = 0x1dcc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1779 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1780 start_va = 0x5a0000 end_va = 0x5b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1781 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1782 start_va = 0x5a0000 end_va = 0x5b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1783 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1784 start_va = 0x5a0000 end_va = 0x5b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1785 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1786 start_va = 0x5a0000 end_va = 0x5b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1787 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1788 start_va = 0x5a0000 end_va = 0x5b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1789 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1790 start_va = 0x5a0000 end_va = 0x5b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1791 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1792 start_va = 0x5a0000 end_va = 0x5b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1793 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1794 start_va = 0x5a0000 end_va = 0x5b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1795 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1796 start_va = 0x5a0000 end_va = 0x5b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1797 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1798 start_va = 0x5a0000 end_va = 0x5b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1799 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1800 start_va = 0x5a0000 end_va = 0x5b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1801 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1802 start_va = 0x5a0000 end_va = 0x5b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1803 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1804 start_va = 0x5a0000 end_va = 0x5b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1805 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1806 start_va = 0x5a0000 end_va = 0x5b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1807 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1808 start_va = 0x5a0000 end_va = 0x5b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1809 start_va = 0x590000 end_va = 0x59ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mrxsmb.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\mrxsmb.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\mrxsmb.sys.mui") Region: id = 1810 start_va = 0xd10000 end_va = 0xd81fff monitored = 0 entry_point = 0xd67000 region_type = mapped_file name = "mrxsmb.sys" filename = "\\Windows\\System32\\drivers\\mrxsmb.sys" (normalized: "c:\\windows\\system32\\drivers\\mrxsmb.sys") Region: id = 1811 start_va = 0x590000 end_va = 0x59ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mrxsmb.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\mrxsmb.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\mrxsmb.sys.mui") Region: id = 1812 start_va = 0xd10000 end_va = 0xd81fff monitored = 0 entry_point = 0xd67000 region_type = mapped_file name = "mrxsmb.sys" filename = "\\Windows\\System32\\drivers\\mrxsmb.sys" (normalized: "c:\\windows\\system32\\drivers\\mrxsmb.sys") Region: id = 1813 start_va = 0x7ffda0bc0000 end_va = 0x7ffda0bcdfff monitored = 0 entry_point = 0x7ffda0bc2b10 region_type = mapped_file name = "perfos.dll" filename = "\\Windows\\System32\\perfos.dll" (normalized: "c:\\windows\\system32\\perfos.dll") Region: id = 1821 start_va = 0x590000 end_va = 0x592fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000590000" filename = "" Region: id = 1822 start_va = 0x7ffda17d0000 end_va = 0x7ffda1807fff monitored = 0 entry_point = 0x7ffda17e8cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1823 start_va = 0x7ffda8b90000 end_va = 0x7ffda8b97fff monitored = 0 entry_point = 0x7ffda8b91ea0 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1824 start_va = 0x1610000 end_va = 0x168ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001610000" filename = "" Region: id = 1825 start_va = 0x7ffda17b0000 end_va = 0x7ffda17c5fff monitored = 0 entry_point = 0x7ffda17b19f0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1826 start_va = 0x7ffda1790000 end_va = 0x7ffda17a9fff monitored = 0 entry_point = 0x7ffda1792430 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1827 start_va = 0x7ffda6620000 end_va = 0x7ffda66c9fff monitored = 0 entry_point = 0x7ffda6647910 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2243 start_va = 0x5a0000 end_va = 0x5a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005a0000" filename = "" Thread: id = 115 os_tid = 0x125c Thread: id = 116 os_tid = 0x134c Thread: id = 117 os_tid = 0xea4 Thread: id = 118 os_tid = 0x890 Thread: id = 119 os_tid = 0xe48 [0248.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x128ff60 | out: lpSystemTimeAsFileTime=0x128ff60*(dwLowDateTime=0x20cfe5db, dwHighDateTime=0x1d86049)) [0248.416] free (_Block=0xdaf820) [0248.416] FreeLibrary (hLibModule=0x180000000) returned 1 [0248.421] free (_Block=0xdb1920) [0248.422] free (_Block=0xdacb00) [0248.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x128ff60 | out: lpSystemTimeAsFileTime=0x128ff60*(dwLowDateTime=0x20d0f609, dwHighDateTime=0x1d86049)) [0248.422] free (_Block=0xdb5d60) [0248.422] FreeLibrary (hLibModule=0x580000) returned 1 [0248.429] free (_Block=0xdacf60) [0248.429] free (_Block=0xdb5060) [0248.430] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x128ff60 | out: lpSystemTimeAsFileTime=0x128ff60*(dwLowDateTime=0x20d21a58, dwHighDateTime=0x1d86049)) [0248.430] free (_Block=0xdb5d40) [0248.430] FreeLibrary (hLibModule=0x7ffdab590000) returned 1 [0248.430] free (_Block=0xd9d320) [0248.430] free (_Block=0xdb4c50) [0248.430] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x128ff60 | out: lpSystemTimeAsFileTime=0x128ff60*(dwLowDateTime=0x20d22e94, dwHighDateTime=0x1d86049)) [0248.430] free (_Block=0xdb5d20) [0248.431] FreeLibrary (hLibModule=0x7ffda8a30000) returned 1 [0248.431] free (_Block=0xdb53c0) [0248.431] free (_Block=0xdb51a0) [0248.431] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x128ff60 | out: lpSystemTimeAsFileTime=0x128ff60*(dwLowDateTime=0x20d241ec, dwHighDateTime=0x1d86049)) [0248.431] free (_Block=0xdaf7a0) [0248.431] FreeLibrary (hLibModule=0x7ffda8970000) returned 1 [0248.447] free (_Block=0xd9cb70) [0248.448] free (_Block=0xdb4c00) [0248.448] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x128ff60 | out: lpSystemTimeAsFileTime=0x128ff60*(dwLowDateTime=0x20d4d9da, dwHighDateTime=0x1d86049)) [0248.448] free (_Block=0xdb63c0) [0248.448] FreeLibrary (hLibModule=0x7ffda8100000) returned 1 [0248.448] free (_Block=0xd9d1c0) [0248.448] free (_Block=0xdb4de0) [0248.449] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 120 os_tid = 0xe3c [0198.760] LoadStringW (in: hInstance=0x7ffd8ecc0000, uID=0x3e, lpBuffer=0x118d6c0, cchBufferMax=256 | out: lpBuffer="Base Board") returned 0xa [0198.760] lstrlenW (lpString="Dell Inc.") returned 9 [0198.760] lstrlenW (lpString="0G3HR7") returned 6 [0198.760] lstrlenW (lpString="A00") returned 3 [0198.760] lstrlenW (lpString="..XXXXXXXXXXXXX.") returned 16 [0201.388] malloc (_Size=0x600) returned 0xdb8430 [0201.388] GetLogicalProcessorInformationEx (in: RelationshipType=0xffff, Buffer=0x0, ReturnedLength=0x118d7f8 | out: Buffer=0x0, ReturnedLength=0x118d7f8) returned 0 [0201.388] GetLastError () returned 0x7a [0201.388] malloc (_Size=0x250) returned 0xdb5890 [0201.389] GetLogicalProcessorInformationEx (in: RelationshipType=0xffff, Buffer=0xdb5890, ReturnedLength=0x118d7f8 | out: Buffer=0xdb5890, ReturnedLength=0x118d7f8) returned 1 [0201.389] GetActiveProcessorCount (GroupNumber=0xffff) returned 0x4 [0201.389] GetMaximumProcessorGroupCount () returned 0x1 [0201.389] malloc (_Size=0x40) returned 0xdb5100 [0201.389] malloc (_Size=0x40) returned 0xdb4ca0 [0201.389] malloc (_Size=0x8) returned 0xdb5730 [0201.389] memcpy (in: _Dst=0xdb5100, _Src=0xdb58b0, _Size=0x10 | out: _Dst=0xdb5100) returned 0xdb5100 [0201.399] GetActiveProcessorCount (GroupNumber=0x0) returned 0x4 [0201.399] NtPowerInformation (in: InformationLevel=0x2e, InputBuffer=0x118d7f0, InputBufferLength=0x2, OutputBuffer=0xdb8430, OutputBufferLength=0x60 | out: OutputBuffer=0xdb8430) returned 0x0 [0201.399] _vsnwprintf (in: _Buffer=0x118d690, _BufferCount=0x63, _Format="CPU%d", _ArgList=0x118cf88 | out: _Buffer="CPU0") returned 4 [0201.400] GetCurrentThread () returned 0xfffffffffffffffe [0201.400] SetThreadGroupAffinity (in: hThread=0xfffffffffffffffe, GroupAffinity=0x118cee0, PreviousGroupAffinity=0x118cef0 | out: PreviousGroupAffinity=0x118cef0) returned 1 [0201.401] GetSystemInfo (in: lpSystemInfo=0x118d020 | out: lpSystemInfo=0x118d020*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0201.401] mbstowcs (in: _Dest=0x118d2a8, _Source="GenuineIntel", _MaxCount=0x28 | out: _Dest="GenuineIntel") returned 0xc [0201.401] _wcsicmp (_String1="GenuineIntel", _String2="GenuineIntel") returned 0 [0201.403] mbstowcs (in: _Dest=0x118d118, _Source="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", _MaxCount=0x28 | out: _Dest="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x27 [0201.403] GetCurrentThread () returned 0xfffffffffffffffe [0201.403] SetThreadGroupAffinity (in: hThread=0xfffffffffffffffe, GroupAffinity=0x118cef0, PreviousGroupAffinity=0x0 | out: PreviousGroupAffinity=0x0) returned 1 [0201.403] LoadStringW (in: hInstance=0x7ffd8ecc0000, uID=0x2c, lpBuffer=0x118ccf0, cchBufferMax=256 | out: lpBuffer="CPU %d") returned 0x6 [0211.365] malloc (_Size=0x34c34) returned 0xdd6f00 [0211.379] _wtoi (_String="238") returned 238 [0211.380] _wtoi (_String="6") returned 6 [0211.380] _itow (in: _Dest=0x0, _Radix=18404800 | out: _Dest=0x0) returned="0" [0211.380] _itow (in: _Dest=0xee, _Radix=18403088 | out: _Dest=0xee) returned="238" [0211.380] malloc (_Size=0x4000) returned 0xe0bb40 [0211.380] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x0, lpData=0xe0bb40, lpcbData=0x118cee4*=0x4000 | out: lpType=0x0, lpData=0xe0bb40*=0x50, lpcbData=0x118cee4*=0x600) returned 0x0 [0211.536] free (_Block=0xe0bb40) [0211.536] Sleep (dwMilliseconds=0x3e8) [0212.538] _itow (in: _Dest=0xee, _Radix=18403088 | out: _Dest=0xee) returned="238" [0212.538] malloc (_Size=0x4000) returned 0xe0bb40 [0212.538] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x0, lpData=0xe0bb40, lpcbData=0x118cee4*=0x4000 | out: lpType=0x0, lpData=0xe0bb40*=0x50, lpcbData=0x118cee4*=0x600) returned 0x0 [0212.608] free (_Block=0xe0bb40) [0212.610] free (_Block=0xdd6f00) [0212.617] _vsnwprintf (in: _Buffer=0x118d5c0, _BufferCount=0x40, _Format="%04X%04X%04X%04X", _ArgList=0x118cf88 | out: _Buffer="0F8BFBFF00050654") returned 16 [0212.619] lstrlenW (lpString=" 0") returned 2 [0212.619] lstrlenW (lpString="Intel(R) Xeon(R) Gold 6126 CPU @ 2.60GHz") returned 40 [0212.620] lstrlenW (lpString="") returned 0 [0212.620] lstrlenW (lpString="") returned 0 [0212.620] lstrlenW (lpString="") returned 0 [0212.622] IsProcessorFeaturePresent (ProcessorFeature=0x14) returned 1 [0212.622] IsProcessorFeaturePresent (ProcessorFeature=0x15) returned 1 [0212.623] RtlNumberOfSetBitsUlongPtr (Target=0x1) returned 0x1 [0212.623] RtlNumberOfSetBitsUlongPtr (Target=0x2) returned 0x1 [0212.623] RtlNumberOfSetBitsUlongPtr (Target=0x4) returned 0x1 [0212.623] RtlNumberOfSetBitsUlongPtr (Target=0x8) returned 0x1 [0212.623] _vsnwprintf (in: _Buffer=0x118d880, _BufferCount=0x63, _Format="CPU%d", _ArgList=0x118d7c8 | out: _Buffer="CPU0") returned 4 [0212.625] free (_Block=0xdb5730) [0212.625] free (_Block=0xdb4ca0) [0212.626] free (_Block=0xdb5100) [0212.626] free (_Block=0xdb5890) [0212.626] free (_Block=0xdb8430) [0212.942] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7ffd8ee77f20 | out: lpflOldProtect=0x7ffd8ee77f20*=0x2) returned 1 [0212.943] LoadLibraryExA (lpLibFileName="IPHLPAPI.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffda17d0000 [0212.951] GetProcAddress (hModule=0x7ffda17d0000, lpProcName="GetAdaptersAddresses") returned 0x7ffda17d2a20 [0212.951] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0x118d8e0 | out: lpflOldProtect=0x118d8e0*=0x4) returned 1 [0212.952] GetAdaptersAddresses (in: Family=0x0, Flags=0x0, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x118d9b8*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x118d9b8*=0x1128) returned 0x6f [0212.988] malloc (_Size=0x1128) returned 0xdb8430 [0212.988] GetAdaptersAddresses (in: Family=0x0, Flags=0x0, Reserved=0x0, AdapterAddresses=0xdb8430, SizePointer=0x118d9b8*=0x1128 | out: AdapterAddresses=0xdb8430*(Alignment=0x7000001c0, Length=0x1c0, IfIndex=0x7, Next=0xdb89f0, AdapterName="{E96D977E-F067-4CE9-924D-F6E0A04729E4}", FirstUnicastAddress=0xdb86a0, FirstAnycastAddress=0x0, FirstMulticastAddress=0xdb8750, FirstDnsServerAddress=0xdb89c0, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #2", FriendlyName="Ethernet 2", PhysicalAddress=([0]=0x38, [1]=0x6e, [2]=0x21, [3]=0x4a, [4]=0x9f, [5]=0x7d, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x1c5, DdnsEnabled=0x1c5, RegisterAdapterSuffix=0x1c5, Dhcpv4Enabled=0x1c5, ReceiveOnly=0x1c5, NoMulticast=0x1c5, Ipv6OtherStatefulConfig=0x1c5, NetbiosOverTcpipEnabled=0x1c5, Ipv4Enabled=0x1c5, Ipv6Enabled=0x1c5, Ipv6ManagedAddressConfigurationSupported=0x1c5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x7, ZoneIndices=([0]=0x7, [1]=0x7, [2]=0x7, [3]=0x7, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6008002000000, Dhcpv4Server.lpSockaddr=0xdb85f0*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11eb6c9dc20d55b0, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x28, [5]=0xb6, [6]=0x28, [7]=0x5e, [8]=0x0, [9]=0xf, [10]=0xf3, [11]=0xe1, [12]=0x61, [13]=0x38, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x6000ff3, FirstDnsSuffix=0x0), SizePointer=0x118d9b8*=0x1128) returned 0x0 [0213.041] malloc (_Size=0x68) returned 0xdb0490 [0213.042] memcpy (in: _Dst=0xdb04dc, _Src=0xdb8480, _Size=0x6 | out: _Dst=0xdb04dc) returned 0xdb04dc [0213.042] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7ffd8ee77f20 | out: lpflOldProtect=0x7ffd8ee77f20*=0x2) returned 1 [0213.042] GetProcAddress (hModule=0x7ffda17d0000, lpProcName="GetIpForwardTable2") returned 0x7ffda17da540 [0213.042] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0x118d850 | out: lpflOldProtect=0x118d850*=0x4) returned 1 [0213.043] GetIpForwardTable2 () returned 0x0 [0213.044] malloc (_Size=0x20) returned 0xdb67e0 [0213.044] RtlIpv6AddressToStringW () returned 0x118d812 [0213.044] malloc (_Size=0x20) returned 0xdb6a50 [0213.044] RtlIpv4AddressToStringW () returned 0x118d7f8 [0213.044] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7ffd8ee77f20 | out: lpflOldProtect=0x7ffd8ee77f20*=0x2) returned 1 [0213.045] GetProcAddress (hModule=0x7ffda17d0000, lpProcName="ConvertLengthToIpv4Mask") returned 0x7ffda17d1c40 [0213.045] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0x118d740 | out: lpflOldProtect=0x118d740*=0x4) returned 1 [0213.046] ConvertLengthToIpv4Mask (in: MaskLength=0x18, Mask=0x118d7c8 | out: Mask=0x118d7c8) returned 0x0 [0213.046] RtlIpv4AddressToStringW () returned 0x118d7fa [0213.046] malloc (_Size=0x20) returned 0xdb6960 [0213.046] RtlIpv4AddressToStringW () returned 0x118d7f6 [0213.046] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7ffd8ee77f20 | out: lpflOldProtect=0x7ffd8ee77f20*=0x2) returned 1 [0213.046] GetProcAddress (hModule=0x7ffda17d0000, lpProcName="FreeMibTable") returned 0x7ffda17d2840 [0213.046] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0x118d850 | out: lpflOldProtect=0x118d850*=0x4) returned 1 [0213.047] FreeMibTable () returned 0x1 [0213.047] malloc (_Size=0x68) returned 0xdb0110 [0213.047] GetIpForwardTable2 () returned 0x0 [0213.048] malloc (_Size=0x20) returned 0xdb6ae0 [0213.048] RtlIpv6AddressToStringW () returned 0x118d7e6 [0213.048] malloc (_Size=0x20) returned 0xdb6810 [0213.048] RtlIpv4AddressToStringW () returned 0x118d7f2 [0213.048] ConvertLengthToIpv4Mask (in: MaskLength=0x8, Mask=0x118d7c8 | out: Mask=0x118d7c8) returned 0x0 [0213.048] RtlIpv4AddressToStringW () returned 0x118d7f2 [0213.048] FreeMibTable () returned 0x1 [0213.048] malloc (_Size=0x68) returned 0xdb03b0 [0213.048] malloc (_Size=0x68) returned 0xdb6cd0 [0213.049] memcpy (in: _Dst=0xdb6d1c, _Src=0xdb91c8, _Size=0x8 | out: _Dst=0xdb6d1c) returned 0xdb6d1c [0213.049] GetIpForwardTable2 () returned 0x0 [0213.051] malloc (_Size=0x20) returned 0xdb66c0 [0213.051] RtlIpv6AddressToStringW () returned 0x118d828 [0213.051] malloc (_Size=0x20) returned 0xdb68a0 [0213.051] RtlIpv6AddressToStringW () returned 0x118d812 [0213.051] malloc (_Size=0x20) returned 0xdb6b40 [0213.051] RtlIpv6AddressToStringW () returned 0x118d7e4 [0213.052] FreeMibTable () returned 0x1 [0213.052] free (_Block=0xdb8430) [0213.053] _vsnwprintf (in: _Buffer=0x118d6f0, _BufferCount=0x105, _Format="SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}", _ArgList=0x118c708 | out: _Buffer="SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}") returned 77 [0213.055] _wtol (_String="0000") returned 0 [0213.061] malloc (_Size=0x48) returned 0xdb4ca0 [0213.063] _wtol (_String="0001") returned 1 [0213.068] malloc (_Size=0x48) returned 0xdb4e80 [0213.070] _wtol (_String="0002") returned 2 [0213.072] malloc (_Size=0x48) returned 0xdb4ed0 [0213.073] _wtol (_String="0003") returned 3 [0213.074] malloc (_Size=0x48) returned 0xdb4d90 [0213.076] _wtol (_String="0004") returned 4 [0213.078] malloc (_Size=0x48) returned 0xdb5100 [0213.079] _wtol (_String="0005") returned 5 [0213.081] malloc (_Size=0x48) returned 0xdb4f20 [0213.082] _wtol (_String="Configuration") returned 0 [0213.083] _wtol (_String="Properties") returned 0 [0213.094] QueryDosDeviceW (in: lpDeviceName="{017EF944-8C88-42C3-8F92-C8F7B6022F8D}", lpTargetPath=0x118c410, ucchMax=0x200 | out: lpTargetPath="뤁￿") returned 0x0 [0213.095] GetLastError () returned 0x2 [0213.095] DefineDosDeviceW (dwFlags=0x1, lpDeviceName="{017EF944-8C88-42C3-8F92-C8F7B6022F8D}", lpTargetPath="\\Device\\{017EF944-8C88-42C3-8F92-C8F7B6022F8D}") returned 1 [0213.104] CreateFileW (lpFileName="\\\\.\\{017EF944-8C88-42C3-8F92-C8F7B6022F8D}" (normalized: "{017ef944-8c88-42c3-8f92-c8f7b6022f8d}"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0xffffffffffffffff) returned 0xffffffffffffffff [0213.105] DefineDosDeviceW (dwFlags=0x7, lpDeviceName="{017EF944-8C88-42C3-8F92-C8F7B6022F8D}", lpTargetPath="\\Device\\{017EF944-8C88-42C3-8F92-C8F7B6022F8D}") returned 1 [0213.109] LoadLibraryExW (lpLibFileName="iphlpapi.dll", hFile=0x0, dwFlags=0x0) returned 0x7ffda17d0000 [0213.109] GetProcAddress (hModule=0x7ffda17d0000, lpProcName="GetAdapterIndex") returned 0x7ffda17eddb0 [0213.110] GetAdapterIndex (in: AdapterName="\\DEVICE\\TCPIP_{017EF944-8C88-42C3-8F92-C8F7B6022F8D}", IfIndex=0x118d980 | out: IfIndex=0x118d980) returned 0x0 [0213.110] FreeLibrary (hLibModule=0x7ffda17d0000) returned 1 [0213.111] QueryDosDeviceW (in: lpDeviceName="{E25A642B-6CEB-4194-8F83-8BC82AF94F5A}", lpTargetPath=0x118c410, ucchMax=0x200 | out: lpTargetPath="") returned 0x0 [0213.111] GetLastError () returned 0x2 [0213.112] DefineDosDeviceW (dwFlags=0x1, lpDeviceName="{E25A642B-6CEB-4194-8F83-8BC82AF94F5A}", lpTargetPath="\\Device\\{E25A642B-6CEB-4194-8F83-8BC82AF94F5A}") returned 1 [0213.119] CreateFileW (lpFileName="\\\\.\\{E25A642B-6CEB-4194-8F83-8BC82AF94F5A}" (normalized: "{e25a642b-6ceb-4194-8f83-8bc82af94f5a}"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0xffffffffffffffff) returned 0xffffffffffffffff [0213.120] DefineDosDeviceW (dwFlags=0x7, lpDeviceName="{E25A642B-6CEB-4194-8F83-8BC82AF94F5A}", lpTargetPath="\\Device\\{E25A642B-6CEB-4194-8F83-8BC82AF94F5A}") returned 1 [0213.124] LoadLibraryExW (lpLibFileName="iphlpapi.dll", hFile=0x0, dwFlags=0x0) returned 0x7ffda17d0000 [0213.124] GetProcAddress (hModule=0x7ffda17d0000, lpProcName="GetAdapterIndex") returned 0x7ffda17eddb0 [0213.124] GetAdapterIndex (in: AdapterName="\\DEVICE\\TCPIP_{E25A642B-6CEB-4194-8F83-8BC82AF94F5A}", IfIndex=0x118d980 | out: IfIndex=0x118d980) returned 0x0 [0213.125] FreeLibrary (hLibModule=0x7ffda17d0000) returned 1 [0213.125] QueryDosDeviceW (in: lpDeviceName="{9E8A7ED5-49C8-421B-A782-D46C28931105}", lpTargetPath=0x118c410, ucchMax=0x200 | out: lpTargetPath="\\Device\\NDMP7") returned 0xf [0213.125] CreateFileW (lpFileName="\\\\.\\{9E8A7ED5-49C8-421B-A782-D46C28931105}" (normalized: "\\device\\ndmp7"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0xffffffffffffffff) returned 0x454 [0213.126] DeviceIoControl (in: hDevice=0x454, dwIoControlCode=0x170002, lpInBuffer=0x118c870*, nInBufferSize=0x4, lpOutBuffer=0x118c8b0, nOutBufferSize=0x1000, lpBytesReturned=0x118c874, lpOverlapped=0x0 | out: lpInBuffer=0x118c870*, lpOutBuffer=0x118c8b0*, lpBytesReturned=0x118c874*=0x4, lpOverlapped=0x0) returned 1 [0213.126] DeviceIoControl (in: hDevice=0x454, dwIoControlCode=0x170002, lpInBuffer=0x118c870*, nInBufferSize=0x4, lpOutBuffer=0x118c8b0, nOutBufferSize=0x1000, lpBytesReturned=0x118c874, lpOverlapped=0x0 | out: lpInBuffer=0x118c870*, lpOutBuffer=0x118c8b0*, lpBytesReturned=0x118c874*=0xc, lpOverlapped=0x0) returned 1 [0213.126] CloseHandle (hObject=0x454) returned 1 [0213.128] LoadLibraryExW (lpLibFileName="iphlpapi.dll", hFile=0x0, dwFlags=0x0) returned 0x7ffda17d0000 [0213.128] GetProcAddress (hModule=0x7ffda17d0000, lpProcName="GetAdapterIndex") returned 0x7ffda17eddb0 [0213.128] GetAdapterIndex (in: AdapterName="\\DEVICE\\TCPIP_{9E8A7ED5-49C8-421B-A782-D46C28931105}", IfIndex=0x118d980 | out: IfIndex=0x118d980) returned 0x0 [0213.129] FreeLibrary (hLibModule=0x7ffda17d0000) returned 1 [0213.129] QueryDosDeviceW (in: lpDeviceName="{C2998852-8A8B-426B-AAB1-8880E47F8B1A}", lpTargetPath=0x118c410, ucchMax=0x200 | out: lpTargetPath="\\Device\\NDMP6") returned 0xf [0213.130] CreateFileW (lpFileName="\\\\.\\{C2998852-8A8B-426B-AAB1-8880E47F8B1A}" (normalized: "\\device\\ndmp6"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0xffffffffffffffff) returned 0x454 [0213.130] DeviceIoControl (in: hDevice=0x454, dwIoControlCode=0x170002, lpInBuffer=0x118c870*, nInBufferSize=0x4, lpOutBuffer=0x118c8b0, nOutBufferSize=0x1000, lpBytesReturned=0x118c874, lpOverlapped=0x0 | out: lpInBuffer=0x118c870*, lpOutBuffer=0x118c8b0*, lpBytesReturned=0x118c874*=0x4, lpOverlapped=0x0) returned 1 [0213.130] DeviceIoControl (in: hDevice=0x454, dwIoControlCode=0x170002, lpInBuffer=0x118c870*, nInBufferSize=0x4, lpOutBuffer=0x118c8b0, nOutBufferSize=0x1000, lpBytesReturned=0x118c874, lpOverlapped=0x0 | out: lpInBuffer=0x118c870*, lpOutBuffer=0x118c8b0*, lpBytesReturned=0x118c874*=0x20, lpOverlapped=0x0) returned 1 [0213.130] CloseHandle (hObject=0x454) returned 1 [0213.132] LoadLibraryExW (lpLibFileName="iphlpapi.dll", hFile=0x0, dwFlags=0x0) returned 0x7ffda17d0000 [0213.132] GetProcAddress (hModule=0x7ffda17d0000, lpProcName="GetAdapterIndex") returned 0x7ffda17eddb0 [0213.133] GetAdapterIndex (in: AdapterName="\\DEVICE\\TCPIP_{C2998852-8A8B-426B-AAB1-8880E47F8B1A}", IfIndex=0x118d980 | out: IfIndex=0x118d980) returned 0x0 [0213.133] FreeLibrary (hLibModule=0x7ffda17d0000) returned 1 [0213.133] QueryDosDeviceW (in: lpDeviceName="{E96D977E-F067-4CE9-924D-F6E0A04729E4}", lpTargetPath=0x118c410, ucchMax=0x200 | out: lpTargetPath="\\Device\\NDMP4") returned 0xf [0213.134] CreateFileW (lpFileName="\\\\.\\{E96D977E-F067-4CE9-924D-F6E0A04729E4}" (normalized: "\\device\\ndmp4"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0xffffffffffffffff) returned 0x454 [0213.134] DeviceIoControl (in: hDevice=0x454, dwIoControlCode=0x170002, lpInBuffer=0x118c870*, nInBufferSize=0x4, lpOutBuffer=0x118c8b0, nOutBufferSize=0x1000, lpBytesReturned=0x118c874, lpOverlapped=0x0 | out: lpInBuffer=0x118c870*, lpOutBuffer=0x118c8b0*, lpBytesReturned=0x118c874*=0x4, lpOverlapped=0x0) returned 1 [0213.134] DeviceIoControl (in: hDevice=0x454, dwIoControlCode=0x170002, lpInBuffer=0x118c870*, nInBufferSize=0x4, lpOutBuffer=0x118c8b0, nOutBufferSize=0x1000, lpBytesReturned=0x118c874, lpOverlapped=0x0 | out: lpInBuffer=0x118c870*, lpOutBuffer=0x118c8b0*, lpBytesReturned=0x118c874*=0x6, lpOverlapped=0x0) returned 1 [0213.134] CloseHandle (hObject=0x454) returned 1 [0213.137] malloc (_Size=0x18) returned 0xdb5dc0 [0213.137] malloc (_Size=0x18) returned 0xdb6160 [0213.137] SafeArrayPutElement (psa=0x4cfd80, rgIndices=0x118d570, pv=0x4a6298) returned 0x0 [0213.137] malloc (_Size=0x18) returned 0xdb62c0 [0213.137] SafeArrayPutElement (psa=0x4cf700, rgIndices=0x118d570, pv=0x4cf8f8) returned 0x0 [0213.137] free (_Block=0xdb62c0) [0213.137] free (_Block=0xdb6160) [0213.137] malloc (_Size=0x18) returned 0xdb6300 [0213.137] SafeArrayPutElement (psa=0x4cfd80, rgIndices=0x118d570, pv=0x4a6298) returned 0x0 [0213.137] malloc (_Size=0x18) returned 0xdb5e20 [0213.137] SafeArrayPutElement (psa=0x4cf700, rgIndices=0x118d570, pv=0x4d0cd8) returned 0x0 [0213.138] free (_Block=0xdb5e20) [0213.138] free (_Block=0xdb6300) [0213.138] free (_Block=0xdb5dc0) [0213.139] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7ffd8ee77f20 | out: lpflOldProtect=0x7ffd8ee77f20*=0x2) returned 1 [0213.139] GetProcAddress (hModule=0x7ffda8cc0000, lpProcName=0x10) returned 0x7ffda8cd0e10 [0213.140] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0x118d420 | out: lpflOldProtect=0x118d420*=0x4) returned 1 [0213.140] malloc (_Size=0x18) returned 0xdb62c0 [0213.140] SafeArrayPutElement (psa=0x4cfb00, rgIndices=0x118d570, pv=0x4d0cd8) returned 0x0 [0213.140] SafeArrayPutElement (psa=0x4cfa40, rgIndices=0x118d570, pv=0xdb697c) returned 0x0 [0213.140] free (_Block=0xdb62c0) [0213.141] _wtol (_String="1650995039") returned 1650995039 [0213.141] _wtol (_String="1650991439") returned 1650991439 [0213.146] GetProcessHeap () returned 0x470000 [0213.146] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x1c0) returned 0x5692a0 [0213.146] GetAdaptersAddresses (in: Family=0x0, Flags=0x6f, Reserved=0x0, AdapterAddresses=0x5692a0, SizePointer=0x118d0c0*=0x1c0 | out: AdapterAddresses=0x5692a0*(Alignment=0x0, Length=0x0, IfIndex=0x0, Next=0x0, AdapterName=0x0, FirstUnicastAddress=0x0, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix=0x0, Description=0x0, FriendlyName=0x0, PhysicalAddress=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x0, Flags=0x0, DdnsEnabled=0x0, RegisterAdapterSuffix=0x0, Dhcpv4Enabled=0x0, ReceiveOnly=0x0, NoMulticast=0x0, Ipv6OtherStatefulConfig=0x0, NetbiosOverTcpipEnabled=0x0, Ipv4Enabled=0x0, Ipv6Enabled=0x0, Ipv6ManagedAddressConfigurationSupported=0x0, Mtu=0x0, IfType=0x0, OperStatus=0x0, Ipv6IfIndex=0x0, ZoneIndices=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0), FirstPrefix=0x0, TransmitLinkSpeed=0x0, ReceiveLinkSpeed=0x0, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0x0, Ipv6Metric=0x0, Luid=0x0, Dhcpv4Server.lpSockaddr=0x0, Dhcpv4Server.iSockaddrLength=0, CompartmentId=0x0, NetworkGuid=0x0, ConnectionType=0x0, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0x0, Dhcpv6Iaid=0x0, FirstDnsSuffix=0x0), SizePointer=0x118d0c0*=0x9a8) returned 0x6f [0213.152] GetProcessHeap () returned 0x470000 [0213.152] RtlFreeHeap (HeapHandle=0x470000, Flags=0x0, BaseAddress=0x5692a0) returned 1 [0213.152] GetProcessHeap () returned 0x470000 [0213.153] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x9a8) returned 0xf07840 [0213.153] GetAdaptersAddresses (in: Family=0x0, Flags=0x6f, Reserved=0x0, AdapterAddresses=0xf07840, SizePointer=0x118d0c0*=0x9a8 | out: AdapterAddresses=0xf07840*(Alignment=0x7000001c0, Length=0x1c0, IfIndex=0x7, Next=0xf07ab0, AdapterName="{E96D977E-F067-4CE9-924D-F6E0A04729E4}", FirstUnicastAddress=0x0, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #2", FriendlyName="Ethernet 2", PhysicalAddress=([0]=0x38, [1]=0x6e, [2]=0x21, [3]=0x4a, [4]=0x9f, [5]=0x7d, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x1c5, DdnsEnabled=0x1c5, RegisterAdapterSuffix=0x1c5, Dhcpv4Enabled=0x1c5, ReceiveOnly=0x1c5, NoMulticast=0x1c5, Ipv6OtherStatefulConfig=0x1c5, NetbiosOverTcpipEnabled=0x1c5, Ipv4Enabled=0x1c5, Ipv6Enabled=0x1c5, Ipv6ManagedAddressConfigurationSupported=0x1c5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x7, ZoneIndices=([0]=0x7, [1]=0x7, [2]=0x7, [3]=0x7, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6008002000000, Dhcpv4Server.lpSockaddr=0xf07a00*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11eb6c9dc20d55b0, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x28, [5]=0xb6, [6]=0x28, [7]=0x5e, [8]=0x0, [9]=0xf, [10]=0xf3, [11]=0xe1, [12]=0x61, [13]=0x38, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x6000ff3, FirstDnsSuffix=0x0), SizePointer=0x118d0c0*=0x9a8) returned 0x0 [0213.216] GetProcessHeap () returned 0x470000 [0213.216] RtlFreeHeap (HeapHandle=0x470000, Flags=0x0, BaseAddress=0xf07840) returned 1 [0213.218] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7ffd8ee77f20 | out: lpflOldProtect=0x7ffd8ee77f20*=0x2) returned 1 [0213.218] LoadLibraryExA (lpLibFileName="DNSAPI.dll", hFile=0x0, dwFlags=0x0) returned 0x7ffda6620000 [0213.229] GetProcAddress (hModule=0x7ffda6620000, lpProcName="DnsQueryConfigAllocEx") returned 0x7ffda6626cf0 [0213.229] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0x118d4f0 | out: lpflOldProtect=0x118d4f0*=0x4) returned 1 [0213.229] DnsQueryConfigAllocEx () returned 0xf189d0 [0213.235] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7ffd8ee77f20 | out: lpflOldProtect=0x7ffd8ee77f20*=0x2) returned 1 [0213.235] GetProcAddress (hModule=0x7ffda6620000, lpProcName="DnsFreeConfigStructure") returned 0x7ffda665c9a0 [0213.236] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0x118d4f0 | out: lpflOldProtect=0x118d4f0*=0x4) returned 1 [0213.236] DnsFreeConfigStructure () returned 0x1 [0213.237] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7ffd8ee77f20 | out: lpflOldProtect=0x7ffd8ee77f20*=0x2) returned 1 [0213.238] GetProcAddress (hModule=0x7ffda6620000, lpProcName="DnsQueryConfigDword") returned 0x7ffda6626bc0 [0213.238] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0x118d4f0 | out: lpflOldProtect=0x118d4f0*=0x4) returned 1 [0213.238] DnsQueryConfigDword () returned 0x1 [0213.238] DnsQueryConfigDword () returned 0x0 [0213.239] malloc (_Size=0x18) returned 0xdb62c0 [0213.239] SafeArrayPutElement (psa=0x4cffc0, rgIndices=0x118d280, pv=0x4d0cd8) returned 0x0 [0213.240] free (_Block=0xdb62c0) [0213.242] LoadLibraryExW (lpLibFileName="iphlpapi.dll", hFile=0x0, dwFlags=0x0) returned 0x7ffda17d0000 [0213.242] GetProcAddress (hModule=0x7ffda17d0000, lpProcName="GetAdapterIndex") returned 0x7ffda17eddb0 [0213.242] GetAdapterIndex (in: AdapterName="\\DEVICE\\TCPIP_{E96D977E-F067-4CE9-924D-F6E0A04729E4}", IfIndex=0x118d980 | out: IfIndex=0x118d980) returned 0x0 [0213.243] FreeLibrary (hLibModule=0x7ffda17d0000) returned 1 [0213.243] QueryDosDeviceW (in: lpDeviceName="{E4D2000A-6025-4C58-8789-AF7349886E11}", lpTargetPath=0x118c410, ucchMax=0x200 | out: lpTargetPath="") returned 0x0 [0213.243] GetLastError () returned 0x2 [0213.243] DefineDosDeviceW (dwFlags=0x1, lpDeviceName="{E4D2000A-6025-4C58-8789-AF7349886E11}", lpTargetPath="\\Device\\{E4D2000A-6025-4C58-8789-AF7349886E11}") returned 1 [0213.250] CreateFileW (lpFileName="\\\\.\\{E4D2000A-6025-4C58-8789-AF7349886E11}" (normalized: "{e4d2000a-6025-4c58-8789-af7349886e11}"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0xffffffffffffffff) returned 0xffffffffffffffff [0213.252] DefineDosDeviceW (dwFlags=0x7, lpDeviceName="{E4D2000A-6025-4C58-8789-AF7349886E11}", lpTargetPath="\\Device\\{E4D2000A-6025-4C58-8789-AF7349886E11}") returned 1 [0213.254] LoadLibraryExW (lpLibFileName="iphlpapi.dll", hFile=0x0, dwFlags=0x0) returned 0x7ffda17d0000 [0213.254] GetProcAddress (hModule=0x7ffda17d0000, lpProcName="GetAdapterIndex") returned 0x7ffda17eddb0 [0213.255] GetAdapterIndex (in: AdapterName="\\DEVICE\\TCPIP_{E4D2000A-6025-4C58-8789-AF7349886E11}", IfIndex=0x118d980 | out: IfIndex=0x118d980) returned 0x0 [0213.255] FreeLibrary (hLibModule=0x7ffda17d0000) returned 1 [0213.256] free (_Block=0xdb4ca0) [0213.257] free (_Block=0xdb4e80) [0213.258] free (_Block=0xdb4ed0) [0213.258] free (_Block=0xdb4d90) [0213.259] free (_Block=0xdb5100) [0213.259] free (_Block=0xdb4f20) [0213.260] free (_Block=0xdb67e0) [0213.260] free (_Block=0xdb6a50) [0213.261] free (_Block=0xdb6960) [0213.262] free (_Block=0xdb0490) [0213.262] free (_Block=0xdb6ae0) [0213.263] free (_Block=0xdb6810) [0213.264] free (_Block=0xdb0110) [0213.264] free (_Block=0xdb03b0) [0213.265] free (_Block=0xdb66c0) [0213.265] free (_Block=0xdb68a0) [0213.265] free (_Block=0xdb6b40) [0213.266] free (_Block=0xdb6cd0) [0224.752] malloc (_Size=0x600) returned 0xdbad50 [0224.752] GetLogicalProcessorInformationEx (in: RelationshipType=0xffff, Buffer=0x0, ReturnedLength=0x118d7f8 | out: Buffer=0x0, ReturnedLength=0x118d7f8) returned 0 [0224.752] GetLastError () returned 0x7a [0224.752] malloc (_Size=0x250) returned 0xdb5890 [0224.752] GetLogicalProcessorInformationEx (in: RelationshipType=0xffff, Buffer=0xdb5890, ReturnedLength=0x118d7f8 | out: Buffer=0xdb5890, ReturnedLength=0x118d7f8) returned 1 [0224.752] GetActiveProcessorCount (GroupNumber=0xffff) returned 0x4 [0224.752] GetMaximumProcessorGroupCount () returned 0x1 [0224.753] malloc (_Size=0x40) returned 0xdb4d90 [0224.753] malloc (_Size=0x40) returned 0xdb4fc0 [0224.753] malloc (_Size=0x8) returned 0xdb5720 [0224.753] memcpy (in: _Dst=0xdb4d90, _Src=0xdb58b0, _Size=0x10 | out: _Dst=0xdb4d90) returned 0xdb4d90 [0224.753] GetActiveProcessorCount (GroupNumber=0x0) returned 0x4 [0224.753] NtPowerInformation (in: InformationLevel=0x2e, InputBuffer=0x118d7f0, InputBufferLength=0x2, OutputBuffer=0xdbad50, OutputBufferLength=0x60 | out: OutputBuffer=0xdbad50) returned 0x0 [0224.753] _vsnwprintf (in: _Buffer=0x118d690, _BufferCount=0x63, _Format="CPU%d", _ArgList=0x118cf88 | out: _Buffer="CPU0") returned 4 [0224.753] GetCurrentThread () returned 0xfffffffffffffffe [0224.753] SetThreadGroupAffinity (in: hThread=0xfffffffffffffffe, GroupAffinity=0x118cee0, PreviousGroupAffinity=0x118cef0 | out: PreviousGroupAffinity=0x118cef0) returned 1 [0224.754] GetSystemInfo (in: lpSystemInfo=0x118d020 | out: lpSystemInfo=0x118d020*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0224.754] mbstowcs (in: _Dest=0x118d2a8, _Source="GenuineIntel", _MaxCount=0x28 | out: _Dest="GenuineIntel") returned 0xc [0224.754] _wcsicmp (_String1="GenuineIntel", _String2="GenuineIntel") returned 0 [0224.756] mbstowcs (in: _Dest=0x118d118, _Source="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", _MaxCount=0x28 | out: _Dest="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x27 [0224.756] GetCurrentThread () returned 0xfffffffffffffffe [0224.756] SetThreadGroupAffinity (in: hThread=0xfffffffffffffffe, GroupAffinity=0x118cef0, PreviousGroupAffinity=0x0 | out: PreviousGroupAffinity=0x0) returned 1 [0224.756] LoadStringW (in: hInstance=0x7ffd8ecc0000, uID=0x2c, lpBuffer=0x118ccf0, cchBufferMax=256 | out: lpBuffer="CPU %d") returned 0x6 [0224.800] malloc (_Size=0x34c34) returned 0xdd6f00 [0224.810] _wtoi (_String="238") returned 238 [0224.810] _wtoi (_String="6") returned 6 [0224.810] _itow (in: _Dest=0x0, _Radix=18404800 | out: _Dest=0x0) returned="0" [0224.810] _itow (in: _Dest=0xee, _Radix=18403088 | out: _Dest=0xee) returned="238" [0224.810] malloc (_Size=0x4000) returned 0xe0bb40 [0224.810] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x0, lpData=0xe0bb40, lpcbData=0x118cee4*=0x4000 | out: lpType=0x0, lpData=0xe0bb40*=0x50, lpcbData=0x118cee4*=0x600) returned 0x0 [0224.811] free (_Block=0xe0bb40) [0224.811] Sleep (dwMilliseconds=0x3e8) [0225.812] _itow (in: _Dest=0xee, _Radix=18403088 | out: _Dest=0xee) returned="238" [0225.812] malloc (_Size=0x4000) returned 0xe0bb40 [0225.812] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x0, lpData=0xe0bb40, lpcbData=0x118cee4*=0x4000 | out: lpType=0x0, lpData=0xe0bb40*=0x50, lpcbData=0x118cee4*=0x600) returned 0x0 [0225.813] free (_Block=0xe0bb40) [0225.815] free (_Block=0xdd6f00) [0225.815] _vsnwprintf (in: _Buffer=0x118d5c0, _BufferCount=0x40, _Format="%04X%04X%04X%04X", _ArgList=0x118cf88 | out: _Buffer="0F8BFBFF00050654") returned 16 [0225.815] lstrlenW (lpString=" 0") returned 2 [0225.815] lstrlenW (lpString="Intel(R) Xeon(R) Gold 6126 CPU @ 2.60GHz") returned 40 [0225.815] lstrlenW (lpString="") returned 0 [0225.815] lstrlenW (lpString="") returned 0 [0225.816] lstrlenW (lpString="") returned 0 [0225.816] IsProcessorFeaturePresent (ProcessorFeature=0x14) returned 1 [0225.816] IsProcessorFeaturePresent (ProcessorFeature=0x15) returned 1 [0225.816] RtlNumberOfSetBitsUlongPtr (Target=0x1) returned 0x1 [0225.816] RtlNumberOfSetBitsUlongPtr (Target=0x2) returned 0x1 [0225.816] RtlNumberOfSetBitsUlongPtr (Target=0x4) returned 0x1 [0225.816] RtlNumberOfSetBitsUlongPtr (Target=0x8) returned 0x1 [0225.816] _vsnwprintf (in: _Buffer=0x118d880, _BufferCount=0x63, _Format="CPU%d", _ArgList=0x118d7c8 | out: _Buffer="CPU0") returned 4 [0225.816] free (_Block=0xdb5720) [0225.817] free (_Block=0xdb4fc0) [0225.817] free (_Block=0xdb4d90) [0225.817] free (_Block=0xdb5890) [0225.817] free (_Block=0xdbad50) Thread: id = 121 os_tid = 0xe34 [0249.731] DllCanUnloadNow () returned 0x1 Thread: id = 122 os_tid = 0xe1c Thread: id = 132 os_tid = 0xf70 Process: id = "6" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x3f306000" os_pid = "0xb48" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x278" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:000287db" [0xc000000f] Region: id = 2429 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2430 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2431 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2432 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 2433 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 2434 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 2435 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 2436 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2437 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 2438 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 2439 start_va = 0x7ff7fa6a0000 end_va = 0x7ff7fa71ffff monitored = 0 entry_point = 0x7ff7fa6b5f50 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 2440 start_va = 0x7ffcb82a0000 end_va = 0x7ffcb8460fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2578 start_va = 0x5c0000 end_va = 0x6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 2579 start_va = 0x7ffcb4950000 end_va = 0x7ffcb4b37fff monitored = 0 entry_point = 0x7ffcb497ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2580 start_va = 0x7ffcb5a50000 end_va = 0x7ffcb5afcfff monitored = 0 entry_point = 0x7ffcb5a681a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2581 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2582 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 2583 start_va = 0x100000 end_va = 0x1bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2584 start_va = 0x7ffcb6b20000 end_va = 0x7ffcb6bbcfff monitored = 0 entry_point = 0x7ffcb6b278a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2585 start_va = 0x400000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 2586 start_va = 0x7ffca7690000 end_va = 0x7ffca7785fff monitored = 0 entry_point = 0x7ffca76c9590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 2587 start_va = 0x7ffcb6360000 end_va = 0x7ffcb65dcfff monitored = 0 entry_point = 0x7ffcb6434970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2588 start_va = 0x7ffcb5b00000 end_va = 0x7ffcb5c1bfff monitored = 0 entry_point = 0x7ffcb5b402b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2589 start_va = 0x7ffcb4b40000 end_va = 0x7ffcb4ba9fff monitored = 0 entry_point = 0x7ffcb4b76d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2590 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2591 start_va = 0x7ffca6cd0000 end_va = 0x7ffca6ce5fff monitored = 0 entry_point = 0x7ffca6cd55e0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 2592 start_va = 0x7ffca9de0000 end_va = 0x7ffca9e5efff monitored = 1 entry_point = 0x7ffca9df7110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 2593 start_va = 0x7ffcb8230000 end_va = 0x7ffcb829afff monitored = 0 entry_point = 0x7ffcb82490c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2594 start_va = 0x7ffcb62e0000 end_va = 0x7ffcb633afff monitored = 0 entry_point = 0x7ffcb62f38b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2595 start_va = 0x7ffcb4750000 end_va = 0x7ffcb4778fff monitored = 0 entry_point = 0x7ffcb4764530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2596 start_va = 0x1c0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 2597 start_va = 0x1c0000 end_va = 0x1c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 2598 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 2599 start_va = 0x7ffcb5c40000 end_va = 0x7ffcb5ce6fff monitored = 0 entry_point = 0x7ffcb5c558d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2600 start_va = 0x6c0000 end_va = 0x9f6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2601 start_va = 0x7ffcb6010000 end_va = 0x7ffcb6165fff monitored = 0 entry_point = 0x7ffcb601a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2602 start_va = 0x7ffcb57f0000 end_va = 0x7ffcb5975fff monitored = 0 entry_point = 0x7ffcb583ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2603 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 2604 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 2605 start_va = 0x480000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000480000" filename = "" Region: id = 2606 start_va = 0xa00000 end_va = 0xb87fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a00000" filename = "" Region: id = 2607 start_va = 0xb90000 end_va = 0xd10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b90000" filename = "" Region: id = 2608 start_va = 0x540000 end_va = 0x541fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 2609 start_va = 0x550000 end_va = 0x550fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 2610 start_va = 0x560000 end_va = 0x564fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 2611 start_va = 0xd20000 end_va = 0xdfcfff monitored = 0 entry_point = 0xd7e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2612 start_va = 0x7ffcb48c0000 end_va = 0x7ffcb48cefff monitored = 0 entry_point = 0x7ffcb48c3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2613 start_va = 0x570000 end_va = 0x570fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 2614 start_va = 0xd20000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d20000" filename = "" Region: id = 2615 start_va = 0xda0000 end_va = 0xe9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 2616 start_va = 0x580000 end_va = 0x580fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000580000" filename = "" Region: id = 2617 start_va = 0x7ffcb61d0000 end_va = 0x7ffcb6276fff monitored = 0 entry_point = 0x7ffcb61db4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2618 start_va = 0x590000 end_va = 0x590fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000590000" filename = "" Region: id = 2619 start_va = 0x7ffca85e0000 end_va = 0x7ffca85f0fff monitored = 0 entry_point = 0x7ffca85e2fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2620 start_va = 0x7ffcb5980000 end_va = 0x7ffcb5a40fff monitored = 0 entry_point = 0x7ffcb59a0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2621 start_va = 0xea0000 end_va = 0xfe2fff monitored = 0 entry_point = 0xec8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2622 start_va = 0xea0000 end_va = 0xf7cfff monitored = 0 entry_point = 0xefe0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2623 start_va = 0xea0000 end_va = 0xf1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 2624 start_va = 0xf20000 end_va = 0xf9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f20000" filename = "" Region: id = 2625 start_va = 0xfa0000 end_va = 0x101ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fa0000" filename = "" Region: id = 2626 start_va = 0x7ffca7670000 end_va = 0x7ffca7683fff monitored = 0 entry_point = 0x7ffca7671800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 3070 start_va = 0x1020000 end_va = 0x109ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 3071 start_va = 0x10a0000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010a0000" filename = "" Region: id = 3072 start_va = 0x1120000 end_va = 0x119ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 3073 start_va = 0x7ffca7640000 end_va = 0x7ffca7664fff monitored = 0 entry_point = 0x7ffca7649900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 3074 start_va = 0x7ffcb0a60000 end_va = 0x7ffcb0c2efff monitored = 1 entry_point = 0x7ffcb0a87df0 region_type = mapped_file name = "cimwin32.dll" filename = "\\Windows\\System32\\wbem\\cimwin32.dll" (normalized: "c:\\windows\\system32\\wbem\\cimwin32.dll") Region: id = 3075 start_va = 0x7ffcb48d0000 end_va = 0x7ffcb491afff monitored = 0 entry_point = 0x7ffcb48d35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 3076 start_va = 0x7ffcb2d80000 end_va = 0x7ffcb2dcdfff monitored = 0 entry_point = 0x7ffcb2d91ce0 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 3077 start_va = 0x7ffcb45a0000 end_va = 0x7ffcb45ccfff monitored = 0 entry_point = 0x7ffcb45b9d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3078 start_va = 0x180000000 end_va = 0x180002fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wmi.dll" filename = "\\Windows\\System32\\wmi.dll" (normalized: "c:\\windows\\system32\\wmi.dll") Region: id = 3079 start_va = 0x7ffcaf080000 end_va = 0x7ffcaf090fff monitored = 0 entry_point = 0x7ffcaf083320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Thread: id = 148 os_tid = 0xb4c [0310.594] malloc (_Size=0x100) returned 0x1e5460 [0310.595] GetProcessHeap () returned 0x5c0000 [0310.595] __dllonexit () returned 0x7ffca9df9c10 [0310.595] GetProcessHeap () returned 0x5c0000 [0310.595] __dllonexit () returned 0x7ffca9df9c20 [0310.595] __dllonexit () returned 0x7ffca9df9c30 [0310.598] GetTickCount () returned 0xdc75 [0310.598] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0xc4 [0310.598] LoadLibraryExW (lpLibFileName="API-MS-Win-Core-LocalRegistry-L1-1-0.dll", hFile=0x0, dwFlags=0x8) returned 0x7ffcb4950000 [0310.598] GetProcAddress (hModule=0x7ffcb4950000, lpProcName="RegCreateKeyExW") returned 0x7ffcb496be60 [0310.599] RegCreateKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\WBEM\\CIMOM", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x3, lpSecurityAttributes=0x0, phkResult=0xcf198, lpdwDisposition=0xcf140 | out: phkResult=0xcf198*=0x0, lpdwDisposition=0xcf140*=0x2) returned 0x5 [0310.599] GetSystemDirectoryW (in: lpBuffer=0x7ffca9e543ac, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0310.600] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WBEM\\Logs\\" (normalized: "c:\\windows\\system32\\wbem\\logs")) returned 0x10 [0310.600] GetLastError () returned 0x0 [0310.600] RegCreateKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\WBEM\\CIMOM", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0xcf198, lpdwDisposition=0xcf140 | out: phkResult=0xcf198*=0x0, lpdwDisposition=0xcf140*=0x2) returned 0x5 [0310.601] _vsnwprintf (in: _Buffer=0xcf100, _BufferCount=0x1d, _Format="%d", _ArgList=0xcf0e8 | out: _Buffer="1") returned 1 [0310.601] _vsnwprintf (in: _Buffer=0xcf100, _BufferCount=0x1d, _Format="%d", _ArgList=0xcf0e8 | out: _Buffer="65536") returned 5 [0310.601] __dllonexit () returned 0x7ffca9df9c40 [0310.602] __dllonexit () returned 0x7ffca9df9c50 [0310.602] __dllonexit () returned 0x7ffca9df9c60 [0310.602] __dllonexit () returned 0x7ffca9df9c70 [0310.602] __dllonexit () returned 0x7ffca9df9c80 [0310.606] DisableThreadLibraryCalls (hLibModule=0x7ffca9de0000) returned 1 [0310.606] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x30) returned 0x5cb810 [0310.606] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x30) returned 0x5cb850 [0310.606] GetVersion () returned 0x295a000a [0310.606] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x7ffcb82a0000 [0310.606] GetProcAddress (hModule=0x7ffcb82a0000, lpProcName="EtwRegisterTraceGuidsW") returned 0x7ffcb82f3ce0 [0310.606] EtwRegisterTraceGuidsW () returned 0x0 [0310.607] EtwRegisterTraceGuidsW () returned 0x0 [0316.170] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5e9aa0 [0317.169] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-0.dll", hFile=0x0, dwFlags=0x8) returned 0x7ffcb4950000 [0317.170] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-obsolete-l1-1-0.dll", hFile=0x0, dwFlags=0x8) returned 0x7ffcb4950000 [0317.170] GetProcAddress (hModule=0x7ffcb4950000, lpProcName="GetThreadPreferredUILanguages") returned 0x7ffcb49b3720 [0317.170] GetProcAddress (hModule=0x7ffcb4950000, lpProcName="SetThreadPreferredUILanguages") returned 0x7ffcb49b0a30 [0317.170] GetProcAddress (hModule=0x7ffcb4950000, lpProcName="LocaleNameToLCID") returned 0x7ffcb495e330 [0317.171] GetProcAddress (hModule=0x7ffcb4950000, lpProcName="GetLocaleInfoEx") returned 0x7ffcb4960710 [0317.171] GetProcAddress (hModule=0x7ffcb4950000, lpProcName="LCIDToLocaleName") returned 0x7ffcb49ae2c0 [0317.171] GetProcAddress (hModule=0x7ffcb4950000, lpProcName="GetSystemDefaultLocaleName") returned 0x7ffcb49bef70 [0317.171] RtlRestoreLastWin32Error () returned 0x302000 [0317.171] GetThreadPreferredUILanguages (in: dwFlags=0x30, pulNumLanguages=0xcfb1c, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xcf9a0 | out: pulNumLanguages=0xcfb1c, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xcf9a0) returned 1 [0317.171] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x18) returned 0x5de010 [0317.172] RtlRestoreLastWin32Error () returned 0x302000 [0317.172] GetThreadPreferredUILanguages (in: dwFlags=0x30, pulNumLanguages=0xcfb1c, pwszLanguagesBuffer=0x5de010, pcchLanguagesBuffer=0xcf9a0 | out: pulNumLanguages=0xcfb1c, pwszLanguagesBuffer=0x5de010, pcchLanguagesBuffer=0xcf9a0) returned 1 [0317.172] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x18) returned 0x5dd9b0 [0317.172] LocaleNameToLCID (lpName="en-US", dwFlags=0x0) returned 0x409 [0317.177] LocaleNameToLCID (lpName="en", dwFlags=0x0) returned 0x409 [0317.177] RtlFreeHeap (HeapHandle=0x5c0000, Flags=0x0, BaseAddress=0x5de010) returned 1 [0317.201] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0317.202] RtlFreeHeap (HeapHandle=0x5c0000, Flags=0x0, BaseAddress=0x5dd9b0) returned 1 [0317.224] GetProcAddress (hModule=0x7ffcb4950000, lpProcName="RegOpenKeyExW") returned 0x7ffcb496f350 [0317.225] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\WBEM\\CIMOM", ulOptions=0x0, samDesired=0x20019, phkResult=0xcec88 | out: phkResult=0xcec88*=0x1ac) returned 0x0 [0317.225] GetProcAddress (hModule=0x7ffcb4950000, lpProcName="RegQueryValueExW") returned 0x7ffcb496f640 [0317.225] RegQueryValueExW (in: hKey=0x1ac, lpValueName="EnableObjectValidation", lpReserved=0x0, lpType=0xcebf4, lpData=0xcec00, lpcbData=0xcebf0*=0x19 | out: lpType=0xcebf4*=0x0, lpData=0xcec00*=0x88, lpcbData=0xcebf0*=0x19) returned 0x2 [0317.225] GetProcAddress (hModule=0x7ffcb4950000, lpProcName="RegCloseKey") returned 0x7ffcb4970c00 [0317.225] RegCloseKey (hKey=0x1ac) returned 0x0 [0317.226] ResolveDelayLoadedAPI () returned 0x7ffcb5990ae0 Thread: id = 149 os_tid = 0xb64 Thread: id = 150 os_tid = 0xbac Thread: id = 151 os_tid = 0xbb4 Thread: id = 152 os_tid = 0xbb8 [0317.454] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0317.455] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0317.947] RtlRestoreLastWin32Error () returned 0x30a000 [0317.947] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xf9e118, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xf9e010 | out: pulNumLanguages=0xf9e118, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xf9e010) returned 1 [0317.947] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5e99f0 [0317.947] RtlRestoreLastWin32Error () returned 0x30a000 [0317.947] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0xf9e118, pwszLanguagesBuffer=0x5e99f0, pcchLanguagesBuffer=0xf9e010 | out: pulNumLanguages=0xf9e118, pwszLanguagesBuffer=0x5e99f0, pcchLanguagesBuffer=0xf9e010) returned 1 [0317.947] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5e9a20 [0317.947] RtlFreeHeap (HeapHandle=0x5c0000, Flags=0x0, BaseAddress=0x5e99f0) returned 1 [0317.947] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x607730 [0317.947] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x607730, pulNumLanguages=0xf9e118 | out: pulNumLanguages=0xf9e118) returned 1 [0317.947] RtlFreeHeap (HeapHandle=0x5c0000, Flags=0x0, BaseAddress=0x607730) returned 1 [0317.951] malloc (_Size=0xa8) returned 0xdc27f0 [0317.951] LoadLibraryExW (lpLibFileName="WMI.DLL", hFile=0x0, dwFlags=0x0) returned 0x180000000 [0317.954] GetProcAddress (hModule=0x180000000, lpProcName="WmiQueryAllDataW") returned 0x7ffcaf083050 [0317.957] GetProcAddress (hModule=0x180000000, lpProcName="WmiQuerySingleInstanceW") returned 0x7ffcaf083690 [0317.958] GetProcAddress (hModule=0x180000000, lpProcName="WmiSetSingleItemW") returned 0x7ffcaf0861a0 [0317.958] GetProcAddress (hModule=0x180000000, lpProcName="WmiSetSingleInstanceW") returned 0x7ffcaf085f10 [0317.958] GetProcAddress (hModule=0x180000000, lpProcName="WmiExecuteMethodW") returned 0x7ffcaf084e00 [0317.958] GetProcAddress (hModule=0x180000000, lpProcName="WmiNotificationRegistrationW") Thread: id = 153 os_tid = 0xbbc Thread: id = 222 os_tid = 0xbc0 Thread: id = 223 os_tid = 0xbc4 [0317.476] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5e9950 [0317.476] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x607ad0 [0317.476] RtlFreeHeap (HeapHandle=0x5c0000, Flags=0x0, BaseAddress=0x5e9950) returned 1 [0317.476] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x2c) returned 0x5fd690 [0317.476] RtlFreeHeap (HeapHandle=0x5c0000, Flags=0x0, BaseAddress=0x607ad0) returned 1 [0317.476] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc8) returned 0x5e29d0 [0317.477] RtlFreeHeap (HeapHandle=0x5c0000, Flags=0x0, BaseAddress=0x5e29d0) returned 1 [0317.477] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x34) returned 0x5fd150 [0317.478] RtlFreeHeap (HeapHandle=0x5c0000, Flags=0x0, BaseAddress=0x5fd150) returned 1 [0317.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x80) returned 0x605ae0 [0317.478] RtlFreeHeap (HeapHandle=0x5c0000, Flags=0x0, BaseAddress=0x5fd690) returned 1 [0317.480] memcpy (in: _Dst=0x111da00, _Src=0x60a228, _Size=0x4 | out: _Dst=0x111da00) returned 0x111da00 [0317.481] memcpy (in: _Dst=0x111da00, _Src=0x609b35, _Size=0x4 | out: _Dst=0x111da00) returned 0x111da00 [0317.481] memcpy (in: _Dst=0x111da00, _Src=0x60a230, _Size=0x2 | out: _Dst=0x111da00) returned 0x111da00 [0317.481] memcpy (in: _Dst=0x111da00, _Src=0x609b3b, _Size=0x2 | out: _Dst=0x111da00) returned 0x111da00 [0317.482] memcpy (in: _Dst=0x111da00, _Src=0x609b3d, _Size=0x2 | out: _Dst=0x111da00) returned 0x111da00 [0317.630] memcpy (in: _Dst=0x111deb0, _Src=0x60d285, _Size=0x2 | out: _Dst=0x111deb0) returned 0x111deb0 [0317.631] memcpy (in: _Dst=0x111deb0, _Src=0x60d287, _Size=0x2 | out: _Dst=0x111deb0) returned 0x111deb0 [0317.631] memcpy (in: _Dst=0x111deb0, _Src=0x60d289, _Size=0x2 | out: _Dst=0x111deb0) returned 0x111deb0 [0317.631] memcpy (in: _Dst=0x111deb0, _Src=0x60d28b, _Size=0x2 | out: _Dst=0x111deb0) returned 0x111deb0 [0317.632] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x28) returned 0x60a630 [0317.632] SafeArrayGetElemsize (psa=0x5fd260) returned 0x8 [0317.634] memcpy (in: _Dst=0x111dc60, _Src=0x111db98, _Size=0x8 | out: _Dst=0x111dc60) returned 0x111dc60 [0317.635] RtlFreeHeap (HeapHandle=0x5c0000, Flags=0x0, BaseAddress=0x60a630) returned 1 [0317.636] RtlFreeHeap (HeapHandle=0x5c0000, Flags=0x0, BaseAddress=0x5dfe90) returned 1 [0317.636] memcpy (in: _Dst=0x111deb0, _Src=0x60cc4a, _Size=0x4 | out: _Dst=0x111deb0) returned 0x111deb0 [0317.736] malloc (_Size=0x100) returned 0xda19a0 [0317.736] malloc (_Size=0x30) returned 0x1eda50 [0317.736] __dllonexit () returned 0x7ffcb0a90410 [0317.736] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x208 [0317.736] __dllonexit () returned 0x7ffcb0a903f0 [0317.738] malloc (_Size=0x18) returned 0x1eefb0 [0317.738] __dllonexit () returned 0x7ffcb0a90400 [0317.739] __dllonexit () returned 0x7ffcb0a90420 [0317.739] __dllonexit () returned 0x7ffcb0a90430 [0317.739] __dllonexit () returned 0x7ffcb0a90440 [0317.740] __dllonexit () returned 0x7ffcb0a90450 [0317.740] malloc (_Size=0x60) returned 0xdaee60 [0317.740] malloc (_Size=0x18) returned 0x1e16a0 [0317.740] malloc (_Size=0x18) returned 0x1ee7c0 [0317.740] __dllonexit () returned 0x7ffcb0a90460 [0317.740] __dllonexit () returned 0x7ffcb0a90470 [0317.740] __dllonexit () returned 0x7ffcb0a90480 [0317.741] __dllonexit () returned 0x7ffcb0a90490 [0317.741] __dllonexit () returned 0x7ffcb0a904a0 [0317.741] __dllonexit () returned 0x7ffcb0a904b0 [0317.742] __dllonexit () returned 0x7ffcb0a904c0 [0317.742] __dllonexit () returned 0x7ffcb0a904d0 [0317.742] __dllonexit () returned 0x7ffcb0a904e0 [0317.743] __dllonexit () returned 0x7ffcb0a904f0 [0317.743] __dllonexit () returned 0x7ffcb0a90500 [0317.743] __dllonexit () returned 0x7ffcb0a90510 [0317.743] __dllonexit () returned 0x7ffcb0a90520 [0317.743] __dllonexit () returned 0x7ffcb0a90530 [0317.744] __dllonexit () returned 0x7ffcb0a90540 [0317.745] VirtualQuery (in: lpAddress=0x7ffcb0c2a000, lpBuffer=0x111b630, dwLength=0x30 | out: lpBuffer=0x111b630*(BaseAddress=0x7ffcb0c2a000, AllocationBase=0x7ffcb0a60000, AllocationProtect=0x80, __alignment1=0xfffff803, RegionSize=0x5000, State=0x1000, Protect=0x2, Type=0x1000000, __alignment2=0xffff8000)) returned 0x30 [0317.745] VirtualProtect (in: lpAddress=0x7ffcb0c2a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7ffcb0c17f20 | out: lpflOldProtect=0x7ffcb0c17f20*=0x2) returned 1 [0317.745] LoadLibraryExA (lpLibFileName="api-ms-win-core-com-l1-1-1.dll", hFile=0x0, dwFlags=0x0) returned 0x7ffcb6360000 [0317.745] GetProcAddress (hModule=0x7ffcb6360000, lpProcName="StringFromGUID2") returned 0x7ffcb63a24b0 [0317.745] VirtualProtect (in: lpAddress=0x7ffcb0c2a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0x111b780 | out: lpflOldProtect=0x111b780*=0x4) returned 1 [0317.745] StringFromGUID2 (in: rguid=0x7ffcb0b77820*(Data1=0x8ecc055d, Data2=0x47f, Data3=0x11d1, Data4=([0]=0xa5, [1]=0x37, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x75, [6]=0x3e, [7]=0xd1)), lpsz=0xdb004c, cchMax=128 | out: lpsz="{8ECC055D-047F-11D1-A537-0000F8753ED1}") returned 39 [0317.746] __dllonexit () returned 0x7ffcb0a90550 [0317.746] __dllonexit () returned 0x7ffcb0a90560 [0317.746] __dllonexit () returned 0x7ffcb0a90570 [0317.746] __dllonexit () returned 0x7ffcb0a90580 [0317.747] __dllonexit () returned 0x7ffcb0a90590 [0317.747] __dllonexit () returned 0x7ffcb0a905a0 [0317.747] StringFromGUID2 (in: rguid=0x7ffcb0b77820*(Data1=0x8ecc055d, Data2=0x47f, Data3=0x11d1, Data4=([0]=0xa5, [1]=0x37, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x75, [6]=0x3e, [7]=0xd1)), lpsz=0xdb1abc, cchMax=128 | out: lpsz="{8ECC055D-047F-11D1-A537-0000F8753ED1}") returned 39 [0317.747] __dllonexit () returned 0x7ffcb0a905b0 [0317.748] __dllonexit () returned 0x7ffcb0a905c0 [0317.748] __dllonexit () returned 0x7ffcb0a905d0 [0317.748] malloc (_Size=0x60) returned 0xdb1c70 [0317.748] malloc (_Size=0x18) returned 0xdb1ce0 [0317.748] malloc (_Size=0x18) returned 0xdb1d00 [0317.748] __dllonexit () returned 0x7ffcb0a905e0 [0317.748] __dllonexit () returned 0x7ffcb0a905f0 [0317.748] __dllonexit () returned 0x7ffcb0a90600 [0317.749] __dllonexit () returned 0x7ffcb0a90610 [0317.749] __dllonexit () returned 0x7ffcb0a90620 [0317.749] __dllonexit () returned 0x7ffcb0a90630 [0317.749] __dllonexit () returned 0x7ffcb0a90640 [0317.750] __dllonexit () returned 0x7ffcb0a90650 [0317.750] __dllonexit () returned 0x7ffcb0a90680 [0317.750] __dllonexit () returned 0x7ffcb0a90690 [0317.751] __dllonexit () returned 0x7ffcb0a906a0 [0317.751] __dllonexit () returned 0x7ffcb0a906b0 [0317.772] __dllonexit () returned 0x7ffcb0a906e0 [0317.772] __dllonexit () returned 0x7ffcb0a906f0 [0317.772] __dllonexit () returned 0x7ffcb0a90700 [0317.773] __dllonexit () returned 0x7ffcb0a90710 [0317.773] __dllonexit () returned 0x7ffcb0a90720 [0317.773] __dllonexit () returned 0x7ffcb0a90730 [0317.773] __dllonexit () returned 0x7ffcb0a90740 [0317.773] __dllonexit () returned 0x7ffcb0a90750 [0317.773] malloc (_Size=0x28) returned 0xdb1830 [0317.774] __dllonexit () returned 0x7ffcb0a90770 [0317.781] __dllonexit () returned 0x7ffcb0a90760 [0317.781] __dllonexit () returned 0x7ffcb0a90780 [0317.781] __dllonexit () returned 0x7ffcb0a90790 [0317.781] __dllonexit () returned 0x7ffcb0a907a0 [0317.781] __dllonexit () returned 0x7ffcb0a907b0 [0317.781] __dllonexit () returned 0x7ffcb0a907c0 [0317.782] __dllonexit () returned 0x7ffcb0a907d0 [0317.782] __dllonexit () returned 0x7ffcb0a907e0 [0317.782] __dllonexit () returned 0x7ffcb0a907f0 [0317.782] __dllonexit () returned 0x7ffcb0a90800 [0317.782] __dllonexit () returned 0x7ffcb0a90810 [0317.782] __dllonexit () returned 0x7ffcb0a90820 [0317.783] __dllonexit () returned 0x7ffcb0a90830 [0317.783] __dllonexit () returned 0x7ffcb0a90850 [0317.783] __dllonexit () returned 0x7ffcb0a90840 [0317.783] __dllonexit () returned 0x7ffcb0a90860 [0317.783] __dllonexit () returned 0x7ffcb0a90870 [0317.783] __dllonexit () returned 0x7ffcb0a90880 [0317.783] __dllonexit () returned 0x7ffcb0a90890 [0317.783] __dllonexit () returned 0x7ffcb0a908a0 [0317.784] __dllonexit () returned 0x7ffcb0a908b0 [0317.784] __dllonexit () returned 0x7ffcb0a908c0 [0317.784] __dllonexit () returned 0x7ffcb0a908d0 [0317.784] __dllonexit () returned 0x7ffcb0a908e0 [0317.784] __dllonexit () returned 0x7ffcb0a908f0 [0317.784] __dllonexit () returned 0x7ffcb0a90900 [0317.785] __dllonexit () returned 0x7ffcb0a90910 [0317.785] __dllonexit () returned 0x7ffcb0a90920 [0317.785] __dllonexit () returned 0x7ffcb0a90930 [0317.785] __dllonexit () returned 0x7ffcb0a90940 [0317.785] __dllonexit () returned 0x7ffcb0a90950 [0317.785] __dllonexit () returned 0x7ffcb0a90960 [0317.786] __dllonexit () returned 0x7ffcb0a90970 [0317.786] __dllonexit () returned 0x7ffcb0a90980 [0317.786] __dllonexit () returned 0x7ffcb0a90990 [0317.787] __dllonexit () returned 0x7ffcb0a909a0 [0317.787] __dllonexit () returned 0x7ffcb0a909b0 [0317.787] __dllonexit () returned 0x7ffcb0a909c0 [0317.787] __dllonexit () returned 0x7ffcb0a909d0 [0317.787] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x20c [0317.787] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x210 [0317.787] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x214 [0317.787] __dllonexit () returned 0x7ffcb0a909e0 [0317.788] __dllonexit () returned 0x7ffcb0a909f0 [0317.788] __dllonexit () returned 0x7ffcb0a90a20 [0317.788] __dllonexit () returned 0x7ffcb0a90a00 [0317.788] __dllonexit () returned 0x7ffcb0a90a30 [0317.788] __dllonexit () returned 0x7ffcb0a90a10 [0317.788] __dllonexit () returned 0x7ffcb0a90b30 [0317.788] __dllonexit () returned 0x7ffcb0a90a40 [0317.788] __dllonexit () returned 0x7ffcb0a90b20 [0317.789] __dllonexit () returned 0x7ffcb0a90a50 [0317.789] __dllonexit () returned 0x7ffcb0a90af0 [0317.789] __dllonexit () returned 0x7ffcb0a90b40 [0317.789] __dllonexit () returned 0x7ffcb0a90ac0 [0317.789] __dllonexit () returned 0x7ffcb0a90ae0 [0317.789] __dllonexit () returned 0x7ffcb0a90ad0 [0317.789] __dllonexit () returned 0x7ffcb0a90b00 [0317.790] __dllonexit () returned 0x7ffcb0a90a60 [0317.790] __dllonexit () returned 0x7ffcb0a90b50 [0317.790] __dllonexit () returned 0x7ffcb0a90b60 [0317.790] __dllonexit () returned 0x7ffcb0a90a90 [0317.790] __dllonexit () returned 0x7ffcb0a90aa0 [0317.790] __dllonexit () returned 0x7ffcb0a90a70 [0317.790] __dllonexit () returned 0x7ffcb0a90a80 [0317.791] __dllonexit () returned 0x7ffcb0a90b10 [0317.791] __dllonexit () returned 0x7ffcb0a90ab0 [0317.791] __dllonexit () returned 0x7ffcb0a90b80 [0317.791] __dllonexit () returned 0x7ffcb0a90b70 [0317.791] __dllonexit () returned 0x7ffcb0a90b90 [0317.792] __dllonexit () returned 0x7ffcb0a90ba0 [0317.792] __dllonexit () returned 0x7ffcb0a90bb0 [0317.793] __dllonexit () returned 0x7ffcb0a90bc0 [0317.793] __dllonexit () returned 0x7ffcb0a90bd0 [0317.793] __dllonexit () returned 0x7ffcb0a90be0 [0317.793] malloc (_Size=0x1680) returned 0xdb8c00 [0317.794] __dllonexit () returned 0x7ffcb0a90bf0 [0317.794] __dllonexit () returned 0x7ffcb0a90c00 [0317.794] __dllonexit () returned 0x7ffcb0a90c10 [0317.794] __dllonexit () returned 0x7ffcb0a90c40 [0317.795] __dllonexit () returned 0x7ffcb0a90c50 [0317.795] __dllonexit () returned 0x7ffcb0a90c60 [0317.795] __dllonexit () returned 0x7ffcb0a90c70 [0317.795] __dllonexit () returned 0x7ffcb0a90c80 [0317.795] __dllonexit () returned 0x7ffcb0a90c90 [0317.795] __dllonexit () returned 0x7ffcb0a90ca0 [0317.796] __dllonexit () returned 0x7ffcb0a90cb0 [0317.796] __dllonexit () returned 0x7ffcb0a90cc0 [0317.796] __dllonexit () returned 0x7ffcb0a90cd0 [0317.797] __dllonexit () returned 0x7ffcb0a90ce0 [0317.797] __dllonexit () returned 0x7ffcb0a90cf0 [0317.797] __dllonexit () returned 0x7ffcb0a90d00 [0317.798] __dllonexit () returned 0x7ffcb0a90d10 [0317.798] __dllonexit () returned 0x7ffcb0a90d20 [0317.798] __dllonexit () returned 0x7ffcb0a90d30 [0317.798] __dllonexit () returned 0x7ffcb0a90d40 [0317.798] __dllonexit () returned 0x7ffcb0a90d50 [0317.798] __dllonexit () returned 0x7ffcb0a90d60 [0317.799] StringFromGUID2 (in: rguid=0x7ffcb0b77820*(Data1=0x8ecc055d, Data2=0x47f, Data3=0x11d1, Data4=([0]=0xa5, [1]=0x37, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x75, [6]=0x3e, [7]=0xd1)), lpsz=0xdbb3bc, cchMax=128 | out: lpsz="{8ECC055D-047F-11D1-A537-0000F8753ED1}") returned 39 [0317.799] __dllonexit () returned 0x7ffcb0a90d70 [0317.799] __dllonexit () returned 0x7ffcb0a90d80 [0317.800] __dllonexit () returned 0x7ffcb0a90d90 [0317.800] __dllonexit () returned 0x7ffcb0a90da0 [0317.800] __dllonexit () returned 0x7ffcb0a90db0 [0317.800] __dllonexit () returned 0x7ffcb0a90dc0 [0317.801] StringFromGUID2 (in: rguid=0x7ffcb0b77820*(Data1=0x8ecc055d, Data2=0x47f, Data3=0x11d1, Data4=([0]=0xa5, [1]=0x37, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x75, [6]=0x3e, [7]=0xd1)), lpsz=0xdbbecc, cchMax=128 | out: lpsz="{8ECC055D-047F-11D1-A537-0000F8753ED1}") returned 39 [0317.801] __dllonexit () returned 0x7ffcb0a90dd0 [0317.801] __dllonexit () returned 0x7ffcb0a90de0 [0317.801] __dllonexit () returned 0x7ffcb0a90df0 [0317.802] StringFromGUID2 (in: rguid=0x7ffcb0b77820*(Data1=0x8ecc055d, Data2=0x47f, Data3=0x11d1, Data4=([0]=0xa5, [1]=0x37, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x75, [6]=0x3e, [7]=0xd1)), lpsz=0xdbc09c, cchMax=128 | out: lpsz="{8ECC055D-047F-11D1-A537-0000F8753ED1}") returned 39 [0317.802] __dllonexit () returned 0x7ffcb0a90e00 [0317.802] __dllonexit () returned 0x7ffcb0a90e10 [0317.803] StringFromGUID2 (in: rguid=0x7ffcb0b77820*(Data1=0x8ecc055d, Data2=0x47f, Data3=0x11d1, Data4=([0]=0xa5, [1]=0x37, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x75, [6]=0x3e, [7]=0xd1)), lpsz=0xdbd2ec, cchMax=128 | out: lpsz="{8ECC055D-047F-11D1-A537-0000F8753ED1}") returned 39 [0317.803] __dllonexit () returned 0x7ffcb0a90e20 [0317.804] __dllonexit () returned 0x7ffcb0a90e50 [0317.804] __dllonexit () returned 0x7ffcb0a90e60 [0317.804] __dllonexit () returned 0x7ffcb0a90e70 [0317.805] StringFromGUID2 (in: rguid=0x7ffcb0b77820*(Data1=0x8ecc055d, Data2=0x47f, Data3=0x11d1, Data4=([0]=0xa5, [1]=0x37, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x75, [6]=0x3e, [7]=0xd1)), lpsz=0xdbd4bc, cchMax=128 | out: lpsz="{8ECC055D-047F-11D1-A537-0000F8753ED1}") returned 39 [0317.805] __dllonexit () returned 0x7ffcb0a90e80 [0317.805] __dllonexit () returned 0x7ffcb0a90eb0 [0317.805] __dllonexit () returned 0x7ffcb0a90ef0 [0317.805] __dllonexit () returned 0x7ffcb0a90ed0 [0317.806] __dllonexit () returned 0x7ffcb0a90f10 [0317.806] __dllonexit () returned 0x7ffcb0a90ee0 [0317.807] __dllonexit () returned 0x7ffcb0a90ec0 [0317.807] __dllonexit () returned 0x7ffcb0a90f20 [0317.807] __dllonexit () returned 0x7ffcb0a90f00 [0317.808] __dllonexit () returned 0x7ffcb0a90f40 [0317.808] __dllonexit () returned 0x7ffcb0a90f50 [0317.808] __dllonexit () returned 0x7ffcb0a90fd0 [0317.808] __dllonexit () returned 0x7ffcb0a91010 [0317.809] __dllonexit () returned 0x7ffcb0a90f30 [0317.809] __dllonexit () returned 0x7ffcb0a90fa0 [0317.809] __dllonexit () returned 0x7ffcb0a90fb0 [0317.810] __dllonexit () returned 0x7ffcb0a90ff0 [0317.810] __dllonexit () returned 0x7ffcb0a90fe0 [0317.810] __dllonexit () returned 0x7ffcb0a90f60 [0317.811] __dllonexit () returned 0x7ffcb0a90fc0 [0317.811] __dllonexit () returned 0x7ffcb0a91000 [0317.811] __dllonexit () returned 0x7ffcb0a90f70 [0317.812] __dllonexit () returned 0x7ffcb0a90f80 [0317.812] __dllonexit () returned 0x7ffcb0a90f90 [0317.813] StringFromGUID2 (in: rguid=0x7ffcb0b77820*(Data1=0x8ecc055d, Data2=0x47f, Data3=0x11d1, Data4=([0]=0xa5, [1]=0x37, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x75, [6]=0x3e, [7]=0xd1)), lpsz=0xdc078c, cchMax=128 | out: lpsz="{8ECC055D-047F-11D1-A537-0000F8753ED1}") returned 39 [0317.813] __dllonexit () returned 0x7ffcb0a91020 [0317.813] __dllonexit () returned 0x7ffcb0a91030 [0317.813] __dllonexit () returned 0x7ffcb0a91040 [0317.816] __dllonexit () returned 0x7ffcb0a91070 [0317.816] __dllonexit () returned 0x7ffcb0a91080 [0317.816] __dllonexit () returned 0x7ffcb0a91090 [0317.816] __dllonexit () returned 0x7ffcb0a910c0 [0317.817] __dllonexit () returned 0x7ffcb0a910d0 [0317.817] __dllonexit () returned 0x7ffcb0a910e0 [0317.817] __dllonexit () returned 0x7ffcb0a910f0 [0317.817] __dllonexit () returned 0x7ffcb0a91100 [0317.817] __dllonexit () returned 0x7ffcb0a91110 [0317.817] __dllonexit () returned 0x7ffcb0a91120 [0317.817] __dllonexit () returned 0x7ffcb0a91130 [0317.818] __dllonexit () returned 0x7ffcb0a91140 [0317.818] __dllonexit () returned 0x7ffcb0a91150 [0317.818] __dllonexit () returned 0x7ffcb0a91160 [0317.818] malloc (_Size=0x60) returned 0xdc0e10 [0317.818] malloc (_Size=0x18) returned 0xdc0950 [0317.818] malloc (_Size=0x18) returned 0xdc0a90 [0317.818] __dllonexit () returned 0x7ffcb0a91170 [0317.818] __dllonexit () returned 0x7ffcb0a91180 [0317.818] GetVersionExW (in: lpVersionInformation=0x111b750*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x111b750*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0317.819] __dllonexit () returned 0x7ffcb0a91190 [0317.819] __dllonexit () returned 0x7ffcb0a911a0 [0317.819] __dllonexit () returned 0x7ffcb0a911b0 [0317.819] malloc (_Size=0x60) returned 0xdc0e80 [0317.819] malloc (_Size=0x18) returned 0xdc0bd0 [0317.819] malloc (_Size=0x18) returned 0xdc0ab0 [0317.819] __dllonexit () returned 0x7ffcb0a911c0 [0317.819] malloc (_Size=0x60) returned 0xdc0ef0 [0317.819] malloc (_Size=0x18) returned 0xdc09d0 [0317.819] malloc (_Size=0x18) returned 0xdc0b90 [0317.820] __dllonexit () returned 0x7ffcb0a911d0 [0317.820] malloc (_Size=0x60) returned 0xdc0f60 [0317.820] malloc (_Size=0x18) returned 0xdc08f0 [0317.820] malloc (_Size=0x18) returned 0xdc0c50 [0317.820] __dllonexit () returned 0x7ffcb0a911e0 [0317.820] malloc (_Size=0x60) returned 0xdc1720 [0317.820] malloc (_Size=0x18) returned 0xdc09f0 [0317.820] malloc (_Size=0x18) returned 0xdc0910 [0317.820] __dllonexit () returned 0x7ffcb0a911f0 [0317.820] malloc (_Size=0x60) returned 0xdc13a0 [0317.820] malloc (_Size=0x18) returned 0xdc0c10 [0317.820] malloc (_Size=0x18) returned 0xdc0930 [0317.821] __dllonexit () returned 0x7ffcb0a91200 [0317.821] malloc (_Size=0x60) returned 0xdc1640 [0317.821] malloc (_Size=0x18) returned 0xdc0ad0 [0317.821] malloc (_Size=0x18) returned 0xdc0a30 [0317.821] __dllonexit () returned 0x7ffcb0a91210 [0317.821] malloc (_Size=0x60) returned 0xdc1250 [0317.821] malloc (_Size=0x18) returned 0xdc0b70 [0317.821] malloc (_Size=0x18) returned 0xdc0bb0 [0317.821] __dllonexit () returned 0x7ffcb0a91220 [0317.821] malloc (_Size=0x60) returned 0xdc1170 [0317.821] malloc (_Size=0x18) returned 0xdc0bf0 [0317.821] malloc (_Size=0x18) returned 0xdc0a50 [0317.821] __dllonexit () returned 0x7ffcb0a91230 [0317.821] malloc (_Size=0x60) returned 0xdc1020 [0317.821] malloc (_Size=0x18) returned 0xdc0c70 [0317.821] malloc (_Size=0x18) returned 0xdc0af0 [0317.821] __dllonexit () returned 0x7ffcb0a91240 [0317.822] malloc (_Size=0x60) returned 0xdc1410 [0317.822] malloc (_Size=0x18) returned 0xdc0970 [0317.822] malloc (_Size=0x18) returned 0xdc0b10 [0317.822] __dllonexit () returned 0x7ffcb0a91250 [0317.822] malloc (_Size=0x60) returned 0xdc12c0 [0317.822] malloc (_Size=0x18) returned 0xdc0a10 [0317.822] malloc (_Size=0x18) returned 0xdc0990 [0317.822] __dllonexit () returned 0x7ffcb0a91260 [0317.822] DisableThreadLibraryCalls (hLibModule=0x7ffcb0a60000) returned 1 [0317.822] malloc (_Size=0x28) returned 0xdc0680 [0317.823] StringFromGUID2 (in: rguid=0x7ffcb0b78f10*(Data1=0x3dd82d10, Data2=0xe6f1, Data3=0x11d2, Data4=([0]=0xb1, [1]=0x39, [2]=0x0, [3]=0x10, [4]=0x5a, [5]=0x1f, [6]=0x77, [7]=0xa1)), lpsz=0x111b740, cchMax=128 | out: lpsz="{3DD82D10-E6F1-11D2-B139-00105A1F77A1}") returned 39 [0317.823] malloc (_Size=0x30) returned 0xdbf720 [0317.823] malloc (_Size=0x28) returned 0xdbff30 [0317.823] StringFromGUID2 (in: rguid=0x7ffcb0b78f00*(Data1=0xd31b6a3f, Data2=0x9350, Data3=0x40de, Data4=([0]=0xa3, [1]=0xfc, [2]=0xa7, [3]=0xed, [4]=0xeb, [5]=0x9b, [6]=0x7c, [7]=0x63)), lpsz=0x111b740, cchMax=128 | out: lpsz="{D31B6A3F-9350-40DE-A3FC-A7EDEB9B7C63}") returned 39 [0317.823] malloc (_Size=0x30) returned 0xdc1f30 [0317.824] DllGetClassObject (in: rclsid=0x5ee220*(Data1=0xd63a5850, Data2=0x8f16, Data3=0x11cf, Data4=([0]=0x9f, [1]=0x47, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbf, [6]=0x34, [7]=0x5c)), riid=0x111d630*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x111c820 | out: ppv=0x111c820*=0xdc09b0) returned 0x0 [0317.832] GetModuleHandleW (lpModuleName="ntdll") returned 0x7ffcb82a0000 [0317.832] GetProcAddress (hModule=0x7ffcb82a0000, lpProcName="EtwEventRegister") returned 0x7ffcb82f3e50 [0317.832] GetProcAddress (hModule=0x7ffcb82a0000, lpProcName="EtwEventUnregister") returned 0x7ffcb82e7a70 [0317.832] GetProcAddress (hModule=0x7ffcb82a0000, lpProcName="EtwEventWrite") returned 0x7ffcb82e9910 [0317.832] GetProcAddress (hModule=0x7ffcb82a0000, lpProcName="EtwEventActivityIdControl") returned 0x7ffcb8310d40 [0317.832] GetProcAddress (hModule=0x7ffcb82a0000, lpProcName="EtwEventWriteTransfer") returned 0x7ffcb82e98c0 [0317.832] GetProcAddress (hModule=0x7ffcb82a0000, lpProcName="EtwEventEnabled") returned 0x7ffcb82eb260 [0317.833] EtwEventRegister () returned 0x0 [0317.833] EtwEventWrite () returned 0x0 [0317.835] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () [0317.876] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 Thread: id = 224 os_tid = 0xbc8 Process: id = "7" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x74b45000" os_pid = "0x360" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x214" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b285" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 2627 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2628 start_va = 0x20000 end_va = 0x21fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2629 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2630 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2631 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 2632 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 2633 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 2634 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 2635 start_va = 0x110000 end_va = 0x110fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 2636 start_va = 0x120000 end_va = 0x120fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 2637 start_va = 0x130000 end_va = 0x130fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 2638 start_va = 0x140000 end_va = 0x140fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 2639 start_va = 0x150000 end_va = 0x151fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 2640 start_va = 0x160000 end_va = 0x166fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 2641 start_va = 0x170000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 2642 start_va = 0x1f0000 end_va = 0x1f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 2643 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 2644 start_va = 0x400000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 2645 start_va = 0x500000 end_va = 0x5bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2646 start_va = 0x5c0000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 2647 start_va = 0x680000 end_va = 0x686fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 2648 start_va = 0x690000 end_va = 0x690fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 2649 start_va = 0x6a0000 end_va = 0x6a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006a0000" filename = "" Region: id = 2650 start_va = 0x6b0000 end_va = 0x6b3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2651 start_va = 0x6c0000 end_va = 0x6c3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2652 start_va = 0x6d0000 end_va = 0x6d1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006d0000" filename = "" Region: id = 2653 start_va = 0x6e0000 end_va = 0x6e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "activeds.dll.mui" filename = "\\Windows\\System32\\en-US\\activeds.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\activeds.dll.mui") Region: id = 2654 start_va = 0x6f0000 end_va = 0x6fffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 2655 start_va = 0x700000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2656 start_va = 0x800000 end_va = 0x987fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 2657 start_va = 0x990000 end_va = 0xb10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000990000" filename = "" Region: id = 2658 start_va = 0xb20000 end_va = 0xf1afff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b20000" filename = "" Region: id = 2659 start_va = 0xf20000 end_va = 0xf9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f20000" filename = "" Region: id = 2660 start_va = 0xfa0000 end_va = 0xfa1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000fa0000" filename = "" Region: id = 2661 start_va = 0xfb0000 end_va = 0xfb6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fb0000" filename = "" Region: id = 2662 start_va = 0xfc0000 end_va = 0xfc1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000fc0000" filename = "" Region: id = 2663 start_va = 0xfd0000 end_va = 0xfd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fd0000" filename = "" Region: id = 2664 start_va = 0xfe0000 end_va = 0xfe6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "newdev.dll.mui" filename = "\\Windows\\System32\\en-US\\newdev.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\newdev.dll.mui") Region: id = 2665 start_va = 0xff0000 end_va = 0xffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ff0000" filename = "" Region: id = 2666 start_va = 0x1000000 end_va = 0x10fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001000000" filename = "" Region: id = 2667 start_va = 0x1100000 end_va = 0x11fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001100000" filename = "" Region: id = 2668 start_va = 0x1200000 end_va = 0x12fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001200000" filename = "" Region: id = 2669 start_va = 0x1300000 end_va = 0x1636fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2670 start_va = 0x1640000 end_va = 0x173ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001640000" filename = "" Region: id = 2671 start_va = 0x1740000 end_va = 0x183ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001740000" filename = "" Region: id = 2672 start_va = 0x1840000 end_va = 0x193ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001840000" filename = "" Region: id = 2673 start_va = 0x1940000 end_va = 0x1984fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000005.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db") Region: id = 2674 start_va = 0x1990000 end_va = 0x1a1dfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 2675 start_va = 0x1a20000 end_va = 0x1a23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a20000" filename = "" Region: id = 2676 start_va = 0x1a30000 end_va = 0x1a30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a30000" filename = "" Region: id = 2677 start_va = 0x1a40000 end_va = 0x1b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a40000" filename = "" Region: id = 2678 start_va = 0x1b40000 end_va = 0x1c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b40000" filename = "" Region: id = 2679 start_va = 0x1c40000 end_va = 0x1c82fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c40000" filename = "" Region: id = 2680 start_va = 0x1c90000 end_va = 0x1c96fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c90000" filename = "" Region: id = 2681 start_va = 0x1ca0000 end_va = 0x1caffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ca0000" filename = "" Region: id = 2682 start_va = 0x1cb0000 end_va = 0x1cbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001cb0000" filename = "" Region: id = 2683 start_va = 0x1cc0000 end_va = 0x1ccffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001cc0000" filename = "" Region: id = 2684 start_va = 0x1cd0000 end_va = 0x1cdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001cd0000" filename = "" Region: id = 2685 start_va = 0x1ce0000 end_va = 0x1ceffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ce0000" filename = "" Region: id = 2686 start_va = 0x1cf0000 end_va = 0x1cfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001cf0000" filename = "" Region: id = 2687 start_va = 0x1d00000 end_va = 0x1dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d00000" filename = "" Region: id = 2688 start_va = 0x1e00000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 2689 start_va = 0x1f00000 end_va = 0x1ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f00000" filename = "" Region: id = 2690 start_va = 0x2000000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002000000" filename = "" Region: id = 2691 start_va = 0x2100000 end_va = 0x217ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 2692 start_va = 0x2180000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002180000" filename = "" Region: id = 2693 start_va = 0x2200000 end_va = 0x22fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 2694 start_va = 0x2300000 end_va = 0x237ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 2695 start_va = 0x2380000 end_va = 0x247ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002380000" filename = "" Region: id = 2696 start_va = 0x2480000 end_va = 0x257ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 2697 start_va = 0x2580000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002580000" filename = "" Region: id = 2698 start_va = 0x2600000 end_va = 0x267ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 2699 start_va = 0x2680000 end_va = 0x277ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002680000" filename = "" Region: id = 2700 start_va = 0x2780000 end_va = 0x27fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002780000" filename = "" Region: id = 2701 start_va = 0x2800000 end_va = 0x28fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002800000" filename = "" Region: id = 2702 start_va = 0x2900000 end_va = 0x29fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 2703 start_va = 0x2a00000 end_va = 0x2afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 2704 start_va = 0x2b00000 end_va = 0x2bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b00000" filename = "" Region: id = 2705 start_va = 0x2c00000 end_va = 0x2cdffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 2706 start_va = 0x2ce0000 end_va = 0x2ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ce0000" filename = "" Region: id = 2707 start_va = 0x2de0000 end_va = 0x2edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002de0000" filename = "" Region: id = 2708 start_va = 0x2ee0000 end_va = 0x2fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 2709 start_va = 0x2fe0000 end_va = 0x30dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002fe0000" filename = "" Region: id = 2710 start_va = 0x30e0000 end_va = 0x31dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000030e0000" filename = "" Region: id = 2711 start_va = 0x31e0000 end_va = 0x31e3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000031e0000" filename = "" Region: id = 2712 start_va = 0x31f0000 end_va = 0x31fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000031f0000" filename = "" Region: id = 2713 start_va = 0x3200000 end_va = 0x320ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003200000" filename = "" Region: id = 2714 start_va = 0x3210000 end_va = 0x3210fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003210000" filename = "" Region: id = 2715 start_va = 0x3220000 end_va = 0x3220fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003220000" filename = "" Region: id = 2716 start_va = 0x3230000 end_va = 0x3233fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003230000" filename = "" Region: id = 2717 start_va = 0x3240000 end_va = 0x3241fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003240000" filename = "" Region: id = 2718 start_va = 0x3250000 end_va = 0x3250fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003250000" filename = "" Region: id = 2719 start_va = 0x3260000 end_va = 0x327ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003260000" filename = "" Region: id = 2720 start_va = 0x3280000 end_va = 0x3281fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003280000" filename = "" Region: id = 2721 start_va = 0x3290000 end_va = 0x329ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 2722 start_va = 0x32a0000 end_va = 0x32affff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 2723 start_va = 0x32b0000 end_va = 0x32bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 2724 start_va = 0x32c0000 end_va = 0x32cffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 2725 start_va = 0x32d0000 end_va = 0x32dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 2726 start_va = 0x32e0000 end_va = 0x335ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000032e0000" filename = "" Region: id = 2727 start_va = 0x3360000 end_va = 0x33dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003360000" filename = "" Region: id = 2728 start_va = 0x33e0000 end_va = 0x34dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000033e0000" filename = "" Region: id = 2729 start_va = 0x34e0000 end_va = 0x355ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000034e0000" filename = "" Region: id = 2730 start_va = 0x3560000 end_va = 0x3560fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003560000" filename = "" Region: id = 2731 start_va = 0x3570000 end_va = 0x35bdfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003570000" filename = "" Region: id = 2732 start_va = 0x35c0000 end_va = 0x35cffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 2733 start_va = 0x35d0000 end_va = 0x35d6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000035d0000" filename = "" Region: id = 2734 start_va = 0x35e0000 end_va = 0x365ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000035e0000" filename = "" Region: id = 2735 start_va = 0x3660000 end_va = 0x36adfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003660000" filename = "" Region: id = 2736 start_va = 0x36b0000 end_va = 0x36b6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000036b0000" filename = "" Region: id = 2737 start_va = 0x36c0000 end_va = 0x36c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000036c0000" filename = "" Region: id = 2738 start_va = 0x36d0000 end_va = 0x36d6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000036d0000" filename = "" Region: id = 2739 start_va = 0x36e0000 end_va = 0x37dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000036e0000" filename = "" Region: id = 2740 start_va = 0x37e0000 end_va = 0x38dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037e0000" filename = "" Region: id = 2741 start_va = 0x38e0000 end_va = 0x395ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000038e0000" filename = "" Region: id = 2742 start_va = 0x3960000 end_va = 0x39dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003960000" filename = "" Region: id = 2743 start_va = 0x39e0000 end_va = 0x3adffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000039e0000" filename = "" Region: id = 2744 start_va = 0x3ae0000 end_va = 0x3ae1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003ae0000" filename = "" Region: id = 2745 start_va = 0x3af0000 end_va = 0x3af4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll" filename = "\\Windows\\System32\\winnlsres.dll" (normalized: "c:\\windows\\system32\\winnlsres.dll") Region: id = 2746 start_va = 0x3b00000 end_va = 0x3bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b00000" filename = "" Region: id = 2747 start_va = 0x3c00000 end_va = 0x3c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003c00000" filename = "" Region: id = 2748 start_va = 0x3c80000 end_va = 0x3d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003c80000" filename = "" Region: id = 2749 start_va = 0x3d80000 end_va = 0x3dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003d80000" filename = "" Region: id = 2750 start_va = 0x3e00000 end_va = 0x3e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e00000" filename = "" Region: id = 2751 start_va = 0x3e80000 end_va = 0x3f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e80000" filename = "" Region: id = 2752 start_va = 0x3f80000 end_va = 0x3f86fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f80000" filename = "" Region: id = 2753 start_va = 0x3f90000 end_va = 0x3f9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003f90000" filename = "" Region: id = 2754 start_va = 0x3fa0000 end_va = 0x3faffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003fa0000" filename = "" Region: id = 2755 start_va = 0x3fb0000 end_va = 0x3fbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003fb0000" filename = "" Region: id = 2756 start_va = 0x3fc0000 end_va = 0x3fcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003fc0000" filename = "" Region: id = 2757 start_va = 0x3fd0000 end_va = 0x3fdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003fd0000" filename = "" Region: id = 2758 start_va = 0x3fe0000 end_va = 0x3feffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003fe0000" filename = "" Region: id = 2759 start_va = 0x3ff0000 end_va = 0x3ffffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll.mui" filename = "\\Windows\\System32\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winnlsres.dll.mui") Region: id = 2760 start_va = 0x4000000 end_va = 0x40fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004000000" filename = "" Region: id = 2761 start_va = 0x4100000 end_va = 0x41fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004100000" filename = "" Region: id = 2762 start_va = 0x4200000 end_va = 0x4210fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1256.nls" filename = "\\Windows\\System32\\C_1256.NLS" (normalized: "c:\\windows\\system32\\c_1256.nls") Region: id = 2763 start_va = 0x4220000 end_va = 0x4230fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1251.nls" filename = "\\Windows\\System32\\C_1251.NLS" (normalized: "c:\\windows\\system32\\c_1251.nls") Region: id = 2764 start_va = 0x4240000 end_va = 0x4250fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1254.nls" filename = "\\Windows\\System32\\C_1254.NLS" (normalized: "c:\\windows\\system32\\c_1254.nls") Region: id = 2765 start_va = 0x4260000 end_va = 0x4270fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1250.nls" filename = "\\Windows\\System32\\C_1250.NLS" (normalized: "c:\\windows\\system32\\c_1250.nls") Region: id = 2766 start_va = 0x4280000 end_va = 0x4290fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1253.nls" filename = "\\Windows\\System32\\C_1253.NLS" (normalized: "c:\\windows\\system32\\c_1253.nls") Region: id = 2767 start_va = 0x42a0000 end_va = 0x42b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1257.nls" filename = "\\Windows\\System32\\C_1257.NLS" (normalized: "c:\\windows\\system32\\c_1257.nls") Region: id = 2768 start_va = 0x42c0000 end_va = 0x42d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1255.nls" filename = "\\Windows\\System32\\C_1255.NLS" (normalized: "c:\\windows\\system32\\c_1255.nls") Region: id = 2769 start_va = 0x42e0000 end_va = 0x42f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_874.nls" filename = "\\Windows\\System32\\C_874.NLS" (normalized: "c:\\windows\\system32\\c_874.nls") Region: id = 2770 start_va = 0x4300000 end_va = 0x437ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004300000" filename = "" Region: id = 2771 start_va = 0x4380000 end_va = 0x4380fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004380000" filename = "" Region: id = 2772 start_va = 0x4390000 end_va = 0x4396fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004390000" filename = "" Region: id = 2773 start_va = 0x43a0000 end_va = 0x43c7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_932.nls" filename = "\\Windows\\System32\\C_932.NLS" (normalized: "c:\\windows\\system32\\c_932.nls") Region: id = 2774 start_va = 0x43d0000 end_va = 0x43dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043d0000" filename = "" Region: id = 2775 start_va = 0x43e0000 end_va = 0x43effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043e0000" filename = "" Region: id = 2776 start_va = 0x43f0000 end_va = 0x43f3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043f0000" filename = "" Region: id = 2777 start_va = 0x4400000 end_va = 0x44fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004400000" filename = "" Region: id = 2778 start_va = 0x4500000 end_va = 0x45fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004500000" filename = "" Region: id = 2779 start_va = 0x4600000 end_va = 0x46fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004600000" filename = "" Region: id = 2780 start_va = 0x4700000 end_va = 0x477ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004700000" filename = "" Region: id = 2781 start_va = 0x4780000 end_va = 0x487ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004780000" filename = "" Region: id = 2782 start_va = 0x4880000 end_va = 0x48fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004880000" filename = "" Region: id = 2783 start_va = 0x4900000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004900000" filename = "" Region: id = 2784 start_va = 0x4a00000 end_va = 0x59fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a00000" filename = "" Region: id = 2785 start_va = 0x5a00000 end_va = 0x5a03fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a00000" filename = "" Region: id = 2786 start_va = 0x5a10000 end_va = 0x5a1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a10000" filename = "" Region: id = 2787 start_va = 0x5a20000 end_va = 0x5a2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a20000" filename = "" Region: id = 2788 start_va = 0x5a30000 end_va = 0x5a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a30000" filename = "" Region: id = 2789 start_va = 0x5a40000 end_va = 0x5a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a40000" filename = "" Region: id = 2790 start_va = 0x5a50000 end_va = 0x5a50fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msxml6r.dll" filename = "\\Windows\\System32\\msxml6r.dll" (normalized: "c:\\windows\\system32\\msxml6r.dll") Region: id = 2791 start_va = 0x5a60000 end_va = 0x5adffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a60000" filename = "" Region: id = 2792 start_va = 0x5ae0000 end_va = 0x5af0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1258.nls" filename = "\\Windows\\System32\\C_1258.NLS" (normalized: "c:\\windows\\system32\\c_1258.nls") Region: id = 2793 start_va = 0x5b00000 end_va = 0x5bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b00000" filename = "" Region: id = 2794 start_va = 0x5c00000 end_va = 0x5cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005c00000" filename = "" Region: id = 2795 start_va = 0x5d00000 end_va = 0x5dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d00000" filename = "" Region: id = 2796 start_va = 0x5e00000 end_va = 0x5efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e00000" filename = "" Region: id = 2797 start_va = 0x5f00000 end_va = 0x5ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f00000" filename = "" Region: id = 2798 start_va = 0x6000000 end_va = 0x60fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006000000" filename = "" Region: id = 2799 start_va = 0x6100000 end_va = 0x61fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006100000" filename = "" Region: id = 2800 start_va = 0x6200000 end_va = 0x627ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006200000" filename = "" Region: id = 2801 start_va = 0x6280000 end_va = 0x62b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_949.nls" filename = "\\Windows\\System32\\C_949.NLS" (normalized: "c:\\windows\\system32\\c_949.nls") Region: id = 2802 start_va = 0x62c0000 end_va = 0x62c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000062c0000" filename = "" Region: id = 2803 start_va = 0x62d0000 end_va = 0x62dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000062d0000" filename = "" Region: id = 2804 start_va = 0x62e0000 end_va = 0x62effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000062e0000" filename = "" Region: id = 2805 start_va = 0x62f0000 end_va = 0x62fffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 2806 start_va = 0x6300000 end_va = 0x63fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006300000" filename = "" Region: id = 2807 start_va = 0x6400000 end_va = 0x64fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006400000" filename = "" Region: id = 2808 start_va = 0x6500000 end_va = 0x65fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006500000" filename = "" Region: id = 2809 start_va = 0x6600000 end_va = 0x66fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006600000" filename = "" Region: id = 2810 start_va = 0x6700000 end_va = 0x67fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006700000" filename = "" Region: id = 2811 start_va = 0x6800000 end_va = 0x68fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006800000" filename = "" Region: id = 2812 start_va = 0x6900000 end_va = 0x69fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006900000" filename = "" Region: id = 2813 start_va = 0x6a00000 end_va = 0x6afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006a00000" filename = "" Region: id = 2814 start_va = 0x6b00000 end_va = 0x6bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006b00000" filename = "" Region: id = 2815 start_va = 0x6c00000 end_va = 0x6cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006c00000" filename = "" Region: id = 2816 start_va = 0x6d00000 end_va = 0x6dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006d00000" filename = "" Region: id = 2817 start_va = 0x6e00000 end_va = 0x6efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006e00000" filename = "" Region: id = 2818 start_va = 0x6f00000 end_va = 0x6ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006f00000" filename = "" Region: id = 2819 start_va = 0x7000000 end_va = 0x70fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007000000" filename = "" Region: id = 2820 start_va = 0x7100000 end_va = 0x71fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007100000" filename = "" Region: id = 2821 start_va = 0x7200000 end_va = 0x72fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007200000" filename = "" Region: id = 2822 start_va = 0x7300000 end_va = 0x73fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007300000" filename = "" Region: id = 2823 start_va = 0x7400000 end_va = 0x74fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007400000" filename = "" Region: id = 2824 start_va = 0x7500000 end_va = 0x75fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007500000" filename = "" Region: id = 2825 start_va = 0x7600000 end_va = 0x76fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007600000" filename = "" Region: id = 2826 start_va = 0x7700000 end_va = 0x77fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007700000" filename = "" Region: id = 2827 start_va = 0x7800000 end_va = 0x78fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007800000" filename = "" Region: id = 2828 start_va = 0x7900000 end_va = 0x79fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007900000" filename = "" Region: id = 2829 start_va = 0x7a00000 end_va = 0x7afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007a00000" filename = "" Region: id = 2830 start_va = 0x7b00000 end_va = 0x7bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007b00000" filename = "" Region: id = 2831 start_va = 0x7c00000 end_va = 0x7cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c00000" filename = "" Region: id = 2832 start_va = 0x7d00000 end_va = 0x7dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007d00000" filename = "" Region: id = 2833 start_va = 0x7e00000 end_va = 0x7efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007e00000" filename = "" Region: id = 2834 start_va = 0x7f00000 end_va = 0x7ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007f00000" filename = "" Region: id = 2835 start_va = 0x8000000 end_va = 0x80fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008000000" filename = "" Region: id = 2836 start_va = 0x8100000 end_va = 0x81fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008100000" filename = "" Region: id = 2837 start_va = 0x8200000 end_va = 0x82fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008200000" filename = "" Region: id = 2838 start_va = 0x8300000 end_va = 0x83fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008300000" filename = "" Region: id = 2839 start_va = 0x8400000 end_va = 0x84fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008400000" filename = "" Region: id = 2840 start_va = 0x8500000 end_va = 0x85fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008500000" filename = "" Region: id = 2841 start_va = 0x8600000 end_va = 0x8603fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008600000" filename = "" Region: id = 2842 start_va = 0x8610000 end_va = 0x8613fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008610000" filename = "" Region: id = 2843 start_va = 0x8800000 end_va = 0x88fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008800000" filename = "" Region: id = 2844 start_va = 0x8900000 end_va = 0x89fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008900000" filename = "" Region: id = 2845 start_va = 0x8a00000 end_va = 0x8afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008a00000" filename = "" Region: id = 2846 start_va = 0x8b00000 end_va = 0x8bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008b00000" filename = "" Region: id = 2847 start_va = 0x8c00000 end_va = 0x8cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008c00000" filename = "" Region: id = 2848 start_va = 0x8d00000 end_va = 0x8dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008d00000" filename = "" Region: id = 2849 start_va = 0x8e00000 end_va = 0x8efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008e00000" filename = "" Region: id = 2850 start_va = 0x8f00000 end_va = 0x8ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008f00000" filename = "" Region: id = 2851 start_va = 0x9000000 end_va = 0x90fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009000000" filename = "" Region: id = 2852 start_va = 0x9100000 end_va = 0x91fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009100000" filename = "" Region: id = 2853 start_va = 0x9200000 end_va = 0x9230fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_936.nls" filename = "\\Windows\\System32\\C_936.NLS" (normalized: "c:\\windows\\system32\\c_936.nls") Region: id = 2854 start_va = 0x9240000 end_va = 0x9270fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_950.nls" filename = "\\Windows\\System32\\C_950.NLS" (normalized: "c:\\windows\\system32\\c_950.nls") Region: id = 2855 start_va = 0x9280000 end_va = 0x937ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009280000" filename = "" Region: id = 2856 start_va = 0x9380000 end_va = 0x947ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009380000" filename = "" Region: id = 2857 start_va = 0x9480000 end_va = 0x957ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009480000" filename = "" Region: id = 2858 start_va = 0x9580000 end_va = 0x967ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009580000" filename = "" Region: id = 2859 start_va = 0x9680000 end_va = 0x977ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009680000" filename = "" Region: id = 2860 start_va = 0x9780000 end_va = 0x987ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009780000" filename = "" Region: id = 2861 start_va = 0x9880000 end_va = 0x997ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009880000" filename = "" Region: id = 2862 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2863 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 2864 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 2865 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 2866 start_va = 0x7ff603290000 end_va = 0x7ff60329cfff monitored = 0 entry_point = 0x7ff603293980 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 2867 start_va = 0x7ffca4340000 end_va = 0x7ffca4353fff monitored = 0 entry_point = 0x7ffca4345080 region_type = mapped_file name = "windows.staterepositorybroker.dll" filename = "\\Windows\\System32\\Windows.StateRepositoryBroker.dll" (normalized: "c:\\windows\\system32\\windows.staterepositorybroker.dll") Region: id = 2868 start_va = 0x7ffca5110000 end_va = 0x7ffca5145fff monitored = 0 entry_point = 0x7ffca51127f0 region_type = mapped_file name = "windows.networking.hostname.dll" filename = "\\Windows\\System32\\Windows.Networking.HostName.dll" (normalized: "c:\\windows\\system32\\windows.networking.hostname.dll") Region: id = 2869 start_va = 0x7ffca5150000 end_va = 0x7ffca51a1fff monitored = 0 entry_point = 0x7ffca5153d30 region_type = mapped_file name = "cryptngc.dll" filename = "\\Windows\\System32\\cryptngc.dll" (normalized: "c:\\windows\\system32\\cryptngc.dll") Region: id = 2870 start_va = 0x7ffca61b0000 end_va = 0x7ffca61c5fff monitored = 0 entry_point = 0x7ffca61b1d50 region_type = mapped_file name = "wwapi.dll" filename = "\\Windows\\System32\\wwapi.dll" (normalized: "c:\\windows\\system32\\wwapi.dll") Region: id = 2871 start_va = 0x7ffca6300000 end_va = 0x7ffca632efff monitored = 0 entry_point = 0x7ffca630ec60 region_type = mapped_file name = "cryptnet.dll" filename = "\\Windows\\System32\\cryptnet.dll" (normalized: "c:\\windows\\system32\\cryptnet.dll") Region: id = 2872 start_va = 0x7ffca6360000 end_va = 0x7ffca6373fff monitored = 0 entry_point = 0x7ffca6363710 region_type = mapped_file name = "mskeyprotect.dll" filename = "\\Windows\\System32\\mskeyprotect.dll" (normalized: "c:\\windows\\system32\\mskeyprotect.dll") Region: id = 2873 start_va = 0x7ffca6380000 end_va = 0x7ffca63d4fff monitored = 0 entry_point = 0x7ffca639f870 region_type = mapped_file name = "ncryptprov.dll" filename = "\\Windows\\System32\\ncryptprov.dll" (normalized: "c:\\windows\\system32\\ncryptprov.dll") Region: id = 2874 start_va = 0x7ffca63e0000 end_va = 0x7ffca63fdfff monitored = 0 entry_point = 0x7ffca63eef80 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\System32\\ncryptsslp.dll" (normalized: "c:\\windows\\system32\\ncryptsslp.dll") Region: id = 2875 start_va = 0x7ffca6940000 end_va = 0x7ffca697efff monitored = 0 entry_point = 0x7ffca69682d0 region_type = mapped_file name = "tcpipcfg.dll" filename = "\\Windows\\System32\\tcpipcfg.dll" (normalized: "c:\\windows\\system32\\tcpipcfg.dll") Region: id = 2876 start_va = 0x7ffca69c0000 end_va = 0x7ffca69d6fff monitored = 0 entry_point = 0x7ffca69c6620 region_type = mapped_file name = "msauserext.dll" filename = "\\Windows\\System32\\msauserext.dll" (normalized: "c:\\windows\\system32\\msauserext.dll") Region: id = 2877 start_va = 0x7ffca69e0000 end_va = 0x7ffca6bdffff monitored = 0 entry_point = 0x7ffca6a55240 region_type = mapped_file name = "wlidsvc.dll" filename = "\\Windows\\System32\\wlidsvc.dll" (normalized: "c:\\windows\\system32\\wlidsvc.dll") Region: id = 2878 start_va = 0x7ffca6c00000 end_va = 0x7ffca6c10fff monitored = 0 entry_point = 0x7ffca6c07480 region_type = mapped_file name = "tetheringclient.dll" filename = "\\Windows\\System32\\tetheringclient.dll" (normalized: "c:\\windows\\system32\\tetheringclient.dll") Region: id = 2879 start_va = 0x7ffca6c20000 end_va = 0x7ffca6ca3fff monitored = 0 entry_point = 0x7ffca6c38d50 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 2880 start_va = 0x7ffca6cd0000 end_va = 0x7ffca6ce5fff monitored = 0 entry_point = 0x7ffca6cd55e0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 2881 start_va = 0x7ffca6cf0000 end_va = 0x7ffca6dc5fff monitored = 0 entry_point = 0x7ffca6d1a800 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 2882 start_va = 0x7ffca6dd0000 end_va = 0x7ffca6ddefff monitored = 0 entry_point = 0x7ffca6dd4960 region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 2883 start_va = 0x7ffca6e20000 end_va = 0x7ffca6e47fff monitored = 0 entry_point = 0x7ffca6e2efc0 region_type = mapped_file name = "dssenh.dll" filename = "\\Windows\\System32\\dssenh.dll" (normalized: "c:\\windows\\system32\\dssenh.dll") Region: id = 2884 start_va = 0x7ffca6e70000 end_va = 0x7ffca6eeffff monitored = 0 entry_point = 0x7ffca6e9d280 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 2885 start_va = 0x7ffca6f10000 end_va = 0x7ffca6f25fff monitored = 0 entry_point = 0x7ffca6f11af0 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 2886 start_va = 0x7ffca6f30000 end_va = 0x7ffca6f49fff monitored = 0 entry_point = 0x7ffca6f32330 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 2887 start_va = 0x7ffca6f50000 end_va = 0x7ffca6f5cfff monitored = 0 entry_point = 0x7ffca6f51420 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 2888 start_va = 0x7ffca7030000 end_va = 0x7ffca72a9fff monitored = 0 entry_point = 0x7ffca704a7a0 region_type = mapped_file name = "msxml6.dll" filename = "\\Windows\\System32\\msxml6.dll" (normalized: "c:\\windows\\system32\\msxml6.dll") Region: id = 2889 start_va = 0x7ffca75d0000 end_va = 0x7ffca7633fff monitored = 0 entry_point = 0x7ffca75ebed0 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 2890 start_va = 0x7ffca7640000 end_va = 0x7ffca7664fff monitored = 0 entry_point = 0x7ffca7649900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 2891 start_va = 0x7ffca7670000 end_va = 0x7ffca7683fff monitored = 0 entry_point = 0x7ffca7671800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 2892 start_va = 0x7ffca7690000 end_va = 0x7ffca7785fff monitored = 0 entry_point = 0x7ffca76c9590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 2893 start_va = 0x7ffca7790000 end_va = 0x7ffca7803fff monitored = 0 entry_point = 0x7ffca77a5eb0 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 2894 start_va = 0x7ffca7810000 end_va = 0x7ffca7946fff monitored = 0 entry_point = 0x7ffca7850480 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 2895 start_va = 0x7ffca85e0000 end_va = 0x7ffca85f0fff monitored = 0 entry_point = 0x7ffca85e2fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2896 start_va = 0x7ffca8600000 end_va = 0x7ffca861dfff monitored = 0 entry_point = 0x7ffca8603a40 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 2897 start_va = 0x7ffca8620000 end_va = 0x7ffca86a1fff monitored = 0 entry_point = 0x7ffca8622a10 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 2898 start_va = 0x7ffca86b0000 end_va = 0x7ffca86f1fff monitored = 0 entry_point = 0x7ffca86b3670 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 2899 start_va = 0x7ffca8740000 end_va = 0x7ffca8752fff monitored = 0 entry_point = 0x7ffca8741b10 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 2900 start_va = 0x7ffca8760000 end_va = 0x7ffca87e1fff monitored = 0 entry_point = 0x7ffca8761790 region_type = mapped_file name = "newdev.dll" filename = "\\Windows\\System32\\newdev.dll" (normalized: "c:\\windows\\system32\\newdev.dll") Region: id = 2901 start_va = 0x7ffca87f0000 end_va = 0x7ffca8873fff monitored = 0 entry_point = 0x7ffca8802830 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 2902 start_va = 0x7ffca8880000 end_va = 0x7ffca88e4fff monitored = 0 entry_point = 0x7ffca8893170 region_type = mapped_file name = "wuuhext.dll" filename = "\\Windows\\System32\\wuuhext.dll" (normalized: "c:\\windows\\system32\\wuuhext.dll") Region: id = 2903 start_va = 0x7ffca88f0000 end_va = 0x7ffca8b25fff monitored = 0 entry_point = 0x7ffca897a450 region_type = mapped_file name = "wuaueng.dll" filename = "\\Windows\\System32\\wuaueng.dll" (normalized: "c:\\windows\\system32\\wuaueng.dll") Region: id = 2904 start_va = 0x7ffca8b30000 end_va = 0x7ffca8b75fff monitored = 0 entry_point = 0x7ffca8b379a0 region_type = mapped_file name = "adsldp.dll" filename = "\\Windows\\System32\\adsldp.dll" (normalized: "c:\\windows\\system32\\adsldp.dll") Region: id = 2905 start_va = 0x7ffca8b80000 end_va = 0x7ffca8bbffff monitored = 0 entry_point = 0x7ffca8b8cbe0 region_type = mapped_file name = "adsldpc.dll" filename = "\\Windows\\System32\\adsldpc.dll" (normalized: "c:\\windows\\system32\\adsldpc.dll") Region: id = 2906 start_va = 0x7ffca8bc0000 end_va = 0x7ffca8c06fff monitored = 0 entry_point = 0x7ffca8bc1d10 region_type = mapped_file name = "activeds.dll" filename = "\\Windows\\System32\\activeds.dll" (normalized: "c:\\windows\\system32\\activeds.dll") Region: id = 2907 start_va = 0x7ffca8c20000 end_va = 0x7ffca8c3efff monitored = 0 entry_point = 0x7ffca8c237e0 region_type = mapped_file name = "netsetupapi.dll" filename = "\\Windows\\System32\\NetSetupApi.dll" (normalized: "c:\\windows\\system32\\netsetupapi.dll") Region: id = 2908 start_va = 0x7ffca8c40000 end_va = 0x7ffca8cb8fff monitored = 0 entry_point = 0x7ffca8c476a0 region_type = mapped_file name = "netsetupshim.dll" filename = "\\Windows\\System32\\NetSetupShim.dll" (normalized: "c:\\windows\\system32\\netsetupshim.dll") Region: id = 2909 start_va = 0x7ffca8cd0000 end_va = 0x7ffca8d0ffff monitored = 0 entry_point = 0x7ffca8ce6c60 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 2910 start_va = 0x7ffca8d10000 end_va = 0x7ffca8d18fff monitored = 0 entry_point = 0x7ffca8d121d0 region_type = mapped_file name = "httpprxc.dll" filename = "\\Windows\\System32\\httpprxc.dll" (normalized: "c:\\windows\\system32\\httpprxc.dll") Region: id = 2911 start_va = 0x7ffca8d20000 end_va = 0x7ffca8dc2fff monitored = 0 entry_point = 0x7ffca8d22c10 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 2912 start_va = 0x7ffca8dd0000 end_va = 0x7ffca8e21fff monitored = 0 entry_point = 0x7ffca8dd5770 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 2913 start_va = 0x7ffca8e60000 end_va = 0x7ffca8e8dfff monitored = 1 entry_point = 0x7ffca8e62300 region_type = mapped_file name = "wmidcom.dll" filename = "\\Windows\\System32\\wmidcom.dll" (normalized: "c:\\windows\\system32\\wmidcom.dll") Region: id = 2914 start_va = 0x7ffca8e90000 end_va = 0x7ffca8eedfff monitored = 0 entry_point = 0x7ffca8e95080 region_type = mapped_file name = "miutils.dll" filename = "\\Windows\\System32\\miutils.dll" (normalized: "c:\\windows\\system32\\miutils.dll") Region: id = 2915 start_va = 0x7ffca8ef0000 end_va = 0x7ffca8f0ffff monitored = 0 entry_point = 0x7ffca8ef1f50 region_type = mapped_file name = "mi.dll" filename = "\\Windows\\System32\\mi.dll" (normalized: "c:\\windows\\system32\\mi.dll") Region: id = 2916 start_va = 0x7ffca8f10000 end_va = 0x7ffca8f18fff monitored = 0 entry_point = 0x7ffca8f118f0 region_type = mapped_file name = "sscoreext.dll" filename = "\\Windows\\System32\\sscoreext.dll" (normalized: "c:\\windows\\system32\\sscoreext.dll") Region: id = 2917 start_va = 0x7ffca8f20000 end_va = 0x7ffca8f30fff monitored = 0 entry_point = 0x7ffca8f21d30 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 2918 start_va = 0x7ffca9130000 end_va = 0x7ffca9428fff monitored = 0 entry_point = 0x7ffca91f7280 region_type = mapped_file name = "esent.dll" filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll") Region: id = 2919 start_va = 0x7ffca9660000 end_va = 0x7ffca9677fff monitored = 0 entry_point = 0x7ffca9664e10 region_type = mapped_file name = "adhsvc.dll" filename = "\\Windows\\System32\\adhsvc.dll" (normalized: "c:\\windows\\system32\\adhsvc.dll") Region: id = 2920 start_va = 0x7ffca9680000 end_va = 0x7ffca96a4fff monitored = 0 entry_point = 0x7ffca9685ca0 region_type = mapped_file name = "httpprxm.dll" filename = "\\Windows\\System32\\httpprxm.dll" (normalized: "c:\\windows\\system32\\httpprxm.dll") Region: id = 2921 start_va = 0x7ffca96b0000 end_va = 0x7ffca96f0fff monitored = 0 entry_point = 0x7ffca96b3750 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 2922 start_va = 0x7ffca9700000 end_va = 0x7ffca97f2fff monitored = 0 entry_point = 0x7ffca9725d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 2923 start_va = 0x7ffca9800000 end_va = 0x7ffca9821fff monitored = 0 entry_point = 0x7ffca9812540 region_type = mapped_file name = "updatepolicy.dll" filename = "\\Windows\\System32\\updatepolicy.dll" (normalized: "c:\\windows\\system32\\updatepolicy.dll") Region: id = 2924 start_va = 0x7ffca99d0000 end_va = 0x7ffca9a1bfff monitored = 0 entry_point = 0x7ffca99e5310 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 2925 start_va = 0x7ffca9be0000 end_va = 0x7ffca9bf7fff monitored = 0 entry_point = 0x7ffca9be2000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 2926 start_va = 0x7ffca9c00000 end_va = 0x7ffca9d81fff monitored = 0 entry_point = 0x7ffca9c182a0 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 2927 start_va = 0x7ffca9de0000 end_va = 0x7ffca9e5efff monitored = 0 entry_point = 0x7ffca9df7110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 2928 start_va = 0x7ffca9e60000 end_va = 0x7ffca9e9bfff monitored = 0 entry_point = 0x7ffca9e66aa0 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 2929 start_va = 0x7ffca9ed0000 end_va = 0x7ffca9edbfff monitored = 0 entry_point = 0x7ffca9ed35c0 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2930 start_va = 0x7ffca9f00000 end_va = 0x7ffcaa239fff monitored = 0 entry_point = 0x7ffca9f08520 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 2931 start_va = 0x7ffcaa240000 end_va = 0x7ffcaa274fff monitored = 0 entry_point = 0x7ffcaa24a270 region_type = mapped_file name = "fwpolicyiomgr.dll" filename = "\\Windows\\System32\\fwpolicyiomgr.dll" (normalized: "c:\\windows\\system32\\fwpolicyiomgr.dll") Region: id = 2932 start_va = 0x7ffcab940000 end_va = 0x7ffcab955fff monitored = 0 entry_point = 0x7ffcab94b550 region_type = mapped_file name = "clipc.dll" filename = "\\Windows\\System32\\Clipc.dll" (normalized: "c:\\windows\\system32\\clipc.dll") Region: id = 2933 start_va = 0x7ffcabab0000 end_va = 0x7ffcabb43fff monitored = 0 entry_point = 0x7ffcabae9210 region_type = mapped_file name = "staterepository.core.dll" filename = "\\Windows\\System32\\StateRepository.Core.dll" (normalized: "c:\\windows\\system32\\staterepository.core.dll") Region: id = 2934 start_va = 0x7ffcabb50000 end_va = 0x7ffcabdf2fff monitored = 0 entry_point = 0x7ffcabb76190 region_type = mapped_file name = "windows.staterepository.dll" filename = "\\Windows\\System32\\Windows.StateRepository.dll" (normalized: "c:\\windows\\system32\\windows.staterepository.dll") Region: id = 2935 start_va = 0x7ffcac290000 end_va = 0x7ffcac2d3fff monitored = 0 entry_point = 0x7ffcac29c010 region_type = mapped_file name = "execmodelclient.dll" filename = "\\Windows\\System32\\ExecModelClient.dll" (normalized: "c:\\windows\\system32\\execmodelclient.dll") Region: id = 2936 start_va = 0x7ffcac7b0000 end_va = 0x7ffcac7c1fff monitored = 0 entry_point = 0x7ffcac7b3580 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 2937 start_va = 0x7ffcac860000 end_va = 0x7ffcac869fff monitored = 0 entry_point = 0x7ffcac8614c0 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 2938 start_va = 0x7ffcac870000 end_va = 0x7ffcac880fff monitored = 0 entry_point = 0x7ffcac8728d0 region_type = mapped_file name = "credentialmigrationhandler.dll" filename = "\\Windows\\System32\\CredentialMigrationHandler.dll" (normalized: "c:\\windows\\system32\\credentialmigrationhandler.dll") Region: id = 2939 start_va = 0x7ffcac890000 end_va = 0x7ffcac8a4fff monitored = 0 entry_point = 0x7ffcac892dc0 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll") Region: id = 2940 start_va = 0x7ffcac9d0000 end_va = 0x7ffcaca6afff monitored = 0 entry_point = 0x7ffcac9d7220 region_type = mapped_file name = "settingsync.dll" filename = "\\Windows\\System32\\SettingSync.dll" (normalized: "c:\\windows\\system32\\settingsync.dll") Region: id = 2941 start_va = 0x7ffcace50000 end_va = 0x7ffcace5ffff monitored = 0 entry_point = 0x7ffcace51700 region_type = mapped_file name = "proximityservicepal.dll" filename = "\\Windows\\System32\\ProximityServicePal.dll" (normalized: "c:\\windows\\system32\\proximityservicepal.dll") Region: id = 2942 start_va = 0x7ffcace60000 end_va = 0x7ffcace68fff monitored = 0 entry_point = 0x7ffcace61ed0 region_type = mapped_file name = "proximitycommonpal.dll" filename = "\\Windows\\System32\\ProximityCommonPal.dll" (normalized: "c:\\windows\\system32\\proximitycommonpal.dll") Region: id = 2943 start_va = 0x7ffcace70000 end_va = 0x7ffcace9cfff monitored = 0 entry_point = 0x7ffcace72290 region_type = mapped_file name = "proximitycommon.dll" filename = "\\Windows\\System32\\ProximityCommon.dll" (normalized: "c:\\windows\\system32\\proximitycommon.dll") Region: id = 2944 start_va = 0x7ffcacea0000 end_va = 0x7ffcacef1fff monitored = 0 entry_point = 0x7ffcacea38e0 region_type = mapped_file name = "proximityservice.dll" filename = "\\Windows\\System32\\ProximityService.dll" (normalized: "c:\\windows\\system32\\proximityservice.dll") Region: id = 2945 start_va = 0x7ffcacf00000 end_va = 0x7ffcacf0dfff monitored = 0 entry_point = 0x7ffcacf01460 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 2946 start_va = 0x7ffcad060000 end_va = 0x7ffcad11ffff monitored = 0 entry_point = 0x7ffcad08fd20 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 2947 start_va = 0x7ffcad1e0000 end_va = 0x7ffcad279fff monitored = 0 entry_point = 0x7ffcad1fada0 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 2948 start_va = 0x7ffcad360000 end_va = 0x7ffcad3c6fff monitored = 0 entry_point = 0x7ffcad3663e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2949 start_va = 0x7ffcad4c0000 end_va = 0x7ffcad4d3fff monitored = 0 entry_point = 0x7ffcad4c2d50 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 2950 start_va = 0x7ffcad7c0000 end_va = 0x7ffcad852fff monitored = 0 entry_point = 0x7ffcad7c9680 region_type = mapped_file name = "msvcp_win.dll" filename = "\\Windows\\System32\\msvcp_win.dll" (normalized: "c:\\windows\\system32\\msvcp_win.dll") Region: id = 2951 start_va = 0x7ffcad970000 end_va = 0x7ffcad988fff monitored = 0 entry_point = 0x7ffcad974520 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 2952 start_va = 0x7ffcada40000 end_va = 0x7ffcada4afff monitored = 0 entry_point = 0x7ffcada41d30 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2953 start_va = 0x7ffcadab0000 end_va = 0x7ffcadac9fff monitored = 0 entry_point = 0x7ffcadab2430 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 2954 start_va = 0x7ffcadad0000 end_va = 0x7ffcadae5fff monitored = 0 entry_point = 0x7ffcadad19f0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 2955 start_va = 0x7ffcadb90000 end_va = 0x7ffcadc3dfff monitored = 0 entry_point = 0x7ffcadba80c0 region_type = mapped_file name = "windows.networking.connectivity.dll" filename = "\\Windows\\System32\\Windows.Networking.Connectivity.dll" (normalized: "c:\\windows\\system32\\windows.networking.connectivity.dll") Region: id = 2956 start_va = 0x7ffcadc40000 end_va = 0x7ffcadc51fff monitored = 0 entry_point = 0x7ffcadc49260 region_type = mapped_file name = "rilproxy.dll" filename = "\\Windows\\System32\\rilproxy.dll" (normalized: "c:\\windows\\system32\\rilproxy.dll") Region: id = 2957 start_va = 0x7ffcadc60000 end_va = 0x7ffcadd10fff monitored = 0 entry_point = 0x7ffcadcd88b0 region_type = mapped_file name = "cellularapi.dll" filename = "\\Windows\\System32\\CellularAPI.dll" (normalized: "c:\\windows\\system32\\cellularapi.dll") Region: id = 2958 start_va = 0x7ffcadd20000 end_va = 0x7ffcadd57fff monitored = 0 entry_point = 0x7ffcadd38cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2959 start_va = 0x7ffcade00000 end_va = 0x7ffcade24fff monitored = 0 entry_point = 0x7ffcade12f20 region_type = mapped_file name = "wificonnapi.dll" filename = "\\Windows\\System32\\wificonnapi.dll" (normalized: "c:\\windows\\system32\\wificonnapi.dll") Region: id = 2960 start_va = 0x7ffcade30000 end_va = 0x7ffcade40fff monitored = 0 entry_point = 0x7ffcade37ea0 region_type = mapped_file name = "dcpapi.dll" filename = "\\Windows\\System32\\dcpapi.dll" (normalized: "c:\\windows\\system32\\dcpapi.dll") Region: id = 2961 start_va = 0x7ffcadf70000 end_va = 0x7ffcadf89fff monitored = 0 entry_point = 0x7ffcadf72cf0 region_type = mapped_file name = "locationpelegacywinlocation.dll" filename = "\\Windows\\System32\\LocationPeLegacyWinLocation.dll" (normalized: "c:\\windows\\system32\\locationpelegacywinlocation.dll") Region: id = 2962 start_va = 0x7ffcadf90000 end_va = 0x7ffcadfe4fff monitored = 0 entry_point = 0x7ffcadf93fb0 region_type = mapped_file name = "policymanager.dll" filename = "\\Windows\\System32\\policymanager.dll" (normalized: "c:\\windows\\system32\\policymanager.dll") Region: id = 2963 start_va = 0x7ffcadff0000 end_va = 0x7ffcae026fff monitored = 0 entry_point = 0x7ffcadff6020 region_type = mapped_file name = "gnssadapter.dll" filename = "\\Windows\\System32\\GnssAdapter.dll" (normalized: "c:\\windows\\system32\\gnssadapter.dll") Region: id = 2964 start_va = 0x7ffcae030000 end_va = 0x7ffcae04ffff monitored = 0 entry_point = 0x7ffcae0339a0 region_type = mapped_file name = "locationwinpalmisc.dll" filename = "\\Windows\\System32\\LocationWinPalMisc.dll" (normalized: "c:\\windows\\system32\\locationwinpalmisc.dll") Region: id = 2965 start_va = 0x7ffcae050000 end_va = 0x7ffcae05bfff monitored = 0 entry_point = 0x7ffcae0514d0 region_type = mapped_file name = "locationframeworkps.dll" filename = "\\Windows\\System32\\LocationFrameworkPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkps.dll") Region: id = 2966 start_va = 0x7ffcae060000 end_va = 0x7ffcae0a0fff monitored = 0 entry_point = 0x7ffcae064840 region_type = mapped_file name = "usermgrproxy.dll" filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll") Region: id = 2967 start_va = 0x7ffcae170000 end_va = 0x7ffcae237fff monitored = 0 entry_point = 0x7ffcae1b13f0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 2968 start_va = 0x7ffcae240000 end_va = 0x7ffcae2a0fff monitored = 0 entry_point = 0x7ffcae244b50 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 2969 start_va = 0x7ffcae2b0000 end_va = 0x7ffcae42bfff monitored = 0 entry_point = 0x7ffcae301650 region_type = mapped_file name = "locationframework.dll" filename = "\\Windows\\System32\\LocationFramework.dll" (normalized: "c:\\windows\\system32\\locationframework.dll") Region: id = 2970 start_va = 0x7ffcae430000 end_va = 0x7ffcae43afff monitored = 0 entry_point = 0x7ffcae431770 region_type = mapped_file name = "lfsvc.dll" filename = "\\Windows\\System32\\lfsvc.dll" (normalized: "c:\\windows\\system32\\lfsvc.dll") Region: id = 2971 start_va = 0x7ffcae440000 end_va = 0x7ffcae456fff monitored = 0 entry_point = 0x7ffcae445630 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 2972 start_va = 0x7ffcae460000 end_va = 0x7ffcae48dfff monitored = 0 entry_point = 0x7ffcae467550 region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 2973 start_va = 0x7ffcae670000 end_va = 0x7ffcae755fff monitored = 0 entry_point = 0x7ffcae68cf10 region_type = mapped_file name = "usermgr.dll" filename = "\\Windows\\System32\\usermgr.dll" (normalized: "c:\\windows\\system32\\usermgr.dll") Region: id = 2974 start_va = 0x7ffcae830000 end_va = 0x7ffcae83cfff monitored = 0 entry_point = 0x7ffcae832ca0 region_type = mapped_file name = "csystemeventsbrokerclient.dll" filename = "\\Windows\\System32\\CSystemEventsBrokerClient.dll" (normalized: "c:\\windows\\system32\\csystemeventsbrokerclient.dll") Region: id = 2975 start_va = 0x7ffcae840000 end_va = 0x7ffcae86efff monitored = 0 entry_point = 0x7ffcae848910 region_type = mapped_file name = "wptaskscheduler.dll" filename = "\\Windows\\System32\\WPTaskScheduler.dll" (normalized: "c:\\windows\\system32\\wptaskscheduler.dll") Region: id = 2976 start_va = 0x7ffcae870000 end_va = 0x7ffcae8e9fff monitored = 0 entry_point = 0x7ffcae897630 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 2977 start_va = 0x7ffcae8f0000 end_va = 0x7ffcae939fff monitored = 0 entry_point = 0x7ffcae8fac30 region_type = mapped_file name = "deviceaccess.dll" filename = "\\Windows\\System32\\deviceaccess.dll" (normalized: "c:\\windows\\system32\\deviceaccess.dll") Region: id = 2978 start_va = 0x7ffcae9a0000 end_va = 0x7ffcaea31fff monitored = 0 entry_point = 0x7ffcae9ea780 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 2979 start_va = 0x7ffcaeac0000 end_va = 0x7ffcaead5fff monitored = 0 entry_point = 0x7ffcaeac1b60 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2980 start_va = 0x7ffcaeae0000 end_va = 0x7ffcaeaebfff monitored = 0 entry_point = 0x7ffcaeae2830 region_type = mapped_file name = "bi.dll" filename = "\\Windows\\System32\\bi.dll" (normalized: "c:\\windows\\system32\\bi.dll") Region: id = 2981 start_va = 0x7ffcaeaf0000 end_va = 0x7ffcaeafffff monitored = 0 entry_point = 0x7ffcaeaf1690 region_type = mapped_file name = "wups.dll" filename = "\\Windows\\System32\\wups.dll" (normalized: "c:\\windows\\system32\\wups.dll") Region: id = 2982 start_va = 0x7ffcaeb10000 end_va = 0x7ffcaeb51fff monitored = 0 entry_point = 0x7ffcaeb127d0 region_type = mapped_file name = "mstask.dll" filename = "\\Windows\\System32\\mstask.dll" (normalized: "c:\\windows\\system32\\mstask.dll") Region: id = 2983 start_va = 0x7ffcaebf0000 end_va = 0x7ffcaebfffff monitored = 0 entry_point = 0x7ffcaebf2c60 region_type = mapped_file name = "usermgrcli.dll" filename = "\\Windows\\System32\\usermgrcli.dll" (normalized: "c:\\windows\\system32\\usermgrcli.dll") Region: id = 2984 start_va = 0x7ffcaeff0000 end_va = 0x7ffcaf05dfff monitored = 0 entry_point = 0x7ffcaeff7f60 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 2985 start_va = 0x7ffcaf060000 end_va = 0x7ffcaf072fff monitored = 0 entry_point = 0x7ffcaf0657f0 region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 2986 start_va = 0x7ffcaf080000 end_va = 0x7ffcaf090fff monitored = 0 entry_point = 0x7ffcaf083320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 2987 start_va = 0x7ffcaf260000 end_va = 0x7ffcaf5e1fff monitored = 0 entry_point = 0x7ffcaf2b1220 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 2988 start_va = 0x7ffcaf5f0000 end_va = 0x7ffcaf725fff monitored = 0 entry_point = 0x7ffcaf61f350 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 2989 start_va = 0x7ffcb0770000 end_va = 0x7ffcb0818fff monitored = 0 entry_point = 0x7ffcb0799010 region_type = mapped_file name = "windows.ui.dll" filename = "\\Windows\\System32\\Windows.UI.dll" (normalized: "c:\\windows\\system32\\windows.ui.dll") Region: id = 2990 start_va = 0x7ffcb0820000 end_va = 0x7ffcb092dfff monitored = 0 entry_point = 0x7ffcb086eaa0 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 2991 start_va = 0x7ffcb0c30000 end_va = 0x7ffcb0c6dfff monitored = 0 entry_point = 0x7ffcb0c3a050 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 2992 start_va = 0x7ffcb0c70000 end_va = 0x7ffcb0c96fff monitored = 0 entry_point = 0x7ffcb0c73bf0 region_type = mapped_file name = "profsvcext.dll" filename = "\\Windows\\System32\\profsvcext.dll" (normalized: "c:\\windows\\system32\\profsvcext.dll") Region: id = 2993 start_va = 0x7ffcb0ca0000 end_va = 0x7ffcb0ce0fff monitored = 0 entry_point = 0x7ffcb0cb7eb0 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 2994 start_va = 0x7ffcb0cf0000 end_va = 0x7ffcb0debfff monitored = 0 entry_point = 0x7ffcb0d26df0 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 2995 start_va = 0x7ffcb0df0000 end_va = 0x7ffcb0e44fff monitored = 0 entry_point = 0x7ffcb0dffc00 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 2996 start_va = 0x7ffcb0e50000 end_va = 0x7ffcb0eb3fff monitored = 0 entry_point = 0x7ffcb0e65ae0 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 2997 start_va = 0x7ffcb1080000 end_va = 0x7ffcb113efff monitored = 0 entry_point = 0x7ffcb10a1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2998 start_va = 0x7ffcb1140000 end_va = 0x7ffcb1168fff monitored = 0 entry_point = 0x7ffcb114ca00 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 2999 start_va = 0x7ffcb1170000 end_va = 0x7ffcb11a5fff monitored = 0 entry_point = 0x7ffcb1180070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 3000 start_va = 0x7ffcb1a50000 end_va = 0x7ffcb1a59fff monitored = 0 entry_point = 0x7ffcb1a51660 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 3001 start_va = 0x7ffcb1a60000 end_va = 0x7ffcb1a77fff monitored = 0 entry_point = 0x7ffcb1a65910 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 3002 start_va = 0x7ffcb1a80000 end_va = 0x7ffcb1bccfff monitored = 0 entry_point = 0x7ffcb1ac3da0 region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 3003 start_va = 0x7ffcb2190000 end_va = 0x7ffcb224dfff monitored = 0 entry_point = 0x7ffcb21d2d40 region_type = mapped_file name = "coremessaging.dll" filename = "\\Windows\\System32\\CoreMessaging.dll" (normalized: "c:\\windows\\system32\\coremessaging.dll") Region: id = 3004 start_va = 0x7ffcb2870000 end_va = 0x7ffcb2d02fff monitored = 0 entry_point = 0x7ffcb287f760 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 3005 start_va = 0x7ffcb2d10000 end_va = 0x7ffcb2d76fff monitored = 0 entry_point = 0x7ffcb2d2e710 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 3006 start_va = 0x7ffcb2dd0000 end_va = 0x7ffcb2dd7fff monitored = 0 entry_point = 0x7ffcb2dd13e0 region_type = mapped_file name = "dabapi.dll" filename = "\\Windows\\System32\\dabapi.dll" (normalized: "c:\\windows\\system32\\dabapi.dll") Region: id = 3007 start_va = 0x7ffcb2e10000 end_va = 0x7ffcb2f95fff monitored = 0 entry_point = 0x7ffcb2e5d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 3008 start_va = 0x7ffcb2fa0000 end_va = 0x7ffcb2fbbfff monitored = 0 entry_point = 0x7ffcb2fa37a0 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 3009 start_va = 0x7ffcb2fc0000 end_va = 0x7ffcb2ff1fff monitored = 0 entry_point = 0x7ffcb2fcb0c0 region_type = mapped_file name = "shacct.dll" filename = "\\Windows\\System32\\shacct.dll" (normalized: "c:\\windows\\system32\\shacct.dll") Region: id = 3010 start_va = 0x7ffcb3000000 end_va = 0x7ffcb3012fff monitored = 0 entry_point = 0x7ffcb3002760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 3011 start_va = 0x7ffcb3170000 end_va = 0x7ffcb31affff monitored = 0 entry_point = 0x7ffcb3181960 region_type = mapped_file name = "brokerlib.dll" filename = "\\Windows\\System32\\BrokerLib.dll" (normalized: "c:\\windows\\system32\\brokerlib.dll") Region: id = 3012 start_va = 0x7ffcb3240000 end_va = 0x7ffcb32d5fff monitored = 0 entry_point = 0x7ffcb3265570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3013 start_va = 0x7ffcb32e0000 end_va = 0x7ffcb3306fff monitored = 0 entry_point = 0x7ffcb32e7940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 3014 start_va = 0x7ffcb3330000 end_va = 0x7ffcb33d9fff monitored = 0 entry_point = 0x7ffcb3357910 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 3015 start_va = 0x7ffcb33e0000 end_va = 0x7ffcb34dffff monitored = 0 entry_point = 0x7ffcb3420f80 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 3016 start_va = 0x7ffcb3570000 end_va = 0x7ffcb357bfff monitored = 0 entry_point = 0x7ffcb3572480 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 3017 start_va = 0x7ffcb3640000 end_va = 0x7ffcb3671fff monitored = 0 entry_point = 0x7ffcb3652340 region_type = mapped_file name = "fwbase.dll" filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll") Region: id = 3018 start_va = 0x7ffcb38b0000 end_va = 0x7ffcb38bbfff monitored = 0 entry_point = 0x7ffcb38b2790 region_type = mapped_file name = "hid.dll" filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll") Region: id = 3019 start_va = 0x7ffcb38c0000 end_va = 0x7ffcb38e3fff monitored = 0 entry_point = 0x7ffcb38c3260 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 3020 start_va = 0x7ffcb3a60000 end_va = 0x7ffcb3b53fff monitored = 0 entry_point = 0x7ffcb3a6a960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 3021 start_va = 0x7ffcb3b60000 end_va = 0x7ffcb3ba8fff monitored = 0 entry_point = 0x7ffcb3b6a090 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 3022 start_va = 0x7ffcb3bb0000 end_va = 0x7ffcb3c05fff monitored = 0 entry_point = 0x7ffcb3bc0bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 3023 start_va = 0x7ffcb3d30000 end_va = 0x7ffcb3d3bfff monitored = 0 entry_point = 0x7ffcb3d327e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 3024 start_va = 0x7ffcb3e10000 end_va = 0x7ffcb3e40fff monitored = 0 entry_point = 0x7ffcb3e17d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 3025 start_va = 0x7ffcb3e70000 end_va = 0x7ffcb3ee9fff monitored = 0 entry_point = 0x7ffcb3e91a50 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 3026 start_va = 0x7ffcb3f30000 end_va = 0x7ffcb3f63fff monitored = 0 entry_point = 0x7ffcb3f4ae70 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3027 start_va = 0x7ffcb3f70000 end_va = 0x7ffcb3f79fff monitored = 0 entry_point = 0x7ffcb3f71830 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll") Region: id = 3028 start_va = 0x7ffcb4080000 end_va = 0x7ffcb409efff monitored = 0 entry_point = 0x7ffcb4085d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3029 start_va = 0x7ffcb41f0000 end_va = 0x7ffcb424bfff monitored = 0 entry_point = 0x7ffcb4206f70 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 3030 start_va = 0x7ffcb42a0000 end_va = 0x7ffcb42b6fff monitored = 0 entry_point = 0x7ffcb42a79d0 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 3031 start_va = 0x7ffcb43c0000 end_va = 0x7ffcb43cafff monitored = 0 entry_point = 0x7ffcb43c19a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3032 start_va = 0x7ffcb4400000 end_va = 0x7ffcb4420fff monitored = 0 entry_point = 0x7ffcb4410250 region_type = mapped_file name = "joinutil.dll" filename = "\\Windows\\System32\\joinutil.dll" (normalized: "c:\\windows\\system32\\joinutil.dll") Region: id = 3033 start_va = 0x7ffcb4450000 end_va = 0x7ffcb4489fff monitored = 0 entry_point = 0x7ffcb4458d20 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll") Region: id = 3034 start_va = 0x7ffcb4490000 end_va = 0x7ffcb44b6fff monitored = 0 entry_point = 0x7ffcb44a0aa0 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 3035 start_va = 0x7ffcb45a0000 end_va = 0x7ffcb45ccfff monitored = 0 entry_point = 0x7ffcb45b9d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3036 start_va = 0x7ffcb4730000 end_va = 0x7ffcb4748fff monitored = 0 entry_point = 0x7ffcb4735e10 region_type = mapped_file name = "eventaggregation.dll" filename = "\\Windows\\System32\\EventAggregation.dll" (normalized: "c:\\windows\\system32\\eventaggregation.dll") Region: id = 3037 start_va = 0x7ffcb4750000 end_va = 0x7ffcb4778fff monitored = 0 entry_point = 0x7ffcb4764530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 3038 start_va = 0x7ffcb4780000 end_va = 0x7ffcb4818fff monitored = 0 entry_point = 0x7ffcb47af4e0 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 3039 start_va = 0x7ffcb48c0000 end_va = 0x7ffcb48cefff monitored = 0 entry_point = 0x7ffcb48c3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 3040 start_va = 0x7ffcb48d0000 end_va = 0x7ffcb491afff monitored = 0 entry_point = 0x7ffcb48d35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 3041 start_va = 0x7ffcb4920000 end_va = 0x7ffcb492ffff monitored = 0 entry_point = 0x7ffcb49256e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 3042 start_va = 0x7ffcb4930000 end_va = 0x7ffcb4943fff monitored = 0 entry_point = 0x7ffcb49352e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3043 start_va = 0x7ffcb4950000 end_va = 0x7ffcb4b37fff monitored = 0 entry_point = 0x7ffcb497ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3044 start_va = 0x7ffcb4b40000 end_va = 0x7ffcb4ba9fff monitored = 0 entry_point = 0x7ffcb4b76d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3045 start_va = 0x7ffcb4c60000 end_va = 0x7ffcb4c76fff monitored = 0 entry_point = 0x7ffcb4c61390 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 3046 start_va = 0x7ffcb4c80000 end_va = 0x7ffcb52c3fff monitored = 0 entry_point = 0x7ffcb4e464b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 3047 start_va = 0x7ffcb52d0000 end_va = 0x7ffcb5384fff monitored = 0 entry_point = 0x7ffcb53122e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 3048 start_va = 0x7ffcb5390000 end_va = 0x7ffcb53d2fff monitored = 0 entry_point = 0x7ffcb53a4b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 3049 start_va = 0x7ffcb53e0000 end_va = 0x7ffcb5465fff monitored = 0 entry_point = 0x7ffcb53ed8f0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 3050 start_va = 0x7ffcb5470000 end_va = 0x7ffcb5636fff monitored = 0 entry_point = 0x7ffcb54cdb80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 3051 start_va = 0x7ffcb5640000 end_va = 0x7ffcb5694fff monitored = 0 entry_point = 0x7ffcb5657970 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 3052 start_va = 0x7ffcb56a0000 end_va = 0x7ffcb57e2fff monitored = 0 entry_point = 0x7ffcb56c8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3053 start_va = 0x7ffcb57f0000 end_va = 0x7ffcb5975fff monitored = 0 entry_point = 0x7ffcb583ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3054 start_va = 0x7ffcb5980000 end_va = 0x7ffcb5a40fff monitored = 0 entry_point = 0x7ffcb59a0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3055 start_va = 0x7ffcb5a50000 end_va = 0x7ffcb5afcfff monitored = 0 entry_point = 0x7ffcb5a681a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3056 start_va = 0x7ffcb5b00000 end_va = 0x7ffcb5c1bfff monitored = 0 entry_point = 0x7ffcb5b402b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3057 start_va = 0x7ffcb5c40000 end_va = 0x7ffcb5ce6fff monitored = 0 entry_point = 0x7ffcb5c558d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3058 start_va = 0x7ffcb5ea0000 end_va = 0x7ffcb5ea7fff monitored = 0 entry_point = 0x7ffcb5ea1ea0 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 3059 start_va = 0x7ffcb6010000 end_va = 0x7ffcb6165fff monitored = 0 entry_point = 0x7ffcb601a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3060 start_va = 0x7ffcb6170000 end_va = 0x7ffcb61c1fff monitored = 0 entry_point = 0x7ffcb617f530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3061 start_va = 0x7ffcb61d0000 end_va = 0x7ffcb6276fff monitored = 0 entry_point = 0x7ffcb61db4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3062 start_va = 0x7ffcb62e0000 end_va = 0x7ffcb633afff monitored = 0 entry_point = 0x7ffcb62f38b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3063 start_va = 0x7ffcb6360000 end_va = 0x7ffcb65dcfff monitored = 0 entry_point = 0x7ffcb6434970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3064 start_va = 0x7ffcb6620000 end_va = 0x7ffcb667bfff monitored = 0 entry_point = 0x7ffcb663b720 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 3065 start_va = 0x7ffcb6680000 end_va = 0x7ffcb6aa8fff monitored = 0 entry_point = 0x7ffcb66a8740 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 3066 start_va = 0x7ffcb6b20000 end_va = 0x7ffcb6bbcfff monitored = 0 entry_point = 0x7ffcb6b278a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3067 start_va = 0x7ffcb6cd0000 end_va = 0x7ffcb822efff monitored = 0 entry_point = 0x7ffcb6e311f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 3068 start_va = 0x7ffcb8230000 end_va = 0x7ffcb829afff monitored = 0 entry_point = 0x7ffcb82490c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 3069 start_va = 0x7ffcb82a0000 end_va = 0x7ffcb8460fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Thread: id = 154 os_tid = 0xb44 Thread: id = 155 os_tid = 0xb40 Thread: id = 156 os_tid = 0xb3c Thread: id = 157 os_tid = 0xb38 Thread: id = 158 os_tid = 0xb34 Thread: id = 159 os_tid = 0xb30 Thread: id = 160 os_tid = 0x8d4 Thread: id = 161 os_tid = 0x8c4 Thread: id = 162 os_tid = 0x8c0 Thread: id = 163 os_tid = 0x864 Thread: id = 164 os_tid = 0x84c Thread: id = 165 os_tid = 0x838 Thread: id = 166 os_tid = 0x820 Thread: id = 167 os_tid = 0x810 Thread: id = 168 os_tid = 0x58c Thread: id = 169 os_tid = 0x5a4 Thread: id = 170 os_tid = 0x6e0 Thread: id = 171 os_tid = 0x5b0 Thread: id = 172 os_tid = 0x578 Thread: id = 173 os_tid = 0x5f4 Thread: id = 174 os_tid = 0x5d0 Thread: id = 175 os_tid = 0x514 Thread: id = 176 os_tid = 0x510 Thread: id = 177 os_tid = 0x474 Thread: id = 178 os_tid = 0x46c Thread: id = 179 os_tid = 0x4c0 Thread: id = 180 os_tid = 0x2f4 Thread: id = 181 os_tid = 0x7bc Thread: id = 182 os_tid = 0x7b4 Thread: id = 183 os_tid = 0x7b0 Thread: id = 184 os_tid = 0x7ac Thread: id = 185 os_tid = 0x7a8 Thread: id = 186 os_tid = 0x7a4 Thread: id = 187 os_tid = 0x794 Thread: id = 188 os_tid = 0x788 Thread: id = 189 os_tid = 0x784 Thread: id = 190 os_tid = 0x77c Thread: id = 191 os_tid = 0x778 Thread: id = 192 os_tid = 0x770 Thread: id = 193 os_tid = 0x76c Thread: id = 194 os_tid = 0x73c Thread: id = 195 os_tid = 0x6e4 Thread: id = 196 os_tid = 0x6ac Thread: id = 197 os_tid = 0x63c Thread: id = 198 os_tid = 0x62c Thread: id = 199 os_tid = 0x628 Thread: id = 200 os_tid = 0x460 Thread: id = 201 os_tid = 0x558 Thread: id = 202 os_tid = 0x4bc Thread: id = 203 os_tid = 0x4b0 Thread: id = 204 os_tid = 0x44c Thread: id = 205 os_tid = 0x41c Thread: id = 206 os_tid = 0x3b8 Thread: id = 207 os_tid = 0x3bc Thread: id = 208 os_tid = 0x2d8 Thread: id = 209 os_tid = 0x2b0 Thread: id = 210 os_tid = 0x294 Thread: id = 211 os_tid = 0x258 Thread: id = 212 os_tid = 0x260 Thread: id = 213 os_tid = 0x25c Thread: id = 214 os_tid = 0x210 Thread: id = 215 os_tid = 0x1cc Thread: id = 216 os_tid = 0x184 Thread: id = 217 os_tid = 0x154 Thread: id = 218 os_tid = 0x158 Thread: id = 219 os_tid = 0x3f4 Thread: id = 220 os_tid = 0x378 Thread: id = 221 os_tid = 0x364